idle (firewall farm datagram protocol) through ip slb natpool
Available Languages
Table Of Contents
idle (firewall farm datagram protocol)
idle (firewall farm TCP protocol)
inservice (firewall farm real server)
inservice (server farm real server)
inservice (server farm virtual server)
ip forward-protocol spanning-tree
ip forward-protocol turbo-flood
ip header-compression special-vj
ip icmp rate-limit unreachable
idle (firewall farm datagram protocol)
To specify the minimum time IOS Server Load Balancing (IOS SLB) maintains connection information in the absence of packet activity, use the idle command in firewall farm datagram protocol configuration mode. To restore the default idle duration value, use the no form of this command.
idle duration
no idle
Syntax Description
duration
Idle connection timer duration in seconds. Valid values range from 10 to 65535 seconds. The default is 3600 seconds (1 hour).
Command Default
The default idle duration is 3600 seconds.
Command Modes
Firewall farm datagram protocol configuration (config-slb-fw-udp)
Command History
Examples
The following example instructs IOS SLB to maintain connection information for an idle connection for 120 seconds:
Router(config)# ip slb firewallfarm FIRE1Router(config-slb-fw)# protocol datagramRouter(config-slb-fw-udp)# idle 120Related Commands
protocol datagram
Enters firewall farm datagram protocol configuration mode.
show ip slb firewallfarm
Displays information about the firewall farm configuration.
idle (firewall farm TCP protocol)
To specify the minimum time IOS Server Load Balancing (IOS SLB) maintains connection information in the absence of packet activity, use the idle command in firewall farm TCP protocol configuration mode. To restore the default idle duration value, use the no form of this command.
idle duration
no idle
Syntax Description
duration
Idle connection timer duration in seconds. Valid values range from 10 to 65535 seconds. The default is 3600 seconds (1 hour).
Command Default
The default idle duration is 3600 seconds.
Command Modes
Firewall farm TCP protocol configuration (config-slb-fw-tcp)
Command History
Usage Guidelines
If a client sends a TCP packet that is not a sequence number (SYN) or reset (RST) packet, and IOS SLB does not have a TCP connection object in its table (possibly due to expiration of the idle timer), IOS SLB sends a TCP RST to the client.
If you are configuring an idle timer for HTTP flows, choose a low number such as 120 seconds as a starting point. A low number ensures that the IOS SLB connection database maintains a manageable size if problems at the server, client, or network result in a large number of connections. However, do not choose a value under 60 seconds; such a low value can reduce the efficiency of IOS SLB.
Examples
The following example instructs IOS SLB to maintain connection information for an idle connection for 120 seconds:
Router(config)# ip slb firewallfarm FIRE1Router(config-slb-fw)# protocol tcpRouter(config-slb-fw-tcp)# idle 120Related Commands
protocol tcp
Enters firewall farm TCP protocol configuration mode.
show ip slb firewallfarm
Displays information about the firewall farm configuration.
idle (virtual server)
To specify the minimum time the IOS Server Load Balancing (IOS SLB) maintains connection information in the absence of packet activity, use the idle command in SLB virtual server configuration mode. To restore the default idle duration value, use the no form of this command.
idle [asn request duration | asn msid msid | gtp imsi duration [query [max-queries]] | gtp request duration | ipmobile request duration | radius {request | framed-ip} duration]
no idle [asn request duration | asn msid msid | gtp imsi duration [query [max-queries]] | gtp request duration | ipmobile request duration | radius {request | framed-ip} duration]
Syntax Description
Command Default
The default idle duration is:
•
60 seconds in ASN load balancing.
•
•
•
•
•
•
•
The default setting for the query keyword is no queries.
The default setting for the max-queries argument is 5 queries.
Command Modes
SLB virtual server configuration (config-slb-vserver)
Command History
Usage Guidelines
If a client sends a TCP packet that is not a sequence number (SYN) or reset (RST) packet, and IOS SLB does not have a TCP connection object in its table (possibly due to expiration of the idle timer), IOS SLB sends a TCP RST to the client.
If you are configuring an idle timer for HTTP flows, choose a low number such as 120 seconds as a starting point. A low number ensures that the IOS SLB connection database maintains a manageable size if problems at the server, client, or network result in a large number of connections. However, do not choose a value under 60 seconds (except in GPRS load balancing); such a low value can reduce the efficiency of the IOS SLB feature.
In most environments, the idle timer times out data paths. However, in GPRS load balancing, it times out the session context for signaling paths (not data paths).
In GPRS load balancing without GTP cause code inspection enabled, you must specify an idle timer greater than the longest possible interval between PDP context requests on the serving GPRS support node (SGSN). The longest interval can be expressed using the following algorithm:
Longest interval = T3 x 2(N3-2)
where T3 is the SGSN's T3-RESPONSE counter value and N3 is the SGSN's N3-REQUESTS counter value.
For example, if the T3-RESPONSE counter value is 3 and the N3-REQUESTS counter value is 6, then:
Longest interval = 3 x 2(6-2) = 3 x 2(4) = 3 x 16 = 48 seconds
Given those values, you must specify an idle timer of at least 49 seconds.
Examples
The following example instructs IOS SLB to maintain sticky objects in the GTP IMSI sticky database for 120 seconds:
Router(config)# ip slb vserver PUBLIC_HTTPRouter(config-slb-vserver)# idle gtp imsi 120Related Commands
show ip slb vservers
Displays information about the virtual servers defined to IOS SLB.
virtual
Configures the virtual server attributes.
inservice (DFP agent)
To enable the Dynamic Feedback Protocol (DFP) agent for communication with a DFP manager, use the inservice command in DFP agent configuration mode. To remove the DFP agent from service, use the no form of this command.
inservice
no inservice
Syntax Description
This command has no arguments or keywords.
Command Default
The DFP agent is inactive.
Command Modes
DFP agent configuration (config-dfp)
Command History
Usage Guidelines
A DFP agent is inactive until both of the following conditions are met:
•
•
When you use the no form of this command to remove a DFP agent from service, the DFP agent closes all open connections, and no new connections are assigned.
Examples
In the following example, the DFP agent is enabled for communication with a DFP manager:
Router(config)# ip dfp agent slbRouter(config-dfp)# inserviceRelated Commands
inservice (firewall farm)
To enable the firewall farm for use by IOS Server Load Balancing (IOS SLB), use the inservice command in firewall farm configuration mode. To remove the firewall farm from service, use the no form of this command.
inservice [standby group-name]
no inservice [standby group-name]
Syntax Description
Command Default
The firewall farm is defined to IOS SLB but is not used.
Command Modes
Firewall farm configuration (config-slb-fw)
Command History
Usage Guidelines
When you use the no form of this command to remove a firewall farm from service, the firewall farm acquiesces gracefully. No new connections are assigned, and existing connections are allowed to complete.
