-
Cisco IOS IPv6 Command Reference
-
Introduction
-
aaa accounting multicast default through clear ipv6 mobile home-agents
-
clear ipv6 mobile traffic through debug bgp vpnv6 unicast
-
debug crypto ipv6 ipsec through debug ipv6 pim
-
debug ipv6 pim df-election through ip http server
-
ip name-server through ipv6 general-prefix
-
ipv6 hello-interval eigrp through ipv6 mld static-group
-
ipv6 mobile home-agent (global configuration) through ipv6 ospf database-filter all out
-
ipv6 ospf dead-interval through ipv6 split-horizon eigrp
-
ipv6 summary-address eigrp through mpls ldp router-id
-
mpls traffic-eng auto-bw timers through route-map
-
router-id (IPv6) through show bgp ipv6 labels
-
show bgp ipv6 neighbors through show crypto isakmp peers
-
show crypto isakmp policy through show ipv6 eigrp neighbors
-
show ipv6 eigrp topology through show ipv6 nat statistics
-
show ipv6 nat translations through show ipv6 protocols
-
show ipv6 rip through snmp-server host
-
snmp-server user through vrf forwarding
-
Table Of Contents
default-information originate (IPv6 IS-IS)
default-information originate (IPv6 OSPF)
distribute-list prefix-list (IPv6 EIGRP)
distribute-list prefix-list (IPv6 RIP)
distribute-list prefix-list (IPv6 OSPF)
enrollment terminal (ca-trustpoint)
enrollment url (ca-trustpoint)
debug ipv6 pim df-election
To display debug messages for Protocol Independent Multicast (PIM) bidirectional designated forwarder (DF) election message processing, use the debug ipv6 pim df-election command in privileged EXEC mode. To disable debug messages for PIM bidirectional DF election message processing, use the no form of this command.
debug ipv6 pim df-election [interface type number] [rp rp-name | rp-address]
no debug ipv6 pim df-election [interface type number] [rp rp-name | rp-address]
Syntax Description
Command Default
Debugging for PIM bidirectional DF election message processing is not enabled.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the debug ipv6 pim df-election command if traffic is not flowing properly when operating in PIM bidirectional mode or if the show ipv6 pim df and show ipv6 pim df winner commands do not display the expected information.
Examples
The following example shows how to enable debugging for PIM bidirectional DF election message processing on Ethernet interface 1/0 and at 200::1:
Route# debug ipv6 pim df-election interface ethernet 1/0 rp 200::1Related Commands
debug ipv6 pim limit
To enable debugging for Protocol Independent Multicast (PIM) interface limits, use the debug ipv6 pim limit command in privileged EXEC mode. To restore the default value, use the no form of this command.
debug ipv6 pim limit [group]
no debug ipv6 pim limit
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the debug ipv6 pim limit command to display debugging information for interface limits and costs. Use the optional group argument to specify a particular group to debug.
Examples
The following example enables PIM interface limit debugging:
Router# debug ipv6 pim limitRelated Commands
debug ipv6 policy
To display IPv6 policy routing packet activity, use the debug ipv6 policy command in user EXEC or privileged EXEC mode. To disable debugging output, use the no form of this command.
debug ipv6 policy [access-list-name]
no debug ipv6 policy [access-list-name]
Syntax Description
access-list-name
(Optional) Name of the IPv6 access list for which to clear the match counters. Names cannot contain a space or quotation mark, or begin with a numeric.
Command Default
IPv6 policy routing packet activity is not displayed.
Command Modes
User EXEC
Privileged EXECCommand History
12.3(7)T
This command was introduced.
12.2(30)S
This command was integrated into Cisco IOS Release 12.2(30)S.
Usage Guidelines
If no access list is specified using the optional access-list-name argument, information about all policy-matched and policy-routed packets is displayed.
After you configure IPv6 policy routing, use the debug ipv6 policy command to verify that IPv6 policy-based routing (PBR) is policy-routing packets normally. Policy routing looks at various parts of the packet and then routes the packet based on certain user-defined attributes in the packet. The debug ipv6 policy command helps you determine what policy routing is following. It displays information about whether a packet matches the criteria, and if so, the resulting routing information for the packet.
Do not use the debug ipv6 policy command unless you suspect a problem with IPv6 PBR policy routing.
Examples
The following example enables IPv6 policy routing packet activity. The output for this command is self-explanatory:
Router# debug ipv6 policy00:02:38:IPv6 PBR:Ethernet0/0, matched src 2003::90 dst 2001:1000::1 protocol 5800:02:38:IPv6 PBR:set nexthop 2003:1::95, interface Ethernet1/000:02:38:IPv6 PBR:policy route via Ethernet1/0/2003:1::95debug ipv6 pool
To enable debugging on IPv6 prefix pools, use the debug ipv6 pool command in privileged EXEC mode. To disable debugging, use the no form of this command.
debug ipv6 pool
no debug ipv6 pool
Syntax Description
This command has no keywords or arguments.
