Table Of Contents
ip mobile registration-lifetime
ip mobile router-service collocated
ip mobile router-service collocated registration nat traversal
ip mobile router-service collocated registration retry
ip mobile router-service description
ip mobile router-service link-type
ip mobile router-service tunnel mode
ip mobile secure foreign-agent
ipv6-address (proxy mobile ipv6)
ip mobile mobile-networks
To associate one or more networks with a mobile router configured as a mobile host and enter mobile networks configuration mode, use the ip mobile mobile-networks command in global configuration mode. To disassociate the networks from the mobile router, use the no form of this command.
ip mobile mobile-networks lower [upper]
no ip mobile mobile-networks lower [upper]
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
12.2(4)T
This command was introduced.
12.2(13)T
The upper argument was added to allow a range of mobile host or mobile node group addresses.
Usage Guidelines
The home agent supports mobile routers configured with the mobile networks that are roaming with the mobile routers.
The lower [upper] arguments associate the mobile networks with the IP address of the mobile router, which was configured using the ip mobile host command. You can use the upper range only with dynamic mobile network registration. Static mobile network configurations are not permitted for a range of hosts.
You can configure the home agent to dynamically learn of the mobile networks during registration as shown in the following example:
ip mobile host 10.0.0.1 10.0.0.10 virtual-networks 10.0.0.0 255.0.0.0ip mobile mobile-networks 10.0.0.1 10.0.0.10!dynamic registrationregisterYou can configure the home agent to learn of the mobile networks through static configuration as shown in the following example:
ip mobile host 10.0.0.1 virtual-networks 10.0.0.0 255.0.0.0ip mobile host 10.0.0.2 virtual-networks 10.0.0.0 255.0.0.0!ip mobile mobile-networks 10.0.0.1!static configurationnetwork 172.16.1.0 255.255.255.0ip mobile mobile-networks 10.0.0.2!static configurationnetwork 172.16.2.0 255.255.255.0You cannot configure the range as shown in the following static configuration:
!static configuration not permitted for range of hostsip mobile mobile-networks 10.0.0.1 10.0.0.10network 172.16.2.0The mobile router configuration is allowed only for one mobile router or an entire range of mobile routers in the mobile host group, exclusively. You cannot configure a partial range of mobile routers as shown in the following example:
ip mobile host 10.0.0.1 10.0.0.10 virtual-network 10.0.0.0 255.0.0.0!Partial range shown below is prohibitedip mobile mobile-networks 10.0.0.1 10.0.0.3registerYou cannot combine full ranges and partial ranges of IP addresses in a configuration as shown in the following example:
ip mobile host 10.0.0.1 10.0.0.10 virtual-network 10.0.0.0 255.0.0.0ip mobile mobile-networks 10.0.0.1 10.0.0.10registerip mobile mobile-networks 10.0.0.2network 172.16.2.0 255.255.255.0Examples
The following example configures the mobile host, which is a mobile router at 10.1.1.10, and associates it with the mobile networks that it is supporting:
ip mobile host 10.1.1.10 virtual-network 10.0.0.0 255.0.0.0ip mobile mobile-networks 10.1.1.10network 172.6.2.0 255.255.255.0ip mobile secure host 10.1.1.10 spi 100 key hex 12345678123456781234567812345678The following example shows the mobile router configured for both static and dynamic mobile networks:
ip mobile host 10.1.1.10 virtual-network 10.0.0.0 255.0.0.0ip mobile mobile-networks 10.1.1.10network 172.16.1.0 255.255.255.0registerRelated Commands
ip mobile prefix-length
To append the prefix-length extension to the advertisement, use the ip mobile prefix-length command in interface configuration mode. To restore the default, use the no form of this command.
ip mobile prefix-length
no ip mobile prefix-length
Syntax Description
This command has no arguments or keywords.
Defaults
The prefix-length extension is not appended.
Command Modes
Interface and Global configuration
Command History
12.0(1)T
This command was introduced.
12.3(11)T
Global configuration mode was added.
Usage Guidelines
The prefix-length extension is used for movement detection. When a mobile node registered with one foreign agent receives an agent advertisement from another foreign agent, the mobile node uses the prefix-length extension to determine whether the advertisements arrived on the same network. The mobile node needs to register with the second foreign agent if it is on a different network. If the second foreign agent is on the same network, reregistration is not necessary.
Examples
The following example appends the prefix-length extension to agent advertisements sent by a foreign agent:
Router(config-if)# ip mobile prefix-lengthRelated Commands
show ip mobile interface
Displays advertisement information for interfaces that are providing foreign agent service or are home links for mobile nodes.
ip mobile proxy-host
To locally configure the proxy Mobile IP attributes, use the ip mobile proxy-host command in global configuration mode. To remove the configuration, use the no form of this command.
ip mobile proxy-host nai username@realm [flags rrq-flags] [home-agent ip-address] [home-addr home-address] [lifetime seconds] [local-timezone]
no ip mobile proxy-host nai username@realm [flags rrq-flags] [home-agent ip-address] [home-addr home-address] [lifetime seconds] [local-timezone]
Syntax Description
Defaults
No security association is specified.
Command Modes
Global configuration
Command History
12.2(2)XC
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T for Packet Data Serving Node (PDSN) platforms.
Usage Guidelines
This command is only available on PDSN platforms running specific PDSN code images; consult Feature Navigator for your Cisco IOS software release.
All proxy Mobile IP attributes can be retrieved from the AAA server. You can use this command to configure the attributes locally.
If only a realm is specified, the home address cannot be specified.
Examples
The following example configures the Mobile IP proxy host with an IP address of 10.3.3.1 and a lifetime value of 6000 seconds:
Router(config)# ip mobile proxy-host nai moiproxy1@cisco.com flags 40 home-agent 10.3.3.1 lifetime 6000Related Commands
ip mobile radius disconnect
To enable the home agent to process Radius Disconnect messages, use the ip mobile radius disconnect command in global configuration mode. To disable the processing of Radius Disconnect messages on the home agent, use the no form of this command.
ip mobile radius disconnect
no ip mobile radius disconnect
Syntax Description
This command has no arguments or keywords.
Command Default
Radius Disconnect messages are not processed by the home agent.
Command Modes
Global configuration
Command History
12.3(7)XJ
This command was introduced.
12.4(11)T
This command was integrated into Cisco IOS Release 12.4(11)T.
Usage Guidelines
In order for packet of disconnect (POD) requests to be processed by AAA, you need to configure the aaa server radius dynamic-author global configuration command.
You must configure radius-server attribute 32 include-in-access-req for the home agent to send the fully qualified domain name (FQDN) in the access request.
Examples
The following example enables the home agent to process Radius Disconnect messages:
Router(config)# ip mobile radius disconnectip mobile realm
To enable inbound user sessions to be disconnected when specific session attributes are presented, use the ip mobile realm command in global configuration mode. To disable this functionality, use the no form of this command.
ip mobile realm @xyz.com vrf vrf-name ha-addr ip-address [aaa-group [accounting aaa-acct-group | authentication aaa-auth-group]] [dns dynamic-update method word] [dns server primary dns server address secondary dns server address [assign]] [hotline]
no ip mobile realm ip mobile realm @xyz.com vrf vrf-name ha-addr ip-address [aaa-group [accounting aaa-acct-group | authentication aaa-auth-group]] [dns dynamic-update method word] [dns server primary dns server address secondary dns server address [assign]] [hotline]
Syntax Description
Defaults
There are no default values for this command.
Command Modes
Global configuration
Command History
Usage Guidelines
This CLI defines the VRF for the domain "@xyz.com". The IP address of the Home Agent corresponding to the VRF is also defined, at which the MOIP tunnel will terminate. The IP address of the Home Agent should be a routable IP address on the box. Optionally, the AAA accounting and/or authentication server groups can be defined per VRF. If a AAA accounting server group is defined, all accounting records for the users of the realm will be sent to the specified group. If a AAA authentication server group is defined, HA-CHAP is sent to the server(s) defined in the group.
Examples
The following example identifies the DNS dynamic update keyword:
Router(config)#ip mobile realm @ispxyz1.com dns ?dynamic-update Enable 3GPP2 IP reachabilityserver DNS server configurationThe following example identifies the hotlining and vrf keywords:
Router(config)# ip mobile realm @ispxyz1.com ?dns Configure DNS detailshotline Hotlining of the mobile hostsvrf VRF for the realmip mobile registration-lifetime
To set the registration lifetime value advertised, use the ip mobile registration-lifetime command in interface or global configuration mode. To reset the registration lifetime value advertised to its default value, use the no form of this command.
ip mobile registration-lifetime seconds
no ip mobile registration-lifetime
Syntax Description
Defaults
36000 seconds
Command Modes
Interface and global configuration
Command History
12.0(1)T
This command was introduced.