Examples
In the following example, the firewall farm is enabled for use by the IOS SLB feature:
Router(config)# ip slb firewallfarm FIRE1Router(config-slb-fw)# inserviceRelated Commands
inservice (firewall farm real server)
To enable the firewall for use by IOS Server Load Balancing (IOS SLB), use the inservice command in firewall farm real server configuration mode. To remove the firewall from service, use the no form of this command.
inservice
no inservice
Syntax Description
This command has no arguments or keywords.
Command Default
The firewall is defined to IOS SLB but is not used.
Command Modes
Firewall farm real server configuration (config-slb-fw-real)
Command History
Usage Guidelines
IOS SLB firewall load balancing uses probes to detect failures. Therefore, if you have not configured a probe, the firewall is not placed in service.
When you use the no form of this command to remove a firewall from service, the firewall acquiesces gracefully. No new connections are assigned, and existing connections are allowed to complete.
Examples
In the following example, the firewall is enabled for use by the IOS SLB feature:
Router(config)# ip slb firewallfarm FIRE1Router(config-slb-fw)# real 10.10.1.1Router(config-slb-fw-real)# inserviceRelated Commands
inservice (server farm real server)
To enable the real server for use by IOS Server Load Balancing (IOS SLB), use the inservice command in SLB server farm real server configuration mode. To remove the real server from service, use the no form of this command.
inservice
no inservice
Syntax Description
This command has no arguments or keywords.
Command Default
The real server is defined to IOS SLB but is not used.
Command Modes
SLB server farm real server configuration (config-slb-sfarm-real)
Command History
Examples
In the following example, the real server is enabled for use by the IOS SLB feature:
Router(config)# ip slb serverfarm PUBLICRouter(config-slb-sfarm)# real 10.10.1.1Router(config-slb-sfarm-real)# inserviceRelated Commands
inservice (server farm virtual server)
To enable the virtual server for use by IOS Server Load Balancing (IOS SLB), use the inservice command in SLB server farm virtual server configuration mode. To remove the virtual server from service, use the no form of this command.
inservice [standby group-name] [active]
no inservice [standby group-name]
Syntax Description
Command Default
The virtual server is defined to IOS SLB but is not used.
Command Modes
SLB server farm virtual server configuration (config-slb-vserver)
Command History
Usage Guidelines
When you use the no form of this command to remove a virtual server from service, the virtual server acquiesces gracefully. No new connections are assigned, and existing connections are allowed to complete.
If the active keyword is configured, and all of the real servers that are associated with the virtual server are inactive, the following actions occur:
•
•
•
Examples
In the following example, the virtual server is enabled for use by the IOS SLB feature:
Router(config)# ip slb vserver PUBLIC_HTTPRouter(config-slb-vserver)# inserviceRelated Commands
show ip slb vservers
Displays information about the virtual servers.
virtual
Configures the virtual server attributes.
interval (custom UDP probe)
To configure a custom User Datagram Protocol (UDP) probe interval, use the interval command in custom UDP probe configuration mode. To remove a custom UDP probe interval configuration, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before reattempting the probe. Valid values range from 1 to 65535 seconds. The default interval is 10 seconds.
Command Default
The default custom UDP probe interval value is 10 seconds.
Command Modes
Custom UDP probe configuration (config-slb-probe)
Command History
Examples
The following example configures a custom UDP probe named PROBE6, enters custom UDP configuration mode, and configures the custom UDP probe timer interval to send every 11 seconds:
Router(config)# ip slb probe PROBE6 custom udpRouter(config-slb-probe)# interval 11Related Commands
interval (DFP agent)
To configure a Dynamic Feedback Protocol (DFP) agent weight recalculation interval, use the interval command in DFP agent configuration mode. To restore the default setting, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before recalculating weights for the DFP manager. The valid range is from 5 to 65535 seconds. The default is 10 seconds.
Command Default
The default interval value is 10 seconds.
Command Modes
DFP agent configuration (config-dfp)
Command History
Usage Guidelines
The DFP agent sends a new weight to the DFP manager only if the new weight is different from the old weight. If the new weight is the same as the old weight, it is not sent to the DFP manager.
Examples
The following example shows how to configure the DFP agent to recalculate weights every 11 seconds:
Router(config)# ip dfp agent slbRouter(config-dfp)# interval 11Related Commands
interval (DNS probe)
To configure a DNS probe interval, use the interval command in DNS probe configuration mode. To remove a DNS probe interval configuration, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before reattempting the probe. Valid values range from 1 to 65535 seconds. The default interval is 10 seconds.
Command Default
The default DNS probe interval value is 10 seconds.
Command Modes
DNS probe configuration (config-slb-probe)
Command History
Examples
The following example configures a DNS probe named PROBE4, enters DNS configuration mode, and configures the DNS probe timer interval to send every 11 seconds:
Router(config)# ip slb probe PROBE4 dnsRouter(config-slb-probe)# interval 11Related Commands
ip slb probe dns
Configures a DNS probe name and enters DNS probe configuration mode.
show ip slb probe
Displays information about an IOS SLB probe.
interval (HTTP probe)
To configure an HTTP probe interval, use the interval command in HTTP probe configuration mode. To remove an HTTP probe interval configuration, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before reattempting the probe. Valid values range from 1 to 65535 seconds. The default interval is 8 seconds.
Command Default
The default HTTP probe interval value is 8 seconds.
Command Modes
HTTP probe configuration (config-slb-probe)
Command History
Examples
The following example configures an HTTP probe named PROBE2, enters HTTP configuration mode, and configures the HTTP probe timer interval to send every 11 seconds:
Router(config)# ip slb probe PROBE2 httpRouter(config-slb-probe)# interval 11Related Commands
ip slb probe http
Configures an HTTP probe name and enters HTTP probe configuration mode.
show ip slb probe
Displays information about an IOS SLB probe.
interval (ping probe)
To configure a ping probe interval, use the interval command in ping probe configuration mode. To remove a ping probe interval configuration, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before reattempting the probe. Valid values range from 1 to 65535 seconds. The default interval is 1 second.
Command Default
The default ping probe interval value is 1 second.
Command Modes
Ping probe configuration (config-slb-probe)
Command History
Examples
The following example configures a ping probe named PROBE1, enters ping configuration mode, and configures the ping probe timer interval to send every 11 seconds:
Router(config)# ip slb probe PROBE1 pingRouter(config-slb-probe)# interval 11Related Commands
ip slb probe ping
Configures a ping probe name and enters ping probe configuration mode.
show ip slb probe
Displays information about an IOS SLB probe.
interval (TCP probe)
To configure a TCP probe interval, use the interval command in TCP probe configuration mode. To remove a TCP probe interval configuration, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before reattempting the probe. Valid values range from 1 to 65535 seconds. The default interval is 10 seconds.
Command Default
The default TCP probe interval value is 10 seconds.