Command Default
No debugging is active.
Command Modes
Privileged EXEC
Command History
Examples
The following example enables debugging for IPv6 prefix pools:
Router# debug ipv6 pool2w4d: IPv6 Pool: Deleting route/prefix 2001:0DB8::/29 to Virtual-Access1 for cisco2w4d: IPv6 Pool: Returning cached entry 2001:0DB8::/29 for cisco on Virtual-Access1 topool12w4d: IPv6 Pool: Installed route/prefix 2001:0DB8::/29 to Virtual-Access1 for ciscoRelated Commands
debug ipv6 rip
To display debug messages for IPv6 Routing Information Protocol (RIP) routing transactions, use the debug ipv6 rip command in privileged EXEC mode. To disable debug messages for IPv6 RIP routing transactions, use the no form of this command.
debug ipv6 rip [interface-type interface-number]
no debug ipv6 rip [interface-type interface-number]
Syntax Description
interface-type
(Optional) The interface type about which to display debug messages.
interface-number
(Optional) The interface number about which to display debug messages.
Command Default
IPv6 RIP debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The debug ipv6 rip command is similar to the debug ip rip command, except that it is IPv6-specific.
Note
By default, the network server sends the output from debug commands and system error messages to the console. To redirect debug output, use the logging command options within global configuration mode. Destinations include the console, virtual terminals, internal buffer, and UNIX hosts running a syslog server. For complete information on debug commands and redirecting debug output, refer to the Cisco IOS Debug Command Reference.
Using this command without arguments enables IPv6 RIP debugging for RIP packets that are sent and received on all router interfaces. Using this command with arguments enables IPv6 RIP debugging for RIP packets that are sent and received only on the specified interface.
Caution
Examples
The following example shows output for the debug ipv6 rip command:
Router# debug ipv6 rip13:09:10:RIPng:Sending multicast update on Ethernet1/1 for as1_rip13:09:10: src=FE80::203:E4FF:FE12:CC1D13:09:10: dst=FF02::9 (Ethernet1/1)13:09:10: sport=521, dport=521, length=3213:09:10: command=2, version=1, mbz=0, #rte=113:09:10: tag=0, metric=1, prefix=::/013:09:28:RIPng:response received from FE80::202:FDFF:FE77:1E42 on Ethernet1/1 for as1_rip13:09:28: src=FE80::202:FDFF:FE77:1E42 (Ethernet1/1)13:09:28: dst=FF02::913:09:28: sport=521, dport=521, length=3213:09:28: command=2, version=1, mbz=0, #rte=113:09:28: tag=0, metric=1, prefix=2000:0:0:1:1::/80The example shows two RIP packets; both are updates, known as "responses" in RIP terminology and indicated by a "command" value of 2. The first is an update sent by this router, and the second is an update received by this router. Multicast update packets are sent to all neighboring IPv6 RIP routers (all routers that are on the same links as the router sending the update, and that have IPv6 RIP enabled). An IPv6 RIP router advertises the contents of its routing table to its neighbors by periodically sending update packets over those interfaces on which IPv6 RIP is configured. An IPv6 router may also send "triggered" updates immediately following a routing table change. In this case the updates only includes the changes to the routing table. An IPv6 RIP router may solicit the contents of the routing table of a neighboring router by sending a Request (command =1) message to the router. The router will respond by sending an update (Response, command=2) containing its routing table. In the example, the received response packet could be a periodic update from the address FE80::202:FDFF:FE77:1E42 or a response to a RIP request message that was previously sent by the local router.
Table 25 describes the significant fields shown in the display.
Related Commands
debug ipv6 routing
Displays debug messages for IPv6 routing table updates and route cache updates.
debug ipv6 routing
To display debug messages for IPv6 routing table updates and route cache updates, use the debug ipv6 routing command in privileged EXEC mode. To disable debug messages for IPv6 routing table updates and route cache updates, use the no form of this command.
debug ipv6 routing
no debug ipv6 routing
Syntax Description
This command has no arguments or keywords.
Command Default
Debugging for IPv6 routing table updates and route cache updates is not enabled.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The debug ipv6 routing command is similar to the debug ip routing command, except that it is IPv6-specific.