12.3(11)T
Global configuration mode was added.
Usage Guidelines
This command allows an administrator to control the advertised lifetime on the interface. The foreign agent uses this command to control duration of registration. Visitors requesting longer lifetimes will be denied.
Examples
The following example sets the registration lifetime to 10 minutes on interface Ethernet 1 and 1 hour on interface Ethernet 2:
interface e1ip mobile registration-lifetime 600interface e2ip mobile registration-lifetime 3600Related Commands
show ip mobile interface
Displays advertisement information for interfaces that are providing foreign agent service or are home links for mobile nodes.
ip mobile router
To enable the mobile router and enter mobile router configuration mode, use the ip mobile router command in global configuration mode. To disable the mobile router, use the no form of this command.
ip mobile router
no ip mobile router
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
The mobile router is a router that operates as a mobile node. The mobile router can roam from its home network and still provide connectivity for devices on its networks. The mobile networks are locally attached to the router.
Examples
The following example enables the mobile router:
ip mobile routerRelated Commands
show ip mobile router
Displays configuration information and monitoring statistics about the mobile router.
ip mobile router-service
To enable mobile router service on an interface, use the ip mobile router-service command in interface configuration mode. To disable this service, use the no form of this command.
ip mobile router-service {hold-down [foreign-agent seconds | reassociate msec] | roam [priority value] | solicit [interval seconds] [retransmit initial minimum maximum seconds retry number]}
no ip mobile router-service {hold-down [foreign-agent seconds | reassociate msec] | roam [priority value] | solicit [interval seconds] [retransmit initial minimum maximum seconds retry number]}
Syntax Description
Defaults
hold-down foreign agent seconds: zero
hold-down reassociate msec: 1000
priority value: 100
interval seconds: 600 seconds
retransmit initial minimum maximum seconds: 1000 milliseconds (1 second)
retry number: Three retriesCommand Modes
Interface configuration
Command History
12.2(4)T
This command was introduced.
12.3(14)T
The foreign-agent seconds and reassociate msec keywords and arguments were added.
Usage Guidelines
The mobile router discovers home agents and foreign agents by receiving agent advertisements.
NoteIn Release 12.3(14)T, the ip mobile router-service hold-down command was changed to the ip mobile router-service hold-down foreign-agent command. The previous version of the command is still accepted but the new command will appear in the running configuration.
When a wireless link connected to an interface is lossy, the mobile router must not immediately register with the foreign agent even when heard on a preferred interface. The ip mobile router-service hold-down foreign-agent seconds command allows existing communications to continue with mobile networks while the mobile router gauges the quality of the link to the new foreign agent.
The ip mobile router-service solicit command instructs the mobile router to send agent solicitation messages periodically. Some networks only send out agent advertisements periodically or when solicited. For networks on which agents do not advertise periodically, this function must be enabled to detect agents. The mobile router always sends solicitation messages when roaming interfaces come up.
If a mobile router interface is configured for solicitations, you should set both ip irdp maxadvertinterval seconds and ip irdp holdtime seconds to 0 seconds on the foreign agent. These settings ensure that the foreign agent will not send out any IRDP advertisements unless solicited. If a foreign agent or home agent are sending IRDP advertisements periodically, then a solicitation will trigger the agent to send an advertisement immediately instead of at the next time interval.
The solicit timer for the ip mobile router-service solicit command is reset and no solicitation is sent out on the roaming interface if the mobile router receives an advertisement from a foreign agent before the solicit timer expires. For example, if the mobile router is configured to solicit every 10 seconds and the foreign agent advertises every 3 seconds, the mobile router will never solicit.
Use the ip mobile router-service hold-down reassociate msec command to specify the interval of time that the mobile router will wait, after receiving an SNMP linkDown trap, for a linkUp trap from the Wireless Mobile Interface Card (WMIC) indicating that the wireless link is available for use. This hold-down delay should be long enough for the WMIC to establish connectivity with a new AP or bridge when roaming.
Use the show ip mobile router agent command to display agents learned from advertisements and the mobile router's available CCoAs. Use the show ip mobile router interface command to display the configuration of the interfaces used for roaming.
Examples
The following example configures roaming interfaces, solicitation services, and hold-down timers on serial interface 0 and roaming interfaces and hold-down timers on Ethernet interface 0 of the mobile router.
In this example, the mobile router has two interfaces. The serial interface is connected to a serial interface of a foreign agent and the Ethernet interface is connected to an Ethernet interface of a foreign agent. The mobile router will prefer to register on the Ethernet interface if possible because it has a higher priority than the serial interface. If the mobile router does not receive any agent advertisements on the Ethernet interface, it will use the serial interface to solicit foreign agents.
If the Ethernet interface hears a new foreign agent advertisement after the mobile router has already registered using the serial interface, it will wait the duration of the hold-down timer (20 seconds) before registering with the foreign agent on the Ethernet interface. The ip mobile router-service hold-down foreign-agent seconds command allows communications to continue with mobile networks while the mobile router gauges the quality of the link to the new foreign agent. The Ethernet interface is configured with a higher priority so the mobile router prefers to register with this interface.
Once it receives an agent advertisement on the Ethernet interface, it will use the Ethernet interface to register to its home agent.
interface s0ip mobile router-service roam! s0 solicits every 5 seconds after last advertisement received on the interfaceip mobile router-service solicit interval 5ip mobile router-service hold-down foreign-agent 20interface e0ip mobile router-service roam priority 101ip mobile router-service hold-down foreign-agent 20In the following example, the mobile router is configured to receive dynamic CCoA from DHCP. The mobile router will wait 2000 milliseconds for the SNMP linkUp trap from the WMIC indicating that layer 2 has reassociated. This interval of time allows the mobile router to roam and still maintain wireless connectivity.
interface FastEthernet0ip address dhcpip dhcp client mobile renew count 3 interval 20ip mobile router-service roamip mobile router-service collocatedip mobile router-service hold-down reassociate 2000Related Commands
ip mobile router-service collocated
To enable static or dynamic collocated care-of address (CCoA) processing on a mobile router interface, use the ip mobile router-service collocated command in interface configuration mode. To disable static or dynamic CCoA processing, use the no form of this command.
ip mobile router-service collocated [gateway ip-address] [ccoa-only]
no ip mobile router-service collocated [gateway ip-address] [ccoa-only]
Syntax Description
Defaults
No default behavior or values
Command Modes
Interface configuration
Command History
12.2(15)T
This command was introduced.
12.3(4)T
The ccoa-only keyword was added. Dynamic CCoA functionality was added.
Usage Guidelines
The primary IP address of the interface is used as the CCoA. The interface must already be configured as a roaming interface using the ip mobile router-service roam interface configuration command for both static and dynamic CCoA processing.
The mobile router can register with the home agent using a CCoA that was acquired dynamically via the IP Control Protocol (IPCP).
The gateway IP address is the next-hop IP address for registration packets. Upon successful registration, this address will be used as the default gateway and default route.
You need not specify the gateway ip-address combination if using a serial interface. The gateway ip-address combination is required on all non point-to-point interfaces such as Ethernet LANs and must be on the same logical subnet as the primary interface IP address.
You can configure the mobile router interface to register only its CCoA and ignore foreign agent advertisements by using the ip mobile router-service collocated ccoa-only option. Using this command on an interface already registered with a foreign agent CoA will cause the mobile router to re-register immediately with a CCoA.
Using the no ip mobile router-service collocated ccoa-only command on an interface already registered with a CCoA will cause the interface to deregister its CCoA and begin foreign agent discovery.
Examples
The following example enables static CCoA processing on a mobile router interface:
interface FastEthernet0/0! Primary IP address is the static CCoAip address 172.21.58.23 255.255.255.0ip mobile router-service roam! Gateway IP address is next-hop destinationip mobile router-service collocated gateway 172.21.58.1The following example enables dynamic CCoA processing on a mobile router interface:
interface Serial 3/1ip address negotiatedencapsulation pppip mobile router-service roamip mobile router-service collocatedThe following example enables static CCoA-only processing. The interface will not listen to foreign agent advertisements.
interface Ethernet 1/0ip address 10.0.1.1 255.255.255.0ip mobile router-service roamip mobile router-service collocated gateway 10.0.1.2 ccoa-onlyip mobile router-service collocated registration retry 30The following example enables dynamic CCoA-only processing. The interface will not listen to foreign agent advertisements.
interface Serial 1/0ip address negotiatedencapsulation pppip mobile router-service roamip mobile router-service collocated ccoa-onlyRelated Commands
ip mobile router-service collocated registration nat traversal
To enable Network Address Translation (NAT) traversal support for the mobile router, use the ip mobile router-service collocated registration nat traversal command in interface configuration mode. To disable NAT traversal support for the mobile router, use the no form of this command.
ip mobile router-service collocated registration nat traversal [keepalive seconds] [force]
no ip mobile router-service collocated registration nat traversal [keepalive seconds] [force]
Syntax Description
Command Default
The mobile router does not support NAT traversal.