Command Modes
TCP probe configuration (config-slb-probe)
Command History
Examples
The following example configures a TCP probe named PROBE5, enters TCP configuration mode, and configures the TCP probe timer interval to send every 11 seconds:
Router(config)# ip slb probe PROBE5 tcpRouter(config-slb-probe)# interval 11Related Commands
ip slb probe tcp
Configures a TCP probe name and enters TCP probe configuration mode.
show ip slb probe
Displays information about an IOS SLB probe.
interval (WSP probe)
To configure a Wireless Session Protocol (WSP) probe interval, use the interval command in WSP probe configuration mode. To remove a WSP probe interval configuration, use the no form of this command.
interval seconds
no interval seconds
Syntax Description
seconds
Number of seconds to wait before reattempting the probe. Valid values range from 1 to 65535 seconds. The default interval is 8 seconds.
Command Default
The default WSP probe interval value is 8 seconds.
Command Modes
WSP probe configuration (config-slb-probe)
Command History
Examples
The following example configures a ping probe named PROBE3, enters WSP probe configuration mode, and configures the WSP probe timer interval to send every 11 seconds:
Router(config)# ip slb probe PROBE3 wspRouter(config-slb-probe)# interval 11Related Commands
ip slb probe wsp
Configures a WSP probe name and enters WSP probe configuration mode.
show ip slb probe
Displays information about an IOS SLB probe.
ip accounting
To enable IP accounting on an interface, use the ip accounting command in interface configuration mode. To disable IP accounting, use the no form of this command.
ip accounting [access-violations] [output-packets]
no ip accounting [access-violations] [output-packets]
Syntax Description
Command Default
IP accounting is disabled on an interface.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The ip accounting command records the number of bytes (IP header and data) and packets switched through the system on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the router access server or terminating in this device is not included in the accounting statistics.
If you specify the access-violations keyword, the ip accounting command provides information identifying IP traffic that fails IP access lists. Identifying IP source addresses that violate IP access lists alerts you to possible attempts to breach security. The data might also indicate that you should verify IP access list configurations.
To receive a logging message on the console when an extended access list entry denies a packet access (to log violations), you must include the log keyword in the access-list (IP extended) or access-list (IP standard) command.
Statistics are accurate even if IP fast switching or IP access lists are being used on the interface. If the access-violations keyword is specified and any IP access list is being used on an interface, then only process switching can generate accurate statistics (IP fast switching or CEF cannot).
IP accounting disables autonomous switching, SSE switching, and distributed switching (dCEF) on the interface. IP accounting will cause packets to be switched on the Route Switch Processor (RSP) instead of the Versatile Interface Processor (VIP), which can cause performance degradation.
Examples
The following example enables IP accounting on Ethernet interface 0:
Router(config)# interface ethernet 0Router(config-if)# ip accountingRelated Commands
ip accounting-list
To define filters to control the hosts for which IP accounting information is kept, use the ip accounting-list command in global configuration mode. To remove a filter definition, use the no form of this command.
ip accounting-list ip-address wildcard
no ip accounting-list ip-address wildcard
Syntax Description
ip-address
IP address in dotted decimal format.
wildcard
Wildcard bits to be applied to the ip-address argument.
Command Default
No filters are defined.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The wildcard argument is a 32-bit quantity written in dotted-decimal format. Address bits corresponding to wildcard bits set to 1 are ignored in comparisons; address bits corresponding to wildcard bits set to zero are used in comparisons.
Examples
The following example adds all hosts with IP addresses beginning with 192.31 to the list of hosts for which accounting information will be kept:
Router(config)# ip accounting-list 192.31.0.0 0.0.255.255Related Commands
ip accounting mac-address
To enable IP accounting on a LAN interface based on the source and destination Media Access Control (MAC) address, use the ip accounting mac-address command in interface configuration mode. To disable IP accounting based on the source and destination MAC address, use the no form of this command.
ip accounting mac-address {input | output}
no ip accounting mac-address {input | output}
Syntax Description
input
Performs accounting based on the source MAC address on received packets.
output
Performs accounting based on the destination MAC address on transmitted packets.
Command Default
IP accounting is disabled on an interface.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
This feature is supported on Ethernet, Fast Ethernet, and FDDI interfaces.
To display the MAC accounting information, use the show interface mac EXEC command.
MAC address accounting provides accounting information for IP traffic based on the source and destination MAC address on LAN interfaces. This calculates the total packet and byte counts for a LAN interface that receives or sends IP packets to or from a unique MAC address. It also records a timestamp for the last packet received or sent. With MAC address accounting, you can determine how much traffic is being sent to and/or received from various peers at NAPS/peering points.
Examples
The following example enables IP accounting based on the source and destination MAC address for received and transmitted packets:
Router(config)# interface ethernet 4/0/0Router(config-if)# ip accounting mac-address inputRouter(config-if)# ip accounting mac-address outputCisco uBR10012 Universal Broadband Router
The following example enables IP accounting based on the source MAC address for received packets on a Gigabit Ethernet interface:
Router# configure terminalRouter(config)# interface GigabitEthernet3/0/0Router(config-if)# ip accounting mac-address inputRelated Commands
show interface mac
Displays MAC accounting information for interfaces configured for MAC accounting.
ip accounting precedence
To enable IP accounting on any interface based on IP precedence, use the ip accounting precedence command in interface configuration mode. To disable IP accounting based on IP precedence, use the no form of this command.
ip accounting precedence {input | output}
no ip accounting precedence {input | output}
Syntax Description
input
Performs accounting based on IP precedence on received packets.
output
Performs accounting based on IP precedence on transmitted packets.
Command Default
IP accounting is not enabled.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
To display IP precedence accounting information, use the show interface precedence EXEC command.
The precedence accounting feature provides accounting information for IP traffic, summarized by IP precedence values. This feature calculates the total packet and byte counts for an interface that receives or sends IP packets and sorts the results based on IP precedence. This feature is supported on all interfaces and subinterfaces and supports Cisco Express Forwarding (CEF), dCEF, flow, and optimum switching.
Examples
The following example enables IP accounting based on IP precedence for received and transmitted packets:
Router(config)# interface ethernet 4/0/0Router(config-if)# ip accounting precedence inputRouter(config-if)# ip accounting precedence outputRelated Commands
show interface precedence
Displays precedence accounting information for an interface configured for precedence accounting.
ip accounting-threshold
To set the maximum number of accounting entries to be created, use the ip accounting-threshold command in global configuration mode. To restore the default number of entries, use the no form of this command.
ip accounting-threshold threshold
no ip accounting-threshold threshold
Syntax Description
threshold
Maximum number of entries (source and destination address pairs) that the Cisco IOS software accumulates.
Command Default
The default maximum number of accounting entries is 512 entries.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The accounting threshold defines the maximum number of entries (source and destination address pairs) that the software accumulates, preventing IP accounting from possibly consuming all available free memory. This level of memory consumption could occur in a router that is switching traffic for many hosts. Overflows will be recorded; see the monitoring commands for display formats.