Note
Examples
The following example shows output for the debug ipv6 routing command:
Router# debug ipv6 routing13:18:43:IPv6RT0:Add 2000:0:0:1:1::/80 to table13:18:43:IPv6RT0:Better next-hop for 2000:0:0:1:1::/80, [120/2]13:19:09:IPv6RT0:Add 2000:0:0:2::/64 to table13:19:09:IPv6RT0:Better next-hop for 2000:0:0:2::/64, [20/1]13:19:09:IPv6RT0:Add 2000:0:0:2:1::/80 to table13:19:09:IPv6RT0:Better next-hop for 2000:0:0:2:1::/80, [20/1]13:19:09:IPv6RT0:Add 2000:0:0:4::/64 to table13:19:09:IPv6RT0:Better next-hop for 2000:0:0:4::/64, [20/1]13:19:37:IPv6RT0:Add 2000:0:0:6::/64 to table13:19:37:IPv6RT0:Better next-hop for 2000:0:0:6::/64, [20/2]The debug ipv6 routing command displays messages whenever the routing table changes. For example, the following message indicates that a route to the prefix 2000:0:0:1:1::/80 was added to the routing table at the time specified in the message.
13:18:43:IPv6RT0:Add 2000:0:0:1:1::/80 to tableThe following message indicates that the prefix 2000:0:0:2::/64 was already in the routing table; however, a received advertisement provided a lower cost path to the prefix. Therefore, the routing table was updated with the lower cost path. (The [20/1] in the example is the administrative distance [20] and metric [1] of the better path.)
13:19:09:IPv6RT0:Better next-hop for 2000:0:0:2::/64, [20/1]Related Commands
debug ipv6 static
To enable Bidirectional Forwarding Detection for IPv6 (BFDv6) debugging, use the debug ipv6 static command in privileged EXEC mode.
debug ipv6 static
Command Default
Debugging is not enabled.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the debug ipv6 static command to monitor BFDv6 operation.
Examples
The following example enables BFDv6 debugging:
Router# debug ipv6 staticRelated Commands
debug isis spf-events
To display a log of significant events during an Intermediate System-to-Intermediate System (IS-IS) shortest-path first (SPF) computation, use the debug isis spf-events command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug isis spf-events
no debug isis spf-events
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command displays information about significant events that occur during SPF-related processing.
Examples
The following example displays significant events during an IS-IS SPF computation:
Router# debug isis spf-eventsISIS-Spf: Compute L2 IPv6 SPTISIS-Spf: Move 0000.0000.1111.00-00 to PATHS, metric 0ISIS-Spf: Add 0000.0000.2222.01-00 to TENT, metric 10ISIS-Spf: Move 0000.0000.2222.01-00 to PATHS, metric 10ISIS-Spf: considering adj to 0000.0000.2222 (Ethernet3/1) metric 10, level 2, circuit 3, adj 3ISIS-Spf: (accepted)ISIS-Spf: Add 0000.0000.2222.00-00 to TENT, metric 10ISIS-Spf: Next hop 0000.0000.2222 (Ethernet3/1)ISIS-Spf: Move 0000.0000.2222.00-00 to PATHS, metric 10ISIS-Spf: Add 0000.0000.2222.02-00 to TENT, metric 20ISIS-Spf: Next hop 0000.0000.2222 (Ethernet3/1)ISIS-Spf: Move 0000.0000.2222.02-00 to PATHS, metric 20ISIS-Spf: Add 0000.0000.3333.00-00 to TENT, metric 20ISIS-Spf: Next hop 0000.0000.2222 (Ethernet3/1)debug nhrp
To enable Next Hop Resolution Protocol (NHRP) debugging, use the debug nhrp command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug nhrp {ipv4 | ipv6} [cache | extension | packet | rate]
no debug nhrp
Syntax Description
(
Command Default
NHRP debugging is not enabled.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example shows NHRP debugging output for IPv6:
Router# debug nhrp ipv6Aug 9 13:13:41.486: NHRP: Attempting to send packet via DEST- 2001:0db8:3c4d:0015:0000:0000:1a2f:3d2c/32Aug 9 13:13:41.486: NHRP: Encapsulation succeeded.Aug 9 13:13:41.486: NHRP: Tunnel NBMA addr 11.11.11.99Aug 9 13:13:41.486: NHRP: Send Registration Request via Tunnel0 vrf 0, packet size: 105Aug 9 13:13:41.486: src: 2001:0db8:3c4d:0015:0000:0000:1a2f:3d2c/32,dst: 2001:0db8:3c4d:0015:0000:0000:1a2f:3d2c/32Aug 9 13:13:41.486: NHRP: 105 bytes out Tunnel0Aug 9 13:13:41.486: NHRP: Receive Registration Reply via Tunnel0 vrf 0, packet size: 125The following example shows NHRP debugging output for IPv4:
Router# debug nhrp ipv4Aug 9 13:13:41.486: NHRP: Attempting to send packet via DEST 10.1.1.99Aug 9 13:13:41.486: NHRP: Encapsulation succeeded. Tunnel IP addr 10.11.11.99Aug 9 13:13:41.486: NHRP: Send Registration Request via Tunnel0 vrf 0, packet size: 105Aug 9 13:13:41.486: src: 10.1.1.11, dst: 10.1.1.99Aug 9 13:13:41.486: NHRP: 105 bytes out Tunnel0Aug 9 13:13:41.486: NHRP: Receive Registration Reply via Tunnel0 vrf 0, packet size: 125Aug 9 13:13:41.486: NHRP: netid_in = 0, to_us = 1Related Commands
debug dmvpn
Displays DMVPN session debugging information.