Command Modes
Interface configuration
Command History
12.4(6)XE
This command was introduced.
12.4(11)T
This command was integrated into Cisco IOS Release 12.4(11)T.
Usage Guidelines
UDP tunneling is negotiated only when the mobile router registers to the home agent in collocated care-of address (CCoA) mode.
If you configure the mobile router to force the home agent to allocate a UDP tunnel but do not configure the home agent to force UDP tunneling, the home agent will reject the forced UDP tunneling request. The decision of whether to force UDP tunneling is controlled by the home agent.
Examples
The following example shows a mobile router configured with a keepalive timer set to 56 seconds and forced to request UDP tunneling.
ip mobile router-service collocated registration nat traversal keepalive 56 forceRelated Commands
ip mobile router-service collocated registration retry
To configure the time period that the mobile router waits before sending another registration request after a registration failure, use the ip mobile router-service collocated registration retry command in interface configuration mode. To disable this functionality, use the no form of this command.
ip mobile router-service collocated registration retry seconds
no ip mobile router-service collocated registration retry
Syntax Description
Defaults
60 seconds
Command Modes
Interface configuration.
Command History
Usage Guidelines
An interface configured for static collocated care-of address (CCoA) will not have foreign agent advertisements to use to trigger new registration attempts. Any foreign agent advertisements detected on that interface are ignored.
The default retry value is 60 seconds. You need to use this command only when a different retry interval is desired.
Examples
The following example shows that the mobile router will wait 30 seconds before sending another registration request after a registration failure:
interface FastEthernet0/0! Primary IP address is the CCoAip address 172.21.58.23 255.255.255.0ip mobile router-service roamip mobile router-service collocated gateway 172.21.58.1ip mobile router-service collocated registration retry 30Related Commands
ip mobile router-service collocated
Enables static CCoA processing on a mobile router interface.
ip mobile router-service description
To add a description for the type of roaming interface that is active on the mobile router, use the ip mobile router-service description command in interface configuration mode. To remove the description, use the no form of this command.
ip mobile router-service description string
no ip mobile router-service description string
Syntax Description
Command Default
If this command is not issued, a description does not exist.
Command Modes
Interface configuration
Command History
Usage Guidelines
If the ip mobile router-service description command is configured, the description of the roaming interface is sent to the home agent during registration and will display in the output of the show ip mobile binding command.
Examples
The following example shows the description for the type of roaming interface on the mobile router:
interface FastEthernet0/0ip mobile router-service description Wireless LANRelated Commands
ip mobile router-service link-type
To enable a link-type roaming interface, use the ip mobile router-service link-type command in interface configuration mode. To disable the link-type roaming interface, use the no form of this command.
ip mobile router-service link-type link-type
no ip mobile router-service link-type
Syntax Description
link-type
Link-type associated with a roaming interface. The following link-types are available:
•
Command Default
No link-type roaming interface is configured.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use this command to configure label-based application routing and the mobile router (MR) roaming interfaces. The link-type label on the interfaces is passed to the home agent (HA) when the interface registers. This label is used during registration on both the MR and the HA to generate dynamic route maps from mobile map templates.
Example:
interface ethernet 1/0ip mobile router-service roamip mobile router-service link-type 802.11gAccess Control Lists
You can use one or more extended named access control lists (ACLs) on both the MR and the HA to identify the application traffic. MR and HA are used as templates at registration time to generate dynamic ACLs that are used in the dynamic route maps.
Example:
ip access-list extended WEBpermit udp any any eq port 8080Mobile Map Mobile Policy Templates
You can use one or more mobile map mobile policy templates on the MR and HA.
Example:
ip mobile mobile-map MPATH_1 10match access-list WEBset link-type 802.11g UMTSset interface null0You need to apply the mobile map to access interfaces. The mobile map is associated with a mobile network interface on the MR in the mobile network configuration. The mobile map configuration on the HA can specify up to three ingress interfaces.
Example:
MR:
ip mobile routermobile-network e 3/0 policy mobile-map MPATH_1HA:
ip mobile routerip mobile home-agent policy mobile-map e 2/0 e 3/0 e 4/0On the MR, a dynamic route map is created when each mobile-map template is configured. The dynamic route map has a long name that contains the first seven characters of the mobile map tag.
Example: A mobile map with the tag "MPATH_1" creates the following dynamic route map:
MIP-00/00/00-01:02:03-1-MPATH_1The dynamic name contains the application that generated the MIP, a date and time stamp, and a sequence number.
On the HA, a single dynamic route map is created when the first mobile map is configured. It has the following name:
MIP-10/11/06-01:02:03-1-MP-HAExamples
The following example shows how to enable the link-type roaming interface using the ip mobile router-service link-type command:
Router> enableRouter# configure terminalRouter(config)# interface FastEthernet0/2Router(config-if)# ip mobile router-service link-type 802.11gRelated Commands
ip mobile router-service roam
Enables the roaming interface of the IP mobile router service.
ip mobile router-service roam
To enable the roaming interface of the IP mobile router service, use the ip mobile router-service roam command in interface configuration mode. To disable a roaming interface, use the no form of this command.
ip mobile router-service roam [priority priority-level]
no ip mobile router-service roam [priority priority-level]
Syntax Description
priority
(Optional) Sets the roaming interface priority of the router service.
priority-level
(Optional) Roaming priority level. The priority level can be 50, 100, 200, and so on.
Command Default
No priority is set for roaming interfaces.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use this command to configure label-based application routing and the mobile router (MR) roaming interfaces. The link type label on the interfaces is passed to the home agent (HA) when the interface registers. This label is used during registration on both the MR and the HA to generate dynamic route maps from mobile map templates.
Example:
interface ethernet 1/0ip mobile router-service roamip mobile router-service link-type 802.11gAccess Control Lists (ACL)
You can use one or more extended named ACLs on both the MR and the HA to identify the application traffic. MR- and HA-named ACLs are used as templates at registration time to generate dynamic ACLs that are used in the dynamic route maps.
Example:
ip access-list extended WEBpermit udp any any eq port 8080Mobile Map Mobile Policy Templates
You can use one or more mobile map mobile policy templates on the MR and HA.
Example:
ip mobile mobile-map MPATH_1 10match access-list WEBset link-type 802.11g UMTSset interface null0You need to apply the mobile map to access interfaces. The mobile map is associated with a mobile network interface on the MR in the mobile network configuration. The mobile map configuration on the HA can specify up to three ingress interfaces.
Example:
MR:
ip mobile routermobile-network e 3/0 policy mobile-map MPATH_1HA:
ip mobile routerip mobile home-agent policy mobile-map e 2/0 e 3/0 e 4/0On the MR, a dynamic route map is created when each mobile map template is configured. The dynamic route map has a long name that contains the first seven characters of the mobile map tag.
Example: A mobile map with the tag "MPATH_1" creates the following dynamic route map:
MIP-00/00/00-01:02:03-1-MPATH_1The dynamic name contains the application that generated the MIP, a date and time stamp, and a sequence number.
On the HA, a single dynamic route map is created when the first mobile map is configured. It has the following name:
MIP-10/11/06-01:02:03-1-MP-HAExamples
The following example shows how to enable a roaming interface and assign a priority for it:
Router> enableRouter# configure terminalRouter# interface FastEthernet0/2Router(config-if)# ip mobile router-service roam priority 101Related Commands
ip mobile router-service link-type
Configures the link type of the roaming interface defined for a mobile router service.
ip mobile router-service tunnel mode
To set the encapsulation mode for a mobile router interface, use the ip mobile router-service tunnel mode command in interface configuration mode. To restore the default encapsultion mode on an interface, use the no form of this command.
ip mobile router-service tunnel mode {gre | ipip}
no ip mobile router-service tunnel mode
Syntax Description
gre
Specifies that the mobile router will attempt to register with Generic Routing Encapsulation (GRE) on the interface.
ipip
Specifies that IP-in-IP encapsulation will be used on the interface.