The default accounting threshold of 512 entries results in a maximum table size of 12,928 bytes. Active and checkpointed tables can reach this size independently.
Examples
The following example sets the IP accounting threshold to 500 entries:
Router(config)# ip accounting-threshold 500Related Commands
ip accounting-transits
To control the number of transit records that are stored in the IP accounting database, use the ip accounting-transits command in global configuration mode. To return to the default number of records, use the no form of this command.
ip accounting-transits count
no ip accounting-transits
Syntax Description
Command Default
The default number of transit records that are stored in the IP accounting database is 0.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Transit entries are those that do not match any of the filters specified by ip accounting-list global configuration commands. If no filters are defined, no transit entries are possible.
To maintain accurate accounting totals, the Cisco IOS software maintains two accounting databases: an active and a checkpointed database.
Examples
The following example specifies that no more than 100 transit records are stored:
Router(config)# ip accounting-transits 100Related Commands
ip broadcast-address
To define a broadcast address for an interface, use the ip broadcast-address interface configuration command. To restore the default IP broadcast address, use the no form of this command.
ip broadcast-address [ip-address]
no ip broadcast-address [ip-address]
Syntax Description
Command Default
Default address: 255.255.255.255 (all ones)
Command Modes
Interface configuration (config-if)
Command History
Examples
The following example specifies an IP broadcast address of 0.0.0.0:
Router(config-if)# ip broadcast-address 0.0.0.0ip casa
To configure the router to function as a forwarding agent, use the ip casa command in global configuration mode. To disable the forwarding agent, use the no form of this command.
ip casa control-address igmp-address [udp-limit]
no ip casa
Syntax Description
Command Default
No default behavior or values.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
If more than the maximum udp-limit value arrives in a burst, the Cisco Appliance Services Architecture (CASA) wildcard updates from the service manager might get dropped.
The control-address value is unique for each forwarding agent.
Examples
The following example specifies the Internet address (10.10.4.1) and IGMP address (224.0.1.2) for the forwarding agent and sets the UDP queue length to 300:
Router(config)# ip casa 10.10.4.1 224.0.1.2 300Related Commands
forwarding-agent
Specifies the port on which the forwarding agent will listen for wildcard and fixed affinities.
ip cef traffic-statistics
To change the time interval that controls when Next Hop Resolution Protocol (NHRP) sets up or tears down a switched virtual circuit (SVC), use the ip cef traffic-statistics command in global configuration mode. To restore the default values, use the no form of this command.
ip cef traffic-statistics [load-interval seconds] [update-rate seconds]
no ip cef traffic-statistics
Syntax Description
Command Default
Load interval: 30 seconds
Update rate: 10 secondsCommand Modes
Global configuration (config)
Command History
Usage Guidelines
The ip nhrp trigger-svc command sets the threshold by which NHRP sets up and tears down a connection. The threshold is the Cisco Express Forwarding traffic load statistics. The thresholds in the ip nhrp trigger-svc command are measured during a sampling interval of 30 seconds, by default. To change that interval over which that threshold is determined, use the load-interval seconds option of the ip cef traffic-statistics command.
When NHRP is configured on a Cisco Express Forwarding switching node with a Versatile Interface Processor (VIP2) adapter, you must make sure the update-rate keyword is set to 5 seconds.
Other Cisco IOS features could also use the ip cef traffic-statistics command; this NHRP feature relies on it.
Examples
In the following example, the triggering and teardown thresholds are calculated based on an average over 120 seconds:
Router(config)# ip cef traffic-statistics load-interval 120Related Commands
ip nhrp trigger-svc
Configures when NHRP will set up and tear down an SVC based on aggregate traffic rates.
ip dfp agent
To identify a Dynamic Feedback Protocol (DFP) agent subsystem and enter DFP agent configuration mode, use the ip dfp agent command in global configuration mode. To remove the DFP agent identification, use the no form of this command.
ip dfp agent subsystem-name
no ip dfp agent subsystem-name
Syntax Description
Command Default
No DFP agent subsystem is defined.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
To discover the subsystem names that are available in your network, enter the ip dfp agent ? command.
Examples
The following example identifies a DFP agent subsystem named slb:
Router(config)# ip dfp agent slbRouter(config-dfp)#Related Commands
agent
Identifies a DFP agent to which IOS SLB can connect.
ip slb dfp
Configures DFP, supplies an optional password, and initiates DFP configuration mode.
ip directed-broadcast
To enable the translation of a directed broadcast to physical broadcasts, use the ip directed-broadcast interface configuration command. To disable this function, use the no form of this command.
ip directed-broadcast [access-list-number | extended access-list-number]
no ip directed-broadcast [access-list-number | extended access-list-number]
Syntax Description
Command Default
Disabled; all IP directed broadcasts are dropped.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
An IP directed broadcast is an IP packet whose destination address is a valid broadcast address for some IP subnet, but which originates from a node that is not itself part of that destination subnet.
A router that is not directly connected to its destination subnet forwards an IP directed broadcast in the same way it would forward unicast IP packets destined to a host on that subnet. When a directed broadcast packet reaches a router that is directly connected to its destination subnet, that packet is "exploded" as a broadcast on the destination subnet. The destination address in the IP header of the packet is rewritten to the configured IP broadcast address for the subnet, and the packet is sent as a link-layer broadcast.
The ip directed-broadcast command controls the explosion of directed broadcasts when they reach their target subnets. The command affects only the final transmission of the directed broadcast on its ultimate destination subnet. It does not affect the transit unicast routing of IP directed broadcasts.
If directed broadcast is enabled for an interface, incoming IP packets whose addresses identify them as directed broadcasts intended for the subnet to which that interface is attached will be exploded as broadcasts on that subnet. If an access list has been configured with the ip directed-broadcast command, only directed broadcasts that are permitted by the access list in question will be forwarded; all other directed broadcasts destined for the interface subnet will be dropped.
If the no ip directed-broadcast command has been configured for an interface, directed broadcasts destined for the subnet to which that interface is attached will be dropped, rather than being broadcast.
Note
Examples
The following example enables forwarding of IP directed broadcasts on Ethernet interface 0:
Router(config)# interface ethernet 0Router(config-if)# ip directed-broadcastRelated Commands
ip forward-protocol
Specifies which protocols and ports the router forwards when forwarding broadcast packets.
ip forward-protocol
To specify which protocols and ports the router forwards when forwarding broadcast packets, use the ip forward-protocol command in global configuration mode. To remove a protocol or port, use the no form of this command.
ip forward-protocol {udp [port] | nd | sdns}
no ip forward-protocol {udp [port | nd | sdns}
Syntax Description
Command Default
Router forwarding is enabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Enabling a helper address or UDP flooding on an interface causes the Cisco IOS software to forward particular broadcast packets. You can use the ip forward-protocol command to specify exactly which types of broadcast packets you would like to have forwarded. A number of commonly forwarded applications are enabled by default. Enabling forwarding for some ports [for example, Routing Information Protocol (RIP)] may be hazardous to your network.