debug nhrp error
Displays NHRP error level debugging information.
debug nhrp condition
To enable Next Hop Resolution Protocol (NHRP) conditional debugging, use the debug nhrp condition command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug nhrp condition [peer [nbma | tunnel | ip-address | ipv6-address]] | [interface tunnel number] | [vrf vrf-name]
no debug nhrp condition [peer {nbma | tunnel} ip-address | ipv6-address] | [interface tunnel number] | [vrf vrf-name]
Syntax Description
Command Default
Conditional NHRP debugging is not enabled.
Command Modes
Privileged EXEC (#)
Command History
12.4(9)T
This command was introduced.
12.4(20)T
The ipv6-address argument was added.
Examples
The following example shows how to enable conditional NHRP debugging for a specific tunnel:
Router# debug nhrp condition peer tunnel 192.0.2.1Related Commands
debug dmvpn
Displays DMVPN session debugging information.
debug nhrp error
Displays NHRP error level debugging information.
debug nhrp error
To display Next Hop Resolution Protocol (NHRP) error level debugging information, use the debug nhrp error command in privileged EXEC mode. To disable debugging output, use the no form of this command.
debug nhrp {ipv4 | ipv6} error
no debug nhrp {ipv4 | ipv6} error
Syntax Description
Command Default
Error level NHRP debugging is not enabled.
Command Modes
Privileged EXEC (#)
Command History
12.4(9)T
This command was introduced.
12.4(20)T
The ipv4 and ipv6 keywords were added.
Examples
The following example shows how to enable error level debugging for IPv4 NHRP:
Router# debug nhrp ipv4 errorNHRP errors debugging is onRelated Commands
debug dmvpn
Displays DMVPN session debugging information.
debug nhrp condition
Enables NHRP conditional debugging.
debug ntp
To display debugging messages for Network Time Protocol (NTP) features, use the debug ntp command in prvileged EXEC mode. To disable debugging output, use the no form of this command.
debug ntp {adjust | all | authentication | core | events | loopfilter | packet | params | refclock | select | sync | validity}
no debug ntp {adjust | all | authentication | core | events | loopfilter | packet | params | refclock | select | sync | validity}
Syntax Description
Command Default
Debugging is not enabled.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Starting from Cisco IOS Release 12.4(20)T, NTP version 4 is supported. In NTP version 4 the debugging options available are adjust, all, core, events, packet, and refclock. In NTP version 3 the debugging options available were events, authentication, loopfilter, packets, params, select, sync and validity.
Examples
The following example shows how to enable all debugging options for NTP:
Router# debug ntp allNTP events debugging is onNTP core messages debugging is onNTP clock adjustments debugging is onNTP reference clocks debugging is onNTP packets debugging is onRelated Commands
default (IPv6 OSPF)
To return a parameter to its default value, use the default command in router configuration mode.
default [area | auto-cost | default-information | default-metric | discard-route | distance | distribute-list | ignore | log-adjacency-changes | maximum-paths | passive-interface | redistribute | router-id | summary-prefix | timers]
Syntax Description
Command Default
This command is disabled by default.
Command Modes
Router configuration
Command History
12.2(15)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
The command is removed if it is disabled by default.
Examples
In the following example, OSPF for IPv6 area parameters are reset to the default values:
default timers spfdefault-information originate (IPv6 IS-IS)
To inject an IPv6 default route into an Intermediate System-to-Intermediate System (IS-IS) IPv6 routing domain, use the default-information originate command in address family configuration mode. To disable this feature, use the no form of this command.
default-information originate [route-map map-name]
no default-information originate [route-map map-name]
Syntax Description
route-map map-name
(Optional) Route map should be used to advertise the default route conditionally.
The map-name argument identifies a configured route map.
Command Default
This feature is disabled.
Command Modes
Address family configuration
Command History
Usage Guidelines
The default-information originate (IPv6 IS-IS) command is similar to the default-information originate (IS-IS) command, except that it is IPv6-specific.