Defaults
The default encapsulation mode for Mobile IP is IP-in-IP encapsulation.
Command Modes
Interface configuration
Command History
Usage Guidelines
If the ip mobile router-service tunnel mode gre command is configured, the mobile router will request GRE encapsulation in the registration request only if the foreign agent (FA) advertises that it is capable of GRE encapsulation (the G bit is set in the advertisement). If the registration request is successful, packets will be tunneled using GRE.
If the ip mobile router-service tunnel mode gre command is enabled and collocated care-of address (CCoA) is configured, the mobile router will attempt to register with the home agent (HA) using GRE encapsulation. If the registration request is successful, packets will be tunneled using GRE.
If the mobile router receives a denied registration reply with error code 72 (foreign agent required encapsulation unavailable) or error code 139 (home agent unsupported encapsulation), the mobile router will send another registration request with the G bit unset and IP-in-IP encapsulation will be used.
The no ip mobile router-service tunnel mode command instructs the mobile router to revert to the default encapsulation mode and register with IP-in-IP encapsulation.
NoteOnce GRE encapsulation is enabled, GRE keepalives can be configured on an interface using the keepalive command. GRE keepalives check for a failure in the end-to-end tunnel at a configurable interval. If the connection to the HA is lost, the mobile router will attempt to reregister. GRE keepalives must be configured on the mobile router only—no configuration is required on the HA.
NoteExamples
The following example configures GRE encapsulation and GRE keepalive messages on an interface of a mobile router:
interface FastEthernet0/0ip address 10.52.52.2 255.255.255.0ip mobile router-service roamip mobile router-service tunnel mode gre!interface tunnel 121keepalive 5 3!ip mobile routertemplate tunnel 121Related Commands
ip mobile secure
To specify the mobility security associations for the mobile host, visitor, home agent, foreign agent, and proxy-host, use the ip mobile secure command in global configuration mode. To remove the mobility security associations, use the no form of this command.
ip mobile secure {aaa-download | host | visitor | home-agent | foreign-agent | proxy-host} {lower-address [upper-address] | nai string} {inbound-spi spi-in outbound-spi spi-out | spi spi} key hex string [replay timestamp [number] algorithm {md5 | hmac-md5} mode prefix-suffix]
no ip mobile secure {aaa-download | host | visitor | home-agent | foreign-agent | proxy-host} {lower-address [upper-address] | nai string} {inbound-spi spi-in outbound-spi spi-out | spi spi} key hex string [replay timestamp [number] algorithm {md5 | hmac-md5} mode prefix-suffix]
Syntax Description
Defaults
No security association is specified.
Command Modes
Global configuration
Command History
Usage Guidelines
The security association consists of the entity address, SPI, key, replay protection method, authentication algorithm, and mode.
The SPI is the 4-byte index that selects the specific security parameters to be used to authenticate the peer. The security parameters consist of the authentication algorithm and mode, replay attack protection method, timeout, and IP address.
The HMAC-MD5 authentication algorithm is mandatory for mobile-home authentication (MHAE), mobile-foreign authentication (MFAE), and foreign-home authentication (FHAE)
On a home agent, the security association of the mobile host is mandatory for mobile host authentication. If desired, configure a foreign agent security association on your home agent. On a foreign agent, the security association of the visiting mobile host and security association of the home agent are optional. Multiple security associations for each entity can be configured.
If registration fails because the timestamp value is out of bounds, the time stamp of the home agent is returned so that the mobile node can reregister with the time-stamp value closer to that of the home agent, if desired.
The nai keyword is valid only for a host, visitor, and proxy host.
The proxy-host keyword is available only on PDSN platforms running specific PDSN code images; consult Feature Navigator for your Cisco IOS software release.
NoteExamples
The following example shows mobile node 10.0.0.4, which has a key that is generated by the MD5 hash of the string:
ip mobile secure host 10.0.0.4 spi 100 key hex 12345678123456781234567812345678Related Commands
ip mobile secure aaa-download
To specify that authentication, authorization, and accounting (AAA) mobility security associations (SAs) are downloaded from the AAA server and the rate at which the information is downloaded, use the ip mobile secure aaa-download command in global configuration mode. To delete the AAA download rate, use the no form of this command.
ip mobile secure aaa-download rate seconds
no ip mobile secure aaa-download rate seconds
Syntax Description
rate
Rate at which the AAA SA is downloaded.
•
Defaults
No AAA SAs are downloaded.
Command Modes
Global configuration
Command History
Usage Guidelines
SAs are downloaded from a AAA server on the first use. This command allows the home agent (HA) to prepopulate an SA table.
Examples
The following example shows a download rate of 35 seconds:
ip mobile secure aaa-download rate 35Related Commands
ip mobile secure foreign-agent
To specify the mobility security associations (SAs) for a foreign agent (FA), use the ip mobile secure foreign-agent command in global configuration mode. To remove the mobility SAs, use the no form of this command.
ip mobile secure foreign-agent lower-address [upper-address] {inbound-spi {hex-in | decimal decimal-in} outbound-spi {hex-out | decimal decimal-out} | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp within seconds] [algorithm {hmac-md5 | md5 mode prefix-suffix}]
no ip mobile secure foreign-agent lower-address [upper-address] {inbound-spi {hex-in | decimal decimal-in} outbound-spi {hex-out | decimal decimal-out} | spi {hex-value | decimal decimal-value}}
Syntax Description
Defaults
No SA is specified for FAs.
Command Modes
Global configuration
Command History
12.0(1)T
This command was introduced.
12.2
The lower-address and upper-address arguments were added.
12.2(13)T
The hmac-md5 keyword was added.
Usage Guidelines
The SA consists of an entity address, SPI, key, replay protection method, authentication algorithm, and authentication algorithm mode (prefix-suffix).
On a FA, the SA of the visiting mobile host and the SA of the home agent (HA) are optional. Multiple SAs for each entity can be configured.
The SA of a visiting mobile host on the MFAE and the SA of the HA on the FHAE are optional on the FA as long as they are not specified on the other entity. Multiple SAs for each entity can be configured.
NoteExamples
The following example shows the configuration of an FA with an IP address of 209.165.200/254:
ip mobile secure foreign-agent 209.165.200/254 inbound-spi 203 outbound-spi 150 key hex ffffffffRelated Commands
ip mobile secure home-agent
To specify the mobility security associations (SAs) for a home agent (HA), use the ip mobile secure home-agent command in global configuration mode. To remove the mobility SAs, use the no form of this command.
ip mobile secure home-agent lower-address [upper-address] {inbound-spi {hex-in | decimal decimal-in} outbound-spi {hex-out | decimal decimal-out} | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp within seconds] [algorithm {hmac-md5 | md5 mode prefix-suffix}] [ignore-spi]
np ip mobile secure home-agent lower-address [upper-address] {inbound-spi {hex-in | decimal decimal-in} outbound-spi {hex-out | decimal decimal-out} | spi {hex-value | decimal decimal-value}}
Syntax Description
Defaults
No SA is specified for HAs.
Command Modes
Global configuration
Command History
12.0(1)T
This command was introduced.
12.2
The lower-address and upper-address arguments were added.
12.2(13)T
The hmac-md5 keyword was added.
Usage Guidelines
The SA consists of an entity address, SPI, key, replay protection method, authentication algorithm, and authentication algorithm mode (prefix-suffix).
The HA may have multiple SAs for each peer. The SPI specifies which SA to use for the peer and selects the specific security parameters to be used to authenticate the peer.
On an HA, the SA of the mobile host is mandatory for mobile host authentication and allows the HA to compute the MHAE for mobile host authentication. If desired, configure a foreign agent (FA) SA on your HA.
The mobile IP protocol automatically synchronizes the time stamp used by the mobile node (MN) in its registration requests. If the MN registration request time stamp is outside the HA permitted replay protection time interval, the HA will respond with the number of seconds by which the MN time stamp is off relative to the HA clock. This allows the MN to adjust its time stamp and use synchronized time stamps in subsequent registration attempts.
If you prefer that the MN first registration attempt always fall within the HA replay protection time interval, use Network Time Protocol (NTP) to synchronize the MN and HA.