If you use the ip forward-protocol command, specifying only UDP without the port enables forwarding and flooding on the default ports.
One common application that requires helper addresses is Dynamic Host Configuration Protocol (DHCP). DHCP is defined in RFC 1531. DHCP protocol information is carried inside of BOOTP packets. To enable BOOTP broadcast forwarding for a set of clients, configure a helper address on the router interface closest to the client. The helper address should specify the address of the DHCP server. If you have multiple servers, you can configure one helper address for each server. Because BOOTP packets are forwarded by default, DHCP information can now be forwarded by the software. The DHCP server now receives broadcasts from the DHCP clients.
If an IP helper address is defined, UDP forwarding is enabled on default ports. If UDP flooding is configured, UDP flooding is enabled on the default ports.
If a helper address is specified and UDP forwarding is enabled, broadcast packets destined to the following port numbers are forwarded by default:
•
•
•
•
•
•
•
•
Note
Examples
The following example defines a helper address and uses the ip forward-protocol command. Using the udp keyword without specifying any port numbers will allow forwarding of UDP packets on the default ports.
Router(config)# ip forward-protocol udpRouter(config)# interface ethernet 1Router(config-if)# ip helper-address 10.24.42.2ip forward-protocol spanning-tree
To permit IP broadcasts to be flooded throughout the internetwork in a controlled fashion, use the ip forward-protocol spanning-tree command in global configuration mode. To disable the flooding of IP broadcasts, use the no form of this command.
ip forward-protocol spanning-tree [any-local-broadcast]
no ip forward-protocol spanning-tree [any-local-broadcast]
Syntax Description
Command Default
IP broadcast flooding is disabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
A packet must meet the following criteria to be considered for flooding:
•
•
•
•
•
A flooded UDP datagram is given the destination address specified by the ip broadcast-address command on the output interface. The destination address can be set to any desired address. Thus, the destination address may change as the datagram propagates through the network. The source address is never changed. The TTL value is decremented.
After a decision has been made to send the datagram out on an interface (and the destination address possibly changed), the datagram is handed to the normal IP output routines and is therefore subject to access lists, if they are present on the output interface.
The ip forward-protocol spanning-tree command uses the database created by the bridging Spanning-Tree Protocol. Therefore, the transparent bridging option must be in the routing software, and bridging must be configured on each interface that is to participate in the flooding in order to support this capability.
If an interface does not have bridging configured, it still will be able to receive broadcasts, but it will never forward broadcasts received on that interface. Also, it will never use that interface to send broadcasts received on a different interface.
If no actual bridging is desired, you can configure a type-code bridging filter that will deny all packet types from being bridged. Refer to the Cisco IOS Bridging and IBM Networking Configuration Guide for more information about using access lists to filter bridged traffic. The spanning-tree database is still available to the IP forwarding code to use for the flooding.
The spanning-tree-based flooding mechanism forwards packets whose contents are all ones (255.255.255.255), all zeros (0.0.0.0), and, if subnetting is enabled, all networks (10.108.255.255 as an example in the network number 10.108.0.0). This mechanism also forward packets whose contents are the zeros version of the all-networks broadcast when subnetting is enabled (for example, 10.108.0.0).
This command is an extension of the ip helper-address command, in that the same packets that may be subject to the helper address and forwarded to a single network can now be flooded. Only one copy of the packet will be put on each network segment.
Examples
The following example permits IP broadcasts to be flooded through the internetwork in a controlled fashion:
Router(config)# ip forward-protocol spanning-treeRelated Commands
ip forward-protocol turbo-flood
To speed up flooding of User Datagram Protocol (UDP) datagrams using the spanning-tree algorithm, use the ip forward-protocol turbo-flood command in global configuration mode. To disable this feature, use the no form of this command.
ip forward-protocol turbo-flood [udp-checksum]
no ip forward-protocol turbo-flood [udp-checksum]
Syntax Description
Command Default
UDP turbo flooding is disabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Used in conjunction with the ip forward-protocol spanning-tree command, this command is supported over Advanced Research Projects Agency (ARPA)-encapsulated Ethernets, FDDI, and High-Level Data Link Control (HDLC) encapsulated serials, but is not supported on Token Rings. As long as the Token Rings and the non-HDLC serials are not part of the bridge group being used for UDP flooding, turbo flooding will behave normally.
When you enter the ip forward-protocol turbo-flood command, the outgoing UDP packets have a NULL checksum. If you want to have UDP checksums on all outgoing packets, you must enter the ip forward-protocol turbo-flood udp-checksum command.
Examples
The following is an example of a two-port router using this command:
Router(config)# ip forward-protocol turbo-floodRouter(config)# ip forward-protocol spanning-tree!Router(config)# interface ethernet 0Router(config-if)# ip address 10.9.1.1Router(config-if)# bridge-group 1!Router(config)# interface ethernet 1Router(config-if)# ip address 10.9.1.2Router(config-if)# bridge-group 1!Router(config)# bridge 1 protocol decThe following example shows how to speed up the flooding of UDP packets using the spanning-tree algorithm and include the UDP checksums on all outgoing packets:
Router(config)# ip forward-protocol turbo-flood udp-checksumRelated Commands
ip header-compression special-vj
To enable the special Van Jacobson (VJ) format of TCP header compression, use the ip header-compression special-vj command in interface configuration mode. To disable the special VJ format and return to the default VJ format, use the no form of this command.
ip header-compression special-vj
no ip header-compression special-vj
Syntax Description
This command has no arguments or keywords.
Command Default
The default VJ format of TCP header compression is enabled.
Command Modes
Interface configuration (config-if)
Command History
12.4(15)T12
This command was introduced.
15.0(1)M2
This command was integrated into Cisco IOS Release 15.0(1)M2.
Usage Guidelines
Use the ip tcp header-compression command to enable the default VJ format of TCP header compression. Then use the ip header-compression special-vj command to enable the special VJ format of TCP header compression.
To enable the special VJ format of TCP header compression so that context IDs are included in compressed packets, use the special-vj command in IPHC profile configuration mode.
Examples
The following example shows how to configure the special VJ format of TCP header compression for serial interface 5/0:
Router(config)# interface serial 5/0Router(config-if)# ip header-compression special-vjBuilding configuration...Current configuration : 579 bytes!interface Serial 5/0bandwidth 4032ip address 10.72.72.3 255.255.255.0encapsulation frame-relayshutdownno keepaliveserial restart-delay 0no arp frame-relayframe-relay map ip 10.72.72.2 100 broadcastframe-relay ip tcp header-compressionframe-relay ip tcp compression-connections 8frame-relay ip rtp header-compression periodic-refreshframe-relay ip rtp compression-connections 8service-policy output p1ip header-compression special-vjip header-compression max-header 60ip header-compression max-time 50ip header-compression max-period 32786endRelated Commands
ip helper-address
To enable forwarding of User Datagram Protocol (UDP) broadcasts, including Bootstrap Protocol (BOOTP), received on an interface, use the ip helper-address command in interface configuration mode. To disable forwarding of broadcast packets to specific addresses, use the no form of this command.
ip helper-address [vrf name | global] address [redundancy vrg-name]
no ip helper-address [vrf name | global] address [redundancy vrg-name]
Syntax Description
Command Default
UDP broadcasts are not forwarded.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The ip forward-protocol command along with the ip helper-address command allows you to control broadcast packets and protocols that are forwarded.