If a router configured with this command has an IPv6 route to ::/0 in the routing table, IS-IS will originate an advertisement for ::/0 in its link-state packets (LSPs).
Without a route map, the default is advertised only in Level 2 LSPs. For Level 1 routing, there is another mechanism to find the default route, which is for the router to look for the closest Level 1 or Level 2 router. The closest Level 1 or Level 2 router can be found by looking at the attached bit (ATT) in Level 1 LSPs.
A route map can be used for two purposes:
•
•
With a match ipv6 address standard-access-list command, you can specify one or more IPv6 routes that must exist before the router will advertise ::/0.
Examples
The following example shows the IPv6 default route (::/0) being advertised with all other routes in router updates:
Router(config)# router isis area01Router(config-router)# address-family ipv6Router(config-router-af)# default-information originateRelated Commands
default-information originate (IPv6 OSPF)
To generate a default external route into an Open Shortest Path First (OSPF) for IPv6 routing domain, use the default-information originate command in router configuration mode. To disable this feature, use the no form of this command.
default-information originate [always] metric metric-value [metric-type type-value] [route-map map-name]
no default-information originate [always] metric metric-value [metric-type type-value] [route-map map-name]
Syntax Description
Command Default
This command is disabled by default.
Command Modes
Router configuration
Command History
12.2(15)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Whenever you use the redistribute or the default-information router configuration command to redistribute routes into an OSPF for IPv6 routing domain, the Cisco IOS software automatically becomes an Autonomous System Boundary Router (ASBR). However, an ASBR does not, by default, generate a default route into the OSPF for IPv6 routing domain. The software still must have a default route for itself before it generates one, except when you have specified the always keyword.
When you use this command for the OSPF for IPv6 process, the default network must reside in the routing table, and you must satisfy the route-map map-name keyword and argument. Use the default-information originate always route-map map-name form of the command when you do not want the dependency on the default network in the routing table.
Examples
The following example specifies a metric of 100 for the default route redistributed into the OSPF for IPv6 routing domain, an external metric type of type 2, and the default route to be always advertised:
default-information originate always metric 100 metric-type 2Related Commands
redistribute (IPv6)
Redistributes IPv6 routes from one routing domain into another routing domain.
default-metric (EIGRP)
To set metrics for Enhanced Interior Gateway Routing Protocol (EIGRP), use the default-metric command in router configuration mode or address-family topology configuration mode. To remove the metric value and restore the default state, use the no form of this command.
default-metric bandwidth delay reliability loading mtu
no default-metric bandwidth delay reliability loading mtu
Syntax Description
Command Default
Only connected routes can be redistributed without a default metric. The metric of redistributed connected routes is set to 0.
Command Modes
Router configuration (config-router)
Address-family topology configuration (config-router-af-topology)Command History
Usage Guidelines
You must use a default metric to redistribute a protocol into EIGRP, unless you use the redistribute command.
Metric defaults have been carefully set to work for a wide variety of networks. Take great care when changing these values.
Default metrics are supported only when you are redistributing from EIGRP or static routes.
Examples
The following example shows how the redistributed Routing Information Protocol (RIP) metrics are translated into EIGRP metrics with values as follows: bandwidth = 1000, delay = 100, reliability = 250, loading = 100, and MTU = 1500:
Router(config)# router eigrp 109Router(config-router)# network 172.16.0.0Router(config-router)# redistribute ripRouter(config-router)# default-metric 1000 100 250 100 1500The following example shows how the redistributed EIGRP service family 6473 metrics are translated into EIGRP metric with values as follows: bandwidth = 1000, delay = 100, reliability = 250, loading = 100, and MTU = 1500.
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# af-interface defaultRouter(config-router-af-interface)# no shutdownRouter(config-router-af-interface)# exitRouter(config-router-af)# topology baseRouter(config-router-af-topology)# redistribute eigrp virtual-name2 6473Router(config-router-af-topology)# default-metric 1000 100 250 100 1500Related Commands
default-metric (IPv6)
To set default metric values for routes redistributed into the Open Shortest Path First (OSPF) for IPv6 routing protocol, use the default-metric command in router configuration mode. To return to the default state, use the no form of this command.
default-metric metric-value
no default-metric metric-value
Syntax Description
metric-value
Default metric value appropriate for the specified routing protocol. The range is from 1 to 4294967295.
Command Default
Built-in, automatic metric translations, as appropriate for each routing protocol.