NoteExamples
The following example shows the configuration of an SA for an HA with an IP address of 10.0.0.4:
ip mobile secure home-agent 10.0.0.4 spi 100 key hex ffffffffRelated Commands
ip mobile secure host
To specify the mobility security associations (SAs) for a mobile host, use the ip mobile secure host command in global configuration mode. To remove the mobility SAs, use the no form of this command.
ip mobile secure host {lower-address [upper-address] | nai nai-string} {inbound-spi {hex-in | decimal decimal-in} outbound-spi {hex-out | decimal decimal-out} | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp within seconds] [algorithm {hmac-md5 | md5 mode prefix-suffix }]
no mobile secure host {lower-address [upper-address] | nai nai-string} {inbound-spi {hex-in | decimal decimal-in} outbound-spi {hex-out | decimal decimal-out} | spi {hex-value | decimal decimal-value}}
Syntax Description
Defaults
No SA is specified for mobile hosts.
Command Modes
Global configuration
Command History
Usage Guidelines
The SA consists of an entity address, SPI, key, replay protection method, authentication algorithm, and authentication algorithm mode (prefix-suffix).
The SA of a visiting mobile host on the MFAE and the SA of the home agent (HA) on the FHAE are optional as long as they are not specified on the other entity. Multiple SAs for each entity can be configured.
The HMAC-MD5 authentication algorithm is mandatory for MHAE, MFAE, and FHAE.
NoteExamples
The following example shows the configuration of an SA for a host:
ip mobile secure host 10.0.0.4 spi 100 key hex 12345678123456781234567812345678Related Commands
ip mobile secure mn-aaa
To specify non-standard security parameter index (SPI) values in the MN-AAA authentication extension that need to be accepted by the home agent or the foreign agent, use the ip mobile secure mn-aaa command in global configuration mode. To disable this functionality, use the no form of this command.
ip mobile secure mn-aaa spi {hex-value | decimal decimal-value} algorithm md5 mode ppp-chap-style
no ip mobile secure mn-aaa spi {hex-value | decimal decimal-value} algorithm md5 mode ppp-chap-style
Syntax Description
Defaults
The home agent or foreign agent only accept the standard SPI value in the MN-AAA authentication extension that specifes CHAP-style authentication using MD5. The standard value for the SPI is 2.
Command Modes
Global configuration
Command History
Usage Guidelines
The SPI is the 4-byte index that selects the specific security parameters to be used to authenticate the peer. The security parameters consist of the authentication algorithm and mode.
A mobile node configured to be authenticated via an MN-AAA authentication extension is required to use an SPI value of 2 to indicate CHAP-style authentication using MD5 as specified by RFC 3012, Mobile IPv4 Challenge/Response Extensions.
Some network implementations need the flexibility to allow an SPI value other than 2 even though the mobile node is authenticated using CHAP. The ip mobile secure mn-aaa command maps new SPI values in the MN-AAA extension of the registration message to the SPI value pre-defined by RFC 3012. When a registration request arrives at the foreign agent or home agent with the MN-AAA extension containing an SPI value specified by the ip mobile secure mn-aaa command, the foreign agent or home agent will process it as if the value was 2 instead of rejecting the request.
Use this command with caution because it is non-standard behavior. For example, different vendors might use the same non-standard SPI to denote different authentication methods and this could affect interoperability. Cisco recommends the use of standard SPI values if possible to be used in the MN-AAA authentication extension by the mobile node.
Examples
In the following example, the foreign agent or home agent will process the registration request even though the CHAP SPI value is not 2:
ip mobile secure mn-aaa spi 1234 algorithm md5 mode ppp-chap-styleip mobile secure proxy-host
To specify the mobility security associations (SAs) for a proxy host, use the ip mobile secure proxy-host command in global configuration mode. To remove the mobility SAs, use the no form of this command.
ip mobile secure proxy-host {lower-address [upper-address] | nai nai-string} {inbound-spi spi-in outbound-spi spi-out | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp seconds] [algorithm {md5 mode prefix-suffix | hmac-md5}]
no ip mobile secure proxy-host {lower-address [upper-address] | nai nai-string} {inbound-spi spi-in outbound-spi spi-out | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp seconds] [algorithm {md5 mode prefix-suffix | hmac-md5}]
Syntax Description
Defaults
No SA is specified for proxy hosts.
Command Modes
Global configuration
Command History
Usage Guidelines
The SA consists of an entity address, SPI, key, replay protection method, authentication algorithm, and authentication algorithm mode (prefix-suffix).
The HMAC-MD5 authentication algorithm is mandatory for MHAE, MFAE, and FHAE.
Note
NoteExamples
The following example shows the configuration of SAs for a proxy host:
ip mobile secure proxy-host 10.0.0.4 spi 100 key hex 12345678123456781234567812345678Related Commands
ip mobile secure visitor
To specify the mobility security associations (SAs) for a visitor, use the ip mobile secure visitor command in global configuration mode. To remove the mobility security associations, use the no form of this command.
ip mobile secure visitor {lower-address [upper-address] | nai nai-string} {inbound-spi spi-in outbound-spi spi-out | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp seconds] [algorithm {md5 mode prefix-suffix | hmac-md5}]
no ip mobile secure visitor {lower-address [upper-address] | nai nai-string} {inbound-spi spi-in outbound-spi spi-out | spi {hex-value | decimal decimal-value}} key {ascii string | hex string} [replay timestamp seconds] [algorithm {md5 mode prefix-suffix | hmac-md5}]
Syntax Description
Defaults
No SA is specified for visitors.
Command Modes
Global configuration
Command History
Usage Guidelines
The SA consists of an entity address, SPI, key, replay protection method, authentication algorithm, and authentication algorithm mode (prefix-suffix).
The SA of a visiting mobile host on the MFAE and the SA of the home agent (HA) on the FHAE are optional as long as they are not specified on the other entity. Multiple SAs for each entity can be configured.
The mobile IP protocol automatically synchronizes the time stamp used by the MN in its registration requests. If the MN registration request time stamp is outside the visitor permitted replay protection time interval, the visitor will respond with the number of secondsby which the MN time stamp is off relative to the visitor clock. This allows the MN to adjust its time stamp and use synchronized time stamps in subsequent registration attempts.
If you prefer that the MN first registration attempt always fall within the visitor replay protection time interval, use Network Time Protocol (NTP) to synchronize the MN and visitor.
The HMAC-MD5 authentication algorithm is mandatory for MHAE, MFAE, and FHAE.
NoteExamples
The following example shows the configuration of SAs for a visitor:
ip mobile secure visitor 10.0.0.4 spi 100 key hex 12345678123456781234567812345678Related Commands
ip mobile tunnel
To specify the settings of tunnels created by Mobile IP, use the ip mobile tunnel command in global configuration mode. To disable the setting of tunnels created by Mobile IP, use the no form of this command.
ip mobile tunnel {crypto map map-name | route-cache [cef] | path-mtu-discovery [age-timer {minutes | infinite}] | nat {inside | outside} | route-map map-tag}
no ip mobile tunnel {crypto map map-name | route-cache [cef] | path-mtu-discovery [age-timer {minutes | infinite}] | nat {inside | outside} | route-map map-tag}
Syntax DescriptionI
Defaults
Disabled.
If enabled, default value for the minutes argument is 10 minutes.
Command Modes
Global configuration
Command History
Usage Guidelines
Path MTU Discovery is used by end stations to find a packet size that does not need to be fragmented when being sent between the end stations. Tunnels must adjust their MTU to the smallest MTU interior to achieve this condition, as described in RFC 2003.
The discovered tunnel MTU should be aged out periodically to possibly recover from a case where suboptimum MTU existed at time of discovery. It is reset to the outgoing MTU of the interface.
The no ip mobile tunnel route-cache command disables fast switching and CEF switching (if CEF is enabled) on Mobile IP tunnels. The no ip mobile tunnel route-cache cef command disables CEF switching only.
CEF switching is currently not supported on a foreign agent when reverse tunneling is enabled. If reverse tunneling is enabled at the foreign agent, disable CEF on the foreign agent using the no ip cef global configuration command. If the foreign agent does not support reverse tunneling, there is no need to disable CEF at the global configuration level.
The crypto map map-name keyword and argument combination are available only on platforms running specific PDSN code images; consult Feature Navigator for your Cisco IOS software release.
Examples
The following example sets the discovered tunnel MTU to expire in 10 minutes (600 seconds):
ip mobile tunnel path-mtu-discovery age-timer 600Related Commands
ip cef
Enables CEF on the RP card.
show ip mobile tunnel
Displays active tunnels.
ip mobile virtual-network
To define a virtual network, use the ip mobile virtual-network command in global configuration mode. To remove the virtual network, use the no form of this command.
ip mobile virtual-network net mask [address address]
no ip mobile virtual-network net mask
Syntax Description
Defaults
No home agent addresses are specified.