One common application that requires helper addresses is DHCP, which is defined in RFC 1531. To enable BOOTP or DHCP broadcast forwarding for a set of clients, configure a helper address on the router interface connected to the client. The helper address must specify the address of the BOOTP or DHCP server. If you have multiple servers, configure one helper address for each server.
The following conditions must be met for a UDP or IP packet to be able to use the ip helper-address command:
•
•
•
•
•
If the DHCP server resides in a VPN or global space that is different from the interface VPN, then the vrf name or the global option allows you to specify the name of the VRF or global space in which the DHCP server resides.
The ip helper-address vrf name address command uses the address associated with the VRF name regardless of the VRF instance of the incoming interface. If the ip helper-address vrf name address command is configured and later the VRF is deleted from the configuration, then all IP helper addresses associated with that VRF name will be removed from the interface configuration.
If the ip helper-address address command is already configured on an interface with no VRF name configured, and later the interface is configured with the ip helper-address vrf name address command, then the previously configured ip helper-address address command is considered to be global.
Note
The service dhcp command must be configured on the router to enable IP helper statements to work with DHCP. If the command is not configured, the DHCP packets will not be relayed through the IP helper statements. The service dhcp command is configured by default.
Examples
The following example shows how to define an address that acts as a helper address:
Router(config)# interface ethernet 1Router(config-if)# ip helper-address 10.24.43.2The following example shows how to define an address that acts as a helper address and is associated with a VRF named host1:
Router(config)# interface ethernet 1/0Router(config-if)# ip helper-address vrf host1 10.25.44.2The following example shows how to define an address that acts as a helper address and is associated with a VRG named group1:
Router(config)# interface ethernet 1/0Router(config-if)# ip helper-address 10.25.45.2 redundancy group1Related Commands
ip icmp rate-limit unreachable
To limit the rate at which Internet Control Message Protocol (ICMP) unreachable messages are generated for a destination, use the ip icmp rate-limit unreachable command in global configuration mode. To use the default, use the no form of this command.
ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]
no ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]
Syntax Description
Command Default
The default value is one ICMP destination unreachable message per 500 ms.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Counting of packets begins when the command is configured and a packet threshold is specified.
The no ip icmp rate-limit unreachable command turns off the previously configured rate limit. To reset the rate limit to its default value, use the ip icmp rate-limit unreachable command default.
Cisco IOS software maintains two timers: one for general destination unreachable messages and one for DF destination unreachable messages. Both share the same time limits and defaults. If the df option is not configured, the ip icmp rate-limit unreachable command sets the time values in ms for DF destination unreachable messages.
Examples
The following example sets the rate of the ICMP destination unreachable message to one message every 10 ms:
Router(config)# ip icmp rate-limit unreachable 10The following example turns off the previously configured rate limit:
Router(config)# no ip icmp rate-limit unreachableThe following example sets the rate limit back to the default:
Router(config)# no ip icmp rate-limit unreachableThe following example sets a logging packet threshold and time interval:
Router(config)# ip icmp rate-limit unreachable log 1200 120000Related Commands
ip icmp redirect
To control the type of Internet Control Message Protocol (ICMP) redirect message that is sent by the Cisco IOS software, use the ip icmp redirect command in global configuration mode. To set the value back to the default, use the no form of this command.
ip icmp redirect [host | subnet]
no ip icmp redirect [host | subnet]
Syntax Description
Command Default
The router will send ICMP subnet redirect messages.
Because the ip icmp redirect subnet command is the default, the command will not be displayed in the configuration.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
An ICMP redirect message can be generated by a router when a packet is received and transmitted on the same interface. In this situation, the router will forward the original packet and send a ICMP redirect message back to the sender of the original packet. This behavior allows the sender to bypass the router and forward future packets directly to the destination (or a router closer to the destination).
There are two types of ICMP redirect messages: redirect for a host address or redirect for an entire subnet.
The ip icmp redirect command determines the type of ICMP redirects sent by the system and is configured on a per system basis. Some hosts do not understand ICMP subnet redirects and need the router to send out ICMP host redirects. Use the ip icmp redirect host command to have the router send out ICMP host redirects. Use the ip icmp redirect subnet command to set the value back to the default, which is to send subnet redirects.
To prevent the router from sending ICMP redirects, use the no ip redirects interface configuration command.
Examples
The following example enables the router to send out ICMP host redirects:
Router(config)# ip icmp redirect hostThe following example sets the value back to the default, which is subnet redirects:
Router(config)# ip icmp redirect subnetRelated Commands
ip information-reply
To have the Cisco IOS software send Internet Control Message Protocol (ICMP) information replies, use the ip information-reply command in interface configuration mode. To disable this function, use the no form of this command.
ip information-reply
no ip information-reply
Syntax Description
This command has no arguments or keywords.
Command Default
ICMP information replies are not sent.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The ability for the Cisco IOS software to respond to ICMP information request messages with an ICMP information reply message is disabled by default. Use this command to allow the software to send ICMP information reply messages.
Examples
The following example enables the sending of ICMP information reply messages on Ethernet interface 0:
Router(config)# interface ethernet 0Router(config-if)# ip address 10.108.1.0 255.255.255.0Router(config-if)# ip information-replyip irdp
To enable ICMP Router Discovery Protocol (IRDP) processing on an interface, use the ip irdp command in interface configuration mode. To disable IRDP routing, use the no form of this command.
ip irdp [multicast | holdtime seconds | maxadvertinterval seconds | minadvertinterval seconds | preference number | address address [number]]
no ip irdp
Syntax Description
Command Default
IRDP is disabled by deafult. When enabled, IRDP uses these defaults:
•
•
•
•
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
If you change the maxadvertinterval value, the other two values also change, so it is important to change the maxadvertinterval value before changing either the holdtime or minadvertinterval values.
The ip irdp multicast command allows for compatibility with Sun Microsystems Solaris, which requires IRDP packets to be sent out as multicasts. Many implementations cannot receive these multicasts; ensure end-host ability before using this command.