Command Modes
Router configuration
Command History
12.2(15)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
The default-metric command is used in conjunction with the redistribute router configuration command to cause the current routing protocol to use the same metric value for all redistributed routes. A default metric helps solve the problem of redistributing routes with incompatible metrics. Whenever metrics do not convert, using a default metric provides a reasonable substitute and enables the redistribution to proceed.
Finer control over the metrics of reditributed routes can be gained by using the options to the redistribute command, including route maps.
Examples
The following example shows an OSPF for IPv6 routing protocol redistributing routes from the Routing Information Protocol (RIP) process named process1. All the redistributed routes are advertised with a metric of 10.
ipv6 router ospf 100default-metric 10redistribute rip process1Related Commands
redistribute (IPv6)
Redistributes IPv6 routes from one routing domain into another routing domain.
deny (IPv6)
To set deny conditions for an IPv6 access list, use the deny command in IPv6 access list configuration mode. To remove the deny conditions, use the no form of this command.
deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [doh-number | doh-type]] [dscp value] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]
no deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [doh-number | doh-type]] [dscp value] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]
Internet Control Message Protocol
deny icmp {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [icmp-type [icmp-code] | icmp-message] [dest-option-type [doh-number | doh-type]] [dscp value] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name]
Transmission Control Protocol
deny tcp {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [ack] [dest-option-type [doh-number | doh-type]] [dscp value] [established] [fin] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [neq {port | protocol}] [psh] [range {port | protocol}] [routing] [routing-type routing-number] [rst] [sequence value] [syn] [time-range name] [urg]
User Datagram Protocol
deny udp {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [doh-number | doh-type]] [dscp value] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [neq {port | protocol}] [range {port | protocol}] [routing] [routing-type routing-number] [sequence value] [time-range name]
Syntax Description
Command Default
No IPv6 access list is defined.
Command Modes
IPv6 access list configuration
Command History
Usage Guidelines
The deny (IPv6) command is similar to the deny (IP) command, except that it is IPv6-specific.
Use the deny (IPv6) command following the ipv6 access-list command to define the conditions under which a packet passes the access list or to define the access list as a reflexive access list.
Specifying IPv6 for the protocol argument matches against the IPv6 header of the packet.
By 1default, the first statement in an access list is number 10, and the subsequent statements are numbered in increments of 10.
You can add permit, deny, remark, or evaluate statements to an existing access list without retyping the entire list. To add a new statement anywhere other than at the end of the list, create a new statement with an appropriate entry number that falls between two existing entry numbers to indicate where it belongs.
In Cisco IOS Release 12.2(2)T or later releases, 12.0(21)ST, and 12.0(22)S, IPv6 access control lists (ACLs) are defined and their deny and permit conditions are set by using the ipv6 access-list command with the deny and permit keywords in global configuration mode. In Cisco IOS Release 12.0(23)S or later releases, IPv6 ACLs are defined by using the ipv6 access-list command in global configuration mode and their permit and deny conditions are set by using the deny and permit commands in IPv6 access list configuration mode. Refer to the ipv6 access-list command for more information on defining IPv6 ACLs.
Note
The IPv6 neighbor discovery process makes use of the IPv6 network layer service; therefore, by default, IPv6 ACLs implicitly allow IPv6 neighbor discovery packets to be sent and received on an interface. In IPv4, the Address Resolution Protocol (ARP), which is equivalent to the IPv6 neighbor discovery process, makes use of a separate data link layer protocol; therefore, by default, IPv4 ACLs implicitly allow ARP packets to be sent and received on an interface.Both the source-ipv6-prefix/prefix-length and destination-ipv6-prefix/prefix-length arguments are used for traffic filtering (the source prefix filters traffic based upon the traffic source; the destination prefix filters traffic based upon the traffic destination).
Note
The fragments keyword is an option only if the operator [port-number] arguments are not specified.
The undetermined-transport keyword is an option only if the operator [port-number] arguments are not specified.
The following is a list of ICMP message names:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example configures the IPv6 access list named toCISCO and applies the access list to outbound traffic on Ethernet interface 0. Specifically, the first deny entry in the list keeps all packets that have a destination TCP port number greater than 5000 from exiting out of Ethernet interface 0. The second deny entry in the list keeps all packets that have a source UDP port number less than 5000 from exiting out of Ethernet interface 0. The second deny also logs all matches to the console. The first permit entry in the list permits all ICMP packets to exit out of Ethernet interface 0. The second permit entry in the list permits all other traffic to exit out of Ethernet interface 0. The second permit entry is necessary because an implicit deny all condition is at the end of each IPv6 access list.
ipv6 access-list toCISCOdeny tcp any any gt 5000deny ::/0 lt 5000 ::/0 logpermit icmp any anypermit any anyinterface ethernet 0ipv6 traffic-filter toCISCO outThe following example shows how to allow TCP or UDP parsing although an IPsec AH is present:
IPv6 access list example1deny tcp host 2001::1 any log sequence 5permit tcp any any auth sequence 10permit udp any any auth sequence 20Related Commands
destination-pattern
To specify either the prefix or the full E.164 telephone number to be used for a dial peer, use the destination-pattern command in dial peer configuration mode. To disable the configured prefix or telephone number, use the no form of this command.
destination-pattern [+]string[T]
no destination-pattern [+]string[T]
Syntax Description
Command Default
The command is enabled with a null string.