Command Modes
Global configuration
Command History
12.0(1)T
This command was introduced.
12.0(2)T
The address keyword and address argument were added.
Usage Guidelines
This command inserts the virtual network into the routing table to allow mobile nodes to use the virtual network as their home network. The network is propagated when redistributed to other routing protocols.
NoteExamples
The following example adds the virtual network 20.0.0.0 to the routing table and specifies that the home agent IP address is configured on the loopback interface for that virtual network:
interface ethernet 0ip address 1.0.0.1 255.0.0.0standby ip 1.0.0.10standby name SanJoseHAinterface loopback 0ip address 20.0.0.1 255.255.255.255ip mobile home-agentip mobile virtual-network 20.0.0.0 255.255.0.0 address 20.0.0.1ip mobile home-agent standby SanJoseHA virtual-networkip mobile secure home-agent 1.0.0.2 spi 100 hex 00112233445566778899001122334455Related Commands
ip mobile host
Configures the mobile host or mobile node group.
redistribute mobile
Redistributes routes from one routing domain into another routing domain.
ip mobile vpn-realm
To define the virtual private network (VPN) realms to be used in home agent policy routing, use the ip mobile vpn-realm command in global configuration mode. To remove the VPN realms, use the no form of this command.
ip mobile vpn-realm realm-name {route-map-sequence sequence-number}
no ip mobile vpn-realm realm-name {route-map-sequence sequence-number}
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
The sequence-number argument must match that configured in the route-map sequence-number command.
Examples
The following example shows two realms configured on the router:
ip mobile vpn-realm company1.com route-map-sequence 20ip mobile vpn-realm company2.com route-map-sequence 10Related Commands
ipv4-address
To configure the IPv4 address for the Local Mobility Anchor (LMA) or the Mobile Access Gateway (MAG) within the Proxy Mobile IPv6 (PMIP) domain, use the ipv4-address command in PMIP domain LMA, PMIP domain MAG, or MAG-LMA configuration mode. To remove the IPv4 address for the LMA or MAG, use the no form of this command.
ipv4-address ipv4-address
no ipv4-address
Syntax Description
Command Default
No IPv4 address is configured for the LMA or MAG.
Command Modes
MAG-LMA configuration (config-ipv6-pmipv6mag-lma)
PMIP domain LMA configuration (config-ipv6-pmipv6-domain-lma)
PMIP domain MAG configuration (config-ipv6-pmipv6-domain-mag)Command History
Usage Guidelines
Use the ipv4-address command in PMIP domain LMA configuration mode to configure the IPv4 address for the LMA within the PMIP domain.
Use the ipv4-address command in PMIP domain MAG configuration mode to configure the IPv4 address for the MAG within the PMIP domain.
Use the ipv4-address command in MAG-LMA configuration mode to configure the IPv4 address for the LMA within the MAG.
Examples
The following example shows how to configure the IPv4 address for the LMA within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# lma lma1Router(config-ipv6-pmipv6-domain-lma)# ipv4-address 10.1.1.1The following example shows how to configure the IPv4 address for the MAG within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# mag mag1Router(config-ipv6-pmipv6-domain-mag)# ipv4-address 10.1.2.1The following example shows how to configure the IPv4 address for the LMA within the MAG:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# exitRouter(config)# ipv6 mobile pmipv6-mag mag1 domain dn1Router(config-ipv6-pmipv6-mag)# lma lma1 dn1Router(config-ipv6-pmipv6mag-lma)# ipv4-address 10.1.2.1Related Commands
ipv6-address (proxy mobile ipv6)
To configure the IPv6 address for the Local Mobility Anchor (LMA) or the Mobile Access Gateway (MAG) within the Proxy Mobile IPv6 (PMIP) domain, use the ipv6-address command in PMIP domain LMA, PMIP domain MAG, or MAG-LMA configuration mode. To remove the IPv6 address for the LMA or MAG, use the no form of this command.
ipv6-address ipv6-address
no ipv6-address
Syntax Description
Command Default
No IPv6 address is configured for the LMA or MAG.
Command Modes
MAG-LMA configuration (config-ipv6-pmipv6mag-lma)
PMIP domain LMA configuration (config-ipv6-pmipv6-domain-lma)
PMIP domain MAG configuration (config-ipv6-pmipv6-domain-mag)Command History
Usage Guidelines
Use the ipv6-address command in PMIP domain LMA configuration mode to configure the IPv6 address for the LMA within the PMIP domain.
Use the ipv6-address command in PMIP domain MAG configuration mode to configure the IPv6 address for the MAG within the PMIP domain.
Use the ipv6-address command in MAG-LMA configuration mode to configure the IPv6 address for the LMA within the MAG.
Examples
The following example shows how to configure the IPv6 address for the LMA within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# lma lma1Router(config-ipv6-pmipv6-domain-lma)# ipv6-address 2001:0DB8:2:3::1The following example shows how to configure the IPv6 address for the MAG within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# mag mag1Router(config-ipv6-pmipv6-domain-mag)# ipv6-address 2001:0DB8:2:3::2The following example shows how to configure the IPv6 address for the LMA within the MAG:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# exitRouter(config)# ipv6 mobile pmipv6-mag mag1 domain dn1Router(config-ipv6-pmipv6-mag)# lma lma1 dn1Router(config-ipv6-pmipv6mag-lma)# ipv6-address 2001:0DB8:2:3::2Related Commands
ipv6 mobile pmipv6-domain
To configure the Proxy Mobile IPv6 (PMIP) domain, use the ipv6 mobile pmipv6-domain command in global configuration mode. To remove the PMIP domain configuration, use the no form of this command.
ipv6 mobile pmipv6-domain domain-name [load-aaa]
no ipv6 mobile pmipv6-domain domain-name [load-aaa]
Syntax Description
domain-name
PMIP domain name.
load-aaa
(Optional) Loads the domain configuration from the authentication, authorization, and accounting (AAA) server.
Command Default
No PMIP domain is configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use the ipv6 mobile pmipv6-domain domain-name command to enter PMIP domain configuration mode and configure the domain-specific parameters.
Use the ipv6 mobile pmipv6-domain domain-name load-aaa to create the PMIP domain using the configuration from AAA.
Examples
The following example shows how to enter PMIP domain configuration mode to configure the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)#The following example shows how to configure the PMIP domain by using the domain configuration from AAA:
Router(config)# ipv6 mobile pmipv6-domain dn1 load-aaaRelated Commands
ipv6 mobile pmipv6-mag
To enable the Mobile Access Gateway (MAG) service on the router and to configure the Proxy Mobile IPv6 (PMIP) domain for the MAG, use the ipv6 mobile pmipv6-mag command in global configuration mode. To disable the MAG service, use the no form of this command.
ipv6 mobile pmipv6-mag mag-id domain domain-name [force]
no ipv6 mobile pmipv6-mag mag-id domain domain-name
Syntax Description
Command Default
MAG service on the router is not configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use the ipv6 mobile pmipv6-mag mag-id domain domain-name command to enable the MAG service on the router. This command configures the MAG-specific parameter values to the default configuration available in the PMIP domain, and enters MAG configuration mode.
Use the ipv6 mobile pmipv6-mag mag-id domain domain-name force command to set the MAG-specific parameter values to the default values set in the PMIP domain.
The MAG service depends on the network time protocol service, IPv4/IPv6 routing, and IPv4/IPV6 address configuration on the interfaces.
Examples
The following example shows how to configure the MAG:
Router(config)# ipv6 mobile pmipv6-mag mag1 domain dn1Router(config-ipv6-pmipv6-mag)#The following example shows how to reset the MAG configuration to the default configuration available in the PMIP domain:
Router(config)# ipv6 mobile pmipv6-mag mag1 domain dn1 forceRelated Commands
ipv6 mobile pmipv6-domain
Configures the PMIP domain.
show ipv6 mobile pmipv6 mag globals
Displays the global MAG configuration.
lma
To specify the Local Mobility Anchors (LMAs) within the Proxy Mobile IPv6 (PMIP) domain, or to configure the LMA for the mobile node (MN) or the Mobile Access Group (MAG) within the PMIP domain, use the lma command in PMIP domain, mobile node, or MAG configuration mode. To disable the LMA configuration, use the no form of this command.
lma lma-id domain-name
no lma lma-id
Syntax Description
lma-id
LMA identifier.
domain-name
Domain name to which the LMA belongs. The domain-name argument is available only in MAG configuration mode.