Examples
The following example sets the various IRDP processes:
!Enable irdp on interface Ethernet 0.Router(config)# interface ethernet 0Router(config-if)# ip irdp!Send IRDP advertisements to the multicast address.Router(config-if)# ip irdp multicast!Increase router preference from 0 to 900.Router(config-if)# ip irdp preference 900!Set maximum time between advertisements to 400 secs.Router(config-if)# ip irdp maxadvertinterval 400!Set minimum time between advertisements to 100 secs.Router(config-if)# ip irdp minadvertinterval 100!Advertisements are good for 6000 seconds.Router(config-if)# ip irdp holdtime 6000!Proxy-advertise 10.108.14.5 with default router preference.Router(config-if)# ip irdp address 10.108.14.5!Proxy-advertise 10.108.14.6 with preference of 50.Router(config-if)# ip irdp address 10.108.14.6 50Related Commands
ip mask-reply
To have the Cisco IOS software respond to Internet Control Message Protocol (ICMP) mask requests by sending ICMP mask reply messages, use the ip mask-reply command in interface configuration mode. To disable this function, use the no form of this command.
ip mask-reply
no ip mask-reply
Syntax Description
This command has no arguments or keywords.
Command Default
ICMP mask reply messages are not sent.
Command Modes
Interface configuration (config-if)
Command History
Examples
The following example enables the sending of ICMP mask reply messages on Ethernet interface 0:
Router(config)# interface ethernet 0Router(config-if)# ip address 10.108.1.0 255.255.255.0Router(config-if)# ip mask-replyip mtu
To set the maximum transmission unit (MTU) size of IP packets that are sent on an interface, use the ip mtu command in interface configuration mode. To restore the default MTU size, use the no form of this command.
ip mtu bytes
no ip mtu
Syntax Description
Command Default
The IP MTU default value depends on the interface medium. Table 1 lists default MTU values according to media type.
Table 1 Default Media MTU Values
Ethernet
1500
Serial
1500
Token Ring
4464
ATM
4470
FDDI
4470
HSSI (HSA)
4470
VASI
9216
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
If an IP packet exceeds the MTU that is set for the interface, the Cisco IOS software will fragment it.
For VASI interfaces that involve Ethernet type interfaces (Ethernet, Fast Ethernet or Gigabit Ethernet), the IP MTU of the VASI interface must be set the same as the lower default setting of the Ethernet type interface of 1500 bytes. If this adjustment is not made, OSPF reconvergence on the VASI interface will take too long.
Note
Examples
The following example sets the maximum IP packet size for the first serial interface to 300 bytes:
Router(config)# interface serial 0Router(config-if)# ip mtu 300Related Commands
ip redirects
To enable the sending of Internet Control Message Protocol (ICMP) redirect messages if the Cisco IOS software is forced to resend a packet through the same interface on which it was received, use the ip redirects command in interface configuration mode. To disable the sending of redirect messages, use the no form of this command.
ip redirects
no ip redirects
Syntax Description
This command has no arguments or keywords.
Command Default
ICMP redirect messages are sent.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Previously, if the Hot Standby Router Protocol (HSRP) was configured on an interface, ICMP redirect messages were disabled by default for the interface. With Cisco IOS Release 12.1(3)T, ICMP redirect messages are enabled by default if HSRP is configured.
Examples
The following example enables the sending of ICMP redirect messages on Ethernet interface 0:
Router(config)# interface ethernet 0Router(config-if)# ip redirectsRelated Commands
ip sctp asconf
To enable the ability of an existing Stream Control Transmission Protocol (SCTP) endpoint to automatically send Address Configuration Change (ASCONF) chunks in response to an IP address change on a router without an authentication check, use the ip sctp asconf command in global configuration mode. To disable the requirement for ASCONF and ASCONF Acknowledgement (ASCONF-ACK) chunks to perform an authentication requirement check, use the no form of this command.
ip sctp asconf {authenticate check | auto}
no ip sctp asconf {authenticate check | auto}
Syntax Description
Command Default
SCTP checks the authentication status of the endpoint before sending an ASCONF chunk in response to an IP address change on the router.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The ASCONF chunk format requires the receiving SCTP to not report to the sender if it does not understand the ASCONF chunk. This command enables you to configure sending the ASCONF chunk automatically in response to an IP address change in an SCTP stream, or to authenticate the endpoint before sending the ASCONF chunk.
The ASCONF chunk is used to communicate to the endpoint of an SCTP stream that at least one of the configuration change requests in the stream must be acknowledged.
Examples
The following example shows how to configure SCTP to authenticate the endpoint before sending an ASCONF chunk:
Router(config)# ip sctp asconf authenticate checkThe following example shows how to configure SCTP to automatically send an ASCONF chunk in response to a change in the IP address of the remote endpoint:
Router(config)# ip sctp asconf autoRelated Commands
ip sctp authenticate
To define Stream Control Transmission Protocol (SCTP) data chunks that the client requires be authenticated.
ip sctp authenticate
To define Stream Control Transmission Protocol (SCTP) data chunks that the client requires be authenticated, use the ip sctp authenticate command in global configuration mode. To disable the authentication of an SCTP data chunk, use the no form of this command.
ip sctp authenticate {chunk-type | chunk-number}
no ip sctp authenticate {chunk-type | chunk-number}
Syntax Description
Command Default
SCTP data chunks are not authenticated by default.
Command Modes
Global configuration (config)
Command History
12.4(15)T
This command was introduced.
12.4(20)T
This command was enhanced to support the Address Configuration (ASCONF) and ASCONF-ACK SCTP chunk types.
Usage Guidelines
SCTP Authentication procedures use either Message Digest 5 (MD5) or Secure Hash Algorithm 1 (SHA-1), which can be memory and CPU intensive. Enabling SCTP Authentication on data chunks could impact CPU utilization when a large number of authenticated chunks are sent.
You cannot disable the authentication of the ASCONF or ASCONF-ACK chunks.
Enabling the authentication of a chunk type applies only to new endpoints and associations.
Table 2 provides a list of SCTP chunk types and SCTP chunk numbers.
Examples
The following example shows how to enable authentication of SCTP data chunks:
Router(config)# ip sctp authenticate dataRelated Commands
ip slb capp udp
To enable the IOS SLB KeepAlive Application Protocol (KAL-AP) agent and enter SLB Content Application Peering Protocol (CAPP) configuration mode, use the ip slb capp udp command in global configuration mode. To disable the KAL-AP agent feature, use the no form of this command.
ip slb capp udp
no ip slb capp udp
Syntax Description
This command has no arguments or keywords.
Command Default
The KAL-AP agent is not enabled.
Command Modes
Global configuration (config)
Command History
Examples
The following example enables the KAL-AP agent an enters CAPP UDP configuration mode:
Router(config)# ip slb capp udpRelated Commands
ip slb dfp
To configure Dynamic Feedback Protocol (DFP), supply an optional password, and enter DFP configuration mode, use the ip slb dfp command in global configuration mode. To remove the DFP configuration, use the no form of this command.
ip slb dfp [password [encrypt] secret-string [timeout]]
no ip slb dfp
Syntax Description
Command Default
The default password encryption is 0 (unencrypted).