Command Modes
Dial peer configuration
Command History
Usage Guidelines
Use the destination-pattern command to define the E.164 telephone number for a dial peer.
The pattern you configure is used to match dialed digits to a dial peer. The dial peer is then used to complete the call. When a router receives voice data, it compares the called number (the full E.164 telephone number) in the packet header with the number configured as the destination pattern for the voice-telephony peer. The router then strips out the left-justified numbers that correspond to the destination pattern. If you have configured a prefix, the prefix is prepended to the remaining numbers, creating a dial string that the router then dials. If all numbers in the destination pattern are stripped out, the user receives a dial tone.
There are areas in the world (for example, certain European countries) where valid telephone numbers can vary in length. Use the optional control character T to indicate that a particular destination-pattern value is a variable-length dial string. In this case, the system does not match the dialed numbers until the interdigit timeout value has expired.
Note
Examples
The following example shows configuration of the E.164 telephone number 555-0179 for a dial peer:
dial-peer voice 10 potsdestination-pattern +5550179The following example shows configuration of a destination pattern in which the pattern "43" is repeated multiple times preceding the digits "555":
dial-peer voice 1 voipdestination-pattern 555(43)+The following example shows configuration of a destination pattern in which the preceding digit pattern is repeated multiple times:
dial-peer voice 2 voipdestination-pattern 555%The following example shows configuration of a destination pattern in which the possible numeric values are between 5550109 and 5550199:
dial-peer voice 3 vofrdestination-pattern 55501[0-9]9The following example shows configuration of a destination pattern in which the possible numeric values are between 5550439, 5553439, 5555439, 5557439, and 5559439:
dial-peer voice 4 voatmdestination-pattern 555[03579]439The following example shows configuration of a destination pattern in which the digit-by-digit matching is prevented and the entire string is received:
dial-peer voice 2 voipdestination-pattern 555TRelated Commands
dialer-group
To control access by configuring an interface to belong to a specific dialing group, use the dialer-group command in interface configuration mode. To remove an interface from the specified dialer access group, use the no form of this command.
dialer-group group-number
no dialer-group
Syntax Description
Defaults
No access is predefined.
Command Modes
Interface configuration
Command History
10.0
This command was introduced.
12.2(13)T
Support for IPv6 was added.
Cisco IOS XE Release 2.5
This command was updated. It was integrated into Cisco IOS XE Release 2.5.
Usage Guidelines
An interface can be associated with a single dialer access group only; multiple dialer-group assignment is not allowed. A second dialer access group assignment will override the first. A dialer access group is defined with the dialer-group command. The dialer-list command associates an access list with a dialer access group.
Packets that match the dialer group specified trigger a connection request.
Examples
The following example specifies dialer access group number 1.
The destination address of the packet is evaluated against the access list specified in the associated dialer-list command. If it passes, either a call is initiated (if no connection has already been established) or the idle timer is reset (if a call is currently connected).
interface async 1dialer-group 1access-list 101 deny igrp 0.0.0.0 255.255.255.255 255.255.255.255 0.0.0.0access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255dialer-list 1 protocol ip list 101Related Commands
dialer-list protocol (Dial)
Defines a DDR dialer list to control dialing by protocol or by a combination of protocol and an access list.
dialer-list protocol
To define a dial-on-demand routing (DDR) dialer list for dialing by protocol or by a combination of a protocol and a previously defined access list, use the dialer-list protocol command in global configuration mode. To delete a dialer list, use the no form of this command.
dialer-list dialer-group protocol protocol-name {permit | deny | list access-list-number | access-group}
no dialer-list dialer-group [protocol protocol-name [list access-list-number | access-group]]
Syntax Description
dialer-group
Number of a dialer access group identified in any dialer-group interface configuration command.
protocol-name
One of the following protocol keywords: appletalk, bridge, clns, clns_es, clns_is, decnet, decnet_router-L1, decnet_router-L2, decnet_node, ip, ipx, ipv6, vines, or xns.
permit
Permits access to an entire protocol.
deny
Denies access to an entire protocol.
list
Specifies that an access list will be used for defining a granularity finer than an entire protocol.
access-list-number
Access list numbers specified in any DECnet, Banyan VINES, IP, Novell IPX, or XNS standard or extended access lists, including Novell IPX extended service access point (SAP) access lists and bridging types, and IPv6 access lists. See Table 26 for the supported access list types and numbers.
access-group
Filter list name used in the clns filter-set and clns access-group commands.