Command Default
The LMA within the PMIP domain is not configured. The LMA for the MN within the PMIP domain is not configured.
Command Modes
MAG configuration (config-ipv6-pmipv6-mag)
Mobile node configuration (config-ipv6-pmipv6-domain-mn)
PMIP domain configuration (config-ipv6-pmipv6-domain)Command History
Usage Guidelines
Use the lma command in PMIP domain configuration mode to enter LMA configuration mode and configure IPv4 and IPv6 addresses for the LMA within the PMIP domain.
Use the lma command in MN configuration mode to specify the LMA for the MN within the PMIP domain.
Use the lma command in MAG configuration mode to specify the LMA for the MAG.
Examples
The following example shows how to enter LMA configuration mode to configure the LMA in PMIP domain configuration mode:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# lma lma1Router(config-ipv6-pmipv6-domain-lma)#The following example shows how to configure the LMA for the MN within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# nai example@example.comRouter(config-ipv6-pmipv6-domain-mn)# lma lma1The following example shows how to configure the LMA for the MAG within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-mag mag1 domain dn1Router(config-ipv6-pmipv6-mag)# lma lma1 dn1Router(config-ipv6-pmipv6mag-lma)#Related Commands
ipv6 mobile pmipv6-domain
Configures the PMIP domain.
nai
Configures the NAI for the mobile node within a PMIP domain.
local-routing-mag
To enable local routing for the Mobile Access Gateway (MAG), use the local-routing-mag command in PMIP domain or MAG configuration mode. To disable local routing for the MAG, use the no form of this command.
local-routing-mag
no local-routing-mag
Syntax Description
This command has no arguments or keywords.
Command Default
Local routing is not enabled for the MAG.
Command Modes
MAG configuration (config-ipv6-pmipv6-mag)
PMIP domain configuration (config-ipv6-pmipv6-domain)Command History
Examples
The following example shows how to enable local routing for the MAG in PMIP configuration mode:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# local-routing-magThe following example shows how to enable local routing for the MAG in MAG configuration mode:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# exitRouter(config)# ipv6 mobile pmipv6-mag mag1 domain dn1Router(config-ipv6-pmipv6-mag)# local-routing-magRelated Commands
ipv6 mobile pmipv6-domain
Configures the PMIP domain.
ipv6 mobile pmipv6-mag
Configures the MAG for the PMIP domain.
mag
To configure the Mobile Access Gateway (MAG) within the Proxy Mobile IPv6 (PMIP) domain, use the mag command in PMIP domain configuration mode. To disable the MAG configuration, use the no form of this command.
mag mag-id
no mag mag-id
Syntax Description
Command Default
The MAG within the PMIP domain is not configured.
Command Modes
PMIP domain configuration (config-ipv6-pmipv6-domain)
Command History
Usage Guidelines
Use the mag command to configure the MAG within the PMIP domain.
Examples
The following example shows how configure the MAG within the PMIP domain:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# mag mag1Router(config-ipv6-pmipv6-domain-mag)#Related Commands
mn-profile-load-aaa
To load the profile configuration from the authentication, authorization, and accounting (AAA) server to the mobile node (MN) within the Proxy Mobile IPv6 (PMIP) domain, use the mn-profile-load-aaa command in PMIP domain configuration mode. To disable triggering of AAA requests, use the no form of this command.
mn-profile-load-aaa
no mn-profile-load-aaa
Syntax Description
This command has no arguments or keywords.
Command Default
The profile configuration for the MN is not loaded.
Command Modes
PMIP domain configuration (config-ipv6-pmipv6-domain)
Command History
Usage Guidelines
Use the mn-profile-load-aaa command to configure the MN using the configuration from the AAA server.
Examples
The following example shows how to configure the MN within the PMIP domain using the configuration from AAA:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# mn-profile-load-aaaRelated Commands
mobile-network
To specify the mobile router interface that is connected to the dynamic mobile network, use the mobile-network command in mobile router configuration mode. To disassociate the networks from the mobile router, use the no form of this command.
mobile-network interface
no mobile-network interface
Syntax Description
Defaults
No default behavior or values.
Command Modes
Mobile router configuration
Command History
Usage Guidelines
The IP address and mask of the interface are added to the registration request to notify the home agent of the mobile networks. Once the home agent acknowledges the mobile network, the mobile router will no longer add the mobile network information in subsequent requests.
Examples
The following example shows how to enable mobile router services. In this example, the mobile router located at 10.0.0.3 is dynamically registering the primary interface address on Ethernet interface 3/2:
router mobileip mobile routeraddress 10.0.0.3 255.0.0.0home-agent 10.0.0.4!specifies the Mobile Router interface connected to the mobile networkmobile-network Ethernet3/2register lifetime 120Related Commands
register (mobile networks)
Dynamically registers the mobile networks with the home agent.
mode bypass
To enable Virtual Multipoint Interfaces (VMI) to support multicast traffic, use the mode bypass command in interface configuration mode. To return the interface to the default mode of aggregate, use the no form of this command.
mode [aggregate | bypass]
no mode bypass
Syntax Description
aggregate
Sets the mode to aggregate. All virtual-access interfaces created by PPPoE sessions are logically aggregated under the VMI.
bypass
Sets the mode to bypass.
Defaults
No mode
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the mode bypass command when you need to support multicast traffic in router-to-radio configurations.
Aggregate Mode
The default mode for operation of the VMI is aggregate mode. In aggregate mode, all of the virtual-access interfaces created by PPPoE sessions are logically aggregated under the VMI. As such, applications above Layer 2, such as, EIGRP and OSPFv3, should be defined on the VMI interface only. Packets sent to the VMI will be correctly forwarded to the correct virtual-access interface.
Bypass Mode
Using bypass mode is recommended for multicast applications.
In bypass mode, the virtual-access interfaces are directly exposed to applications running above Layer2. In bypass mode, definition of a VMI is still required because the VMI will continue to manage presentation of cross-layer signals, such as, neighbor up, neighbor down, and metrics. However, applications will still be aware on the actual underlying virtual-access interfaces and send packets to them directly.
Using bypass mode can cause databases in the applications to be larger because knowledge of more interfaces are required for normal operation.
After you enter the mode bypass command, Cisco recommends that you copy the running configuration to NVRAM. because the default mode of operation for VMI is to logically aggregate the virtual-access interfaces.
Examples
Bypass Mode on VMI Interfaces
Enabling Multicast on VMI interfaces includes changing the VMI interface to bypass mode and enabling Protocol Independent Multicast (PIM) sparse mode on the virtual-template interface.
Router# enableRouter# configure terminal!Router(config)#interface Virtual-Template1Router(config-if)#ip address 10.3.3.1 255.255.255.0Router(config-if)# load-interval 30Router(config-if)# no keepaliveRouter(config-if)# ip pim sparse-dense-modeRouter(config-if)#service-policy output FQ!!Router(config)#interface vmi1Router(config-if)#ip address 10.3.9.1 255.255.255.0Router(config-if)# load-interval 30Router(config-if)# physical-interface FastEthernet0/0Router(config-if)# mode bypass!Router(config)#endOSPF v3 Using Bypass Mode for IPv6 Multicast Traffic Example
The ipv6 ospf network point-to-multipoint command in this OSPF example is needed to allow OSPFv3 to learn dynamic metrics from the link.
version 12.4!hostname host1!enableconfigure terminal!no aaa new-modelclock timezone EST -5!!!ip cefno ip domain lookupipv6 unicast-routingipv6 cefsubscriber authorization enable!subscriber profile host1pppoe service manet_radio!multilink bundle-name authenticatedno virtual-template subinterface!!archivelog config!policy-map FQclass class-defaultfair-queue!bba-group pppoe VMI1virtual-template 1service profile host1!interface Loopback1no ip addressload-interval 30ipv6 address 2001:0DB1::1/64ipv6 enablepv6 ospf 1 area 0!interface FastEthernet0/0no ip addressno ip mroute-cacheload-interval 30speed 100full-duplexipv6 enablepppoe enable group VMI1!interface Serial1/0no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/1no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/2no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/3no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface FastEthernet2/0switchport access vlan 2duplex fullspeed 100!interface FastEthernet2/1switchport access vlan 503load-interval 30duplex fullspeed 100!interface FastEthernet2/2shutdown!interface FastEthernet2/3shutdown!interface Virtual-Template1no ip addressload-interval 30ipv6 address 2001:0DB2::1/64ipv6 enable!ipv6 ospf network point-to-multipointipv6 ospf cost dynamicipv6 ospf 1 area 0no keepaliveservice-policy output FQ!interface Vlan1no ip addressno ip mroute-cacheshutdown!interface Vlan2no ip addressno ip mroute-cacheload-interval 30ipv6 address 2001:0DB5::1/64ipv6 enableipv6 ospf 1 area 0!interface Vlan503load-interval 30ipv6 address 2001:0DB8::1/64ipv6 enableipv6 ospf 1 area 0!interface vmi1no ip addressload-interval 30ipv6 enablephysical-interface FastEthernet0/0mode bypass!!no ip http serverno ip http secure-server!ipv6 router ospf 1log-adjacency-changesredistribute connected metric-type 1!!!control-plane!!line con 0exec-timeout 0 0stopbits 1line aux 0line vty 0 4login!endEIGRP IPv4 with Bypass Mode Example
In this example, the IP address of the VMI1 interface needs to be defined, but it will not be routable because the vmi interface will be configured as down/down.