The default password timeout is 180 seconds, if a password is specified.Command Modes
Global configuration (config)
Command History
Usage Guidelines
The password specified in the ip slb dfp command for the DFP manager must match the password specified in the password command for the DFP agent.
The timeout option allows you to change the password without stopping messages between the DFP agent and its manager. The default value is 180 seconds.
During the timeout, the agent sends packets with the old password (or null, if there is no old password), and receives packets with either the old or new password. After the timeout expires, the agent sends and receives packets only with the new password; received packets that use the old password are discarded.
If you are changing the password for an entire load-balanced environment, set a longer timeout to allow enough time for you to update the password on all agents and servers before the timeout expires. Setting a longer timeout also prevents mismatches between agents and servers that have begun running the new password and agents, and servers on which you have not yet changed the old password.
If you are running IOS SLB as a DFP manager, and you specify a password on the ip slb dfp command, the password must match the one specified on the password command in DFP agent configuration mode in the DFP agent.
Examples
The following example configures DFP, sets the DFP password to Password1 and the timeout to 360 seconds, and enters DFP configuration mode:
Router(config)# ip slb dfp password Password1 360Router(config-slb-dfp)#Related Commands
agent
Identifies a DFP agent to which IOS SLB can connect.
ip dfp agent
Identifies a DFP agent subsystem and enters DFP agent configuration mode.
ip slb entries
To configure an initial allocation and a maximum value for IOS Server Load Balancing (IOS SLB) database entries, use the ip slb entries command in global configuration mode. To restore the default values, use the no form of this command.
ip slb entries [conn [init-conn [max-conn]] | frag [init-frag [max-frag] | lifetime timeout] | gtp {gsn init-gsn [max-gsn] | nsapi init-nsapi [max-nsapi]} | sticky [init-sticky [max-sticky]]]
no ip slb entries [conn | frag [lifetime] | gtp {gsn | nsapi} | sticky]
Syntax Description
Command Default
For the connection database, the default initial allocation is 8000 connections, and the default maximum is 8000000 connections.
For the fragment database, the default initial allocation is 2000 fragments, and the default maximum is 8000000 fragments. The default lifetime is 10 seconds.
For the GSN database, the default initial allocation is 200 GSNs, and the default maximum is 20000 GSNs.
For the NSAPI database, the default initial allocation is 8000 NSAPIs, and the default maximum is 8000000 NSAPIs.
For the sticky connection database, the default initial allocation is 4000 sticky connections, and the default maximum is 3200 sticky connections.Command Modes
Global configuration (config)
Command History
Usage Guidelines
Enter this command before entering the rest of your IOS SLB configuration. If you have already begun configuring IOS SLB before entering this command, you must reload ISO SLB after entering this command.
If you configure an initial allocation value that exceeds the amount of available memory, memory might not be available for other features. In extreme cases, the router or switch might not boot properly. Therefore, be careful when you configure initial allocation values.
Examples
The following example configures an initial allocation of 128,000 connections, which can grow dynamically to a limit of 512,000 connections:
Router(config)# ip slb entries conn 128000 512000Related Commands
show ip slb conns
Displays all connections handled by IOS SLB, or, optionally, only those connections associated with a particular virtual server or client.
ip slb firewallfarm
To identify a firewall farm and enter firewall farm configuration mode, use the ip slb firewallfarm command in global configuration mode. To remove the firewall farm from the IOS Server Load Balancing (IOS SLB) configuration, use the no form of this command.
ip slb firewallfarm firewall-farm
no ip slb firewallfarm firewall-farm
Syntax Description
firewall-farm
Character string used to identify the firewall farm. The character string is limited to 15 characters.
Command Default
No default behavior or values
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Grouping real servers into firewall farms is an essential part of IOS SLB firewall load balancing. Using firewall farms enables IOS SLB to assign new connections to the real servers based on their weighted capacities, and on the load-balancing algorithms used.
Examples
The following example identifies a firewall farm named FIRE1:
Router(config)# ip slb firewallfarm FIRE1Related Commands
real (firewall farm)
Identifies a firewall by IP address as a member of a firewall farm and enters real server configuration mode.
ip slb map
To configure an IOS SLB protocol map and enter SLB map configuration mode, use the ip slb map command in global configuration mode. To delete the map, use the no form of this command.
ip slb map map-id {gtp | radius}
no ip slb map map-id {gtp | radius}
Syntax Description
Command Default
No SLB protocol map is configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
You can configure up to 255 IOS SLB GTP or RADIUS maps. However, we recommend that you configure no more than 10 maps for a given virtual server.
Each map ID must be unique across all server farms associated with a given GTP or RADIUS virtual server. That is, you cannot configure more than one map with the same ID.
For each IOS SLB RADIUS map, you can configure a single calling-station-id command or a single username (IOS SLB) command, but not both.
Configure the gtp or radius keyword only on maps that are to be used with GTP or RADIUS virtual servers, respectively.
Examples
The following example configures IOS SLB RADIUS map 1 and enters SLB RADIUS map configuration mode:
Router(config)# ip slb map 1 radiusRelated Commands
ip slb maxbuffers frag
To configure the maximum number of buffers for the IOS Server Load Balancing (IOS SLB) fragment database, use the ip slb maxbuffers frag command in global configuration mode. To restore the default setting, use the no form of this command.
ip slb maxbuffers frag buffers
no ip slb maxbuffers frag
Syntax Description
Command Default
The default maximum is 100 buffers.
Command Modes
Global configuration (config)
Command History
Examples
The following example sets the maximum number of buffers for the IOS SLB fragment buffer to 300:
Router(config)# ip slb maxbuffers frag 300ip slb natpool
To configure an IOS Server Load Balancing (IOS SLB) Network Address Translation (NAT) to create at least one client address pool, use the ip slb natpool command in global configuration mode. To remove an ip slb natpool configuration, use the no form of this command.
ip slb natpool pool start-ip end-ip [netmask netmask | prefix-length leading-1-bits] [entries init-address [max-address]]
no ip slb natpool pool
Syntax Description
Command Default
The default initial allocation is 8000 client NAT address entries.
The default maximum number of client NAT address entries that can be allocated is the maximum number of ports that can be allocated within the IP address range.Command Modes
Global configuration (config)
Command History
Usage Guidelines
If you want to use client NAT, you must create at least one client address pool.
The range of IP addresses in the address pool, configured with the start-ip and end-ip arguments, must not overlap the IP address for a VLAN as specified on the ip address interface configuration command.
Examples
The following example configures an IOS SLB NAT server farm pool of addresses with the name web-clients, the IP address range from 10.1.10.1 to 10.1.10.5, and a subnet mask of 255.255.0.0:
Router(config)# ip slb natpool web-clients 10.1.10.1 10.1.10.5 netmask 255.255.0.0Related Commands
show ip slb natpool
Displays information about the IOS SLB NAT configuration.
show ip slb serverfarms
Displays information about the server farm configuration.
Feedback