version 12.4ostname host1!no aaa new-modelclock timezone EST -5ip cef!no ip domain lookupsubscriber authorization enable!subscriber profile host1pppoe service manet_radio!!multilink bundle-name authenticatedno virtual-template subinterface!archivelog config!policy-map FQclass class-defaultfair-queue!!!bba-group pppoe VMI1virtual-template 1service profile host1!!interface Loopback1ip address 10.9.1.1 255.255.255.0load-interval 30!interface FastEthernet0/0no ip addressno ip mroute-cacheload-interval 30speed 100full-duplexpppoe enable group VMI1!interface Serial1/0no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/1no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/2no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/3no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface FastEthernet2/0switchport access vlan 2duplex fullspeed 100!interface FastEthernet2/1switchport access vlan 503load-interval 30duplex fullspeed 100!interface FastEthernet2/2shutdown!interface FastEthernet2/3shutdown!interface Virtual-Template1ip address 10.3.3.1 255.255.255.0load-interval 30no keepaliveservice-policy output FQ!interface Vlan1no ip addressno ip mroute-cacheshutdown!interface Vlan2ip address 10.15.60.144 255.255.255.0no ip mroute-cacheload-interval 30!interface Vlan503ip address 10.2.2.2 255.255.255.0load-interval 30ipv6 address 3514:8::1/64ipv6 enable!interface vmi1ip address 10.3.9.1 255.255.255.0load-interval 30physical-interface FastEthernet0/0mode bypass!router eigrp 1redistribute connectednetwork 10.2.0.0 0.0.255.255network 10.3.0.0 0.0.255.255EIGRP for IPv6 Example
version 12.4enableconfigure terminalip cef!!!no ip domain lookupipv6 unicast-routingipv6 cefsubscriber authorization enable!subscriber profile host1pppoe service manet_radio!multilink bundle-name authenticatedno virtual-template subinterface!!!archivelog config!!policy-map FQclass class-defaultfair-queue!!!bba-group pppoe VMI1virtual-template 1service profile host1!!interface Loopback1load-interval 30ipv6 address 2001:)DB1::1/64ipv6 enableipv6 eigrp 1!interface FastEthernet0/0no ip addressno ip mroute-cacheload-interval 30speed 100full-duplexpppoe enable group VMI1!interface Serial1/0no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/1no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/2no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/3no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface FastEthernet2/0switchport access vlan 2duplex fullspeed 100!interface FastEthernet2/1switchport access vlan 503load-interval 30duplex fullspeed 100!interface FastEthernet2/2shutdown!interface FastEthernet2/3shutdown!interface Virtual-Template1no ip addressload-interval 30ipv6 address 2001:0DB2::1/64ipv6 enableipv6 eigrp 1no keepaliveservice-policy output FQ!interface Vlan1no ip addressno ip mroute-cacheshutdown!interface Vlan2no ip addressno ip mroute-cacheload-interval 30ipv6 address 2001:0DB5::1/64ipv6 enableipv6 eigrp 1!interface Vlan503no ip addressload-interval 30ipv6 address 2001:0DB8::1/64ipv6 enableipv6 eigrp 1!interface vmi1no ip addressload-interval 30ipv6 enablephysical-interface FastEthernet0/0mode bypass!!no ip http serverno ip http secure-server!ipv6 router eigrp 1no shutdownredistribute connected!!!EIGRP with IPv4 and IPv6 Traffic Using Bypass Mode Example
version 12.4T!hostname host1!enableconfigure terminalip cefno ip domain lookupipv6 unicast-routingipv6 cefsubscriber authorization enable!subscriber profile host1pppoe service manet_radio!multilink bundle-name authenticatedno virtual-template subinterface!archivelog config!!policy-map FQclass class-defaultfair-queue!bba-group pppoe VMI1virtual-template 1service profile host1!!interface Loopback1ip address 10.9.1.1 255.255.255.0load-interval 30ipv6 address 2001:0DB1::1/64ipv6 enableipv6 eigrp 1!interface FastEthernet0/0no ip addressno ip mroute-cacheload-interval 30speed 100full-duplexpppoe enable group VMI1!interface Serial1/0no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/1no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/2no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface Serial1/3no ip addressno ip mroute-cacheshutdownclock rate 2000000!interface FastEthernet2/0switchport access vlan 2duplex fullspeed 100!interface FastEthernet2/1switchport access vlan 503load-interval 30duplex fullspeed 100!interface FastEthernet2/2shutdown!interface FastEthernet2/3shutdown!interface Virtual-Template1ip address 10.3.3.1 255.255.255.0load-interval 30ipv6 address 2001:0DB8:0000:0000::/64ipv6 enableipv6 eigrp 1no keepaliveservice-policy output FQ!interface Vlan1no ip addressno ip mroute-cacheshutdown!interface Vlan2ip address 10.15.60.144 255.255.255.0no ip mroute-cacheload-interval 30!interface Vlan503ip address 10.2.2.2 255.255.255.0load-interval 30ipv6 address 2001:0DB8::1/64ipv6 enableipv6 eigrp 1!interface vmi1ip address 10.3.9.1 255.255.255.0load-interval 30ipv6 enablephysical-interface FastEthernet0/0mode bypass!router eigrp 1redistribute connectednetwork 10.2.0.0 0.0.255.255network 10.3.0.0 0.0.255.255auto-summary!!no ip http serverno ip http secure-server!ipv6 router eigrp 1eigrp router-id 10.9.1.1no shutdownredistribute connected!!!endRelated Commands
multi-homed
To enable multihoming for the mobile node (MN) within the Proxy Mobile IPv6 (PMIP) domain, use the multi-homed command in mobile node configuration mode. To remove the multihoming feature for the MN, use the no form of this command.
multi-homed
no multi-homed
Syntax Description
This command has no arguments or keywords.
Command Default
Multihoming is not enabled for the MN.
Command Modes
Mobile node configuration (config-ipv6-pmipv6-domain-mn)
Command History
Usage Guidelines
NoteExamples
The following example shows how to enable multihoming for the MN:
Router(config)# ipv6 mobile pmipv6-domain dn1Router(config-ipv6-pmipv6-domain)# nai example@cisco.comRouter(config-ipv6-pmipv6-domain-mn)# multi-homedRelated Commands
ipv6 mobile pmipv6-domain
Configures the PMIP domain.
nai
Configures the Network Access Identifier for the MN within the PMIP domain.
multi-path (mobile networks)
To override the global default setting and enable the home agent to process requests with multiple path support for a specific mobile router, use the multi-path command in mobile networks configuration mode. To disable this functionality, use the no form of this command.
multi-path [metric {bandwidth | hopcount}]
no multi-path [metric {bandwidth | hopcount}]
Syntax Description
Command Default
Multiple path support is disabled on the home agent.
Command Modes
Mobile networks configuration
Command History
Usage Guidelines
Multiple path support is enabled by default on the mobile router but is disabled by default on the home agent.
Examples
The following example shows how to configure the home agent to disable multiple path support for a specific mobile router:
!ip mobile mobile-networks 10.1.1.14no multi-pathRelated Commands
multi-path (mobile router)
To enable the mobile router to request multiple path support, use the multi-path command in mobile router configuration mode. To disable this functionality, use the no form of this command.
multi-path [metric {bandwidth | hopcount}]
no multi-path [metric {bandwidth | hopcount}]
Syntax Description
Command Default
Multiple path support is enabled on the mobile router.
Command Modes
Mobile router configuration.
Command History
Usage Guidelines
Multiple path support is enabled by default on the mobile router but disabled by default on the home agent.
Examples
The following example shows how to configure the mobile router to request multiple path support:
ip mobile routermulti-pathRelated Commands