Command Default
No dialer lists are defined.
Command Modes
Global configuration
Command History
Usage Guidelines
The various no forms of this command have the following effects:
•
•
•
The dialer-list protocol command permits or denies access to an entire protocol. The dialer-list protocol list command provides a finer permission granularity and also supports protocols that were not previously supported.
The dialer-list protocol list command applies protocol access lists to dialer access groups to control dialing using DDR. The dialer access groups are defined with the dialer-group command.
Table 26 lists the access list types and number range that the dialer-list protocol list command supports. The table does not include International Organization for Standardization (ISO) Connectionless Network Services (CLNS) or IPv6 because those protocols use filter names instead of predefined access list numbers.
Examples
Dialing occurs when an interesting packet (one that matches access list specifications) needs to be output on an interface. Using the standard access list method, packets can be classified as interesting or uninteresting. In the following example, Integrated Gateway Routing Protocol (IGRP) TCP/IP routing protocol updates are not classified as interesting and do not initiate calls:
access-list 101 deny igrp 0.0.0.0 255.255.255.255 255.255.255.255 0.0.0.0The following example classifies all other IP packets as interesting and permits them to initiate calls:
access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255Then the following command places list 101 into dialer access group 1:
dialer-list 1 protocol ip list 101In the following example, DECnet access lists allow any DECnet packets with source area 10 and destination area 20 to trigger calls:
access-list 301 permit 10.0 0.1023 10.0 0.1023access-list 301 permit 10.0 0.1023 20.0 0.1023Then the following command places access list 301 into dialer access group 1:
dialer-list 1 protocol decnet list 301In the following example, both IP and VINES access lists are defined. The IP access lists define IGRP packets as uninteresting, but permits all other IP packets to trigger calls. The VINES access lists do not allow Routing Table Protocol (RTP) routing updates to trigger calls, but allow any other data packets to trigger calls.
access-list 101 deny igrp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255access-list 101 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255!vines access-list 107 deny RTP 00000000:0000 FFFFFFFF:FFFF 00000000:0000 FFFFFFFF:FFFFvines access-list 107 permit IP 00000000:0000 FFFFFFFF:FFFF 00000000:0000 FFFFFFFF:FFFFThen the following two commands place the IP and VINES access lists into dialer access group 1:
dialer-list 1 protocol ip list 101dialer-list 1 protocol vines list 107In the following example, a CLNS filter is defined and then the filter is placed in dialer access group 1:
clns filter-set ddrline permit 47.0004.0001....!dialer-list 1 protocol clns list ddrlineThe following example configures an IPv6 access list named list2 and places the access list in dialer access group 1:
ipv6 access-list list2 deny fec0:0:0:2::/64 anyipv6 access-list list2 permit any any!dialer-list 1 protocol ipv6 list list2Related Commands
dial-peer voice
To define a particular dial peer, to specify the method of voice encapsulation, and to enter dial peer configuration mode, use the dial-peer voice command in global configuration mode. To delete a defined dial peer, use the no form of this command.
Cisco 1750 and Cisco 1751 Modular Access Routers
dial-peer voice tag {pots | vofr | voip}
no dial-peer voice tag {pots | vofr | voip}
Cisco 2600 Series, Cisco 2600XM, Cisco 3600 Series, and Cisco 3700 Series
dial-peer voice tag {pots | voatm | vofr | voip}
no dial-peer voice tag {pots | voatm | vofr | voip}
Cisco 7200 Series
dial-peer voice tag vofr
no dial-peer voice tag vofr
Cisco 7204VXR and Cisco 7206VXR
dial-peer voice tag {pots | voatm | vofr | voip}
no dial-peer voice tag {pots | voatm | vofr | voip}
Cisco AS5300
dial-peer voice tag {mmoip | pots | vofr | voip}
no dial-peer voice tag {mmoip | pots | vofr | voip}
Syntax Description
Command Default
No dial peer is defined.
No method of voice encapsulation is specified.Command Modes
Global configuration
Command History
Usage Guidelines
Use the dial-peer voice global configuration command to switch to dial peer configuration mode from global configuration mode and to define a particular dial peer. Use the exit command to exit dial peer configuration mode and return to global configuration mode.
After you have created a dial peer, that dial peer remains defined and active until you delete it. To delete a dial peer, use the no form of this command. To disable a dial peer, use the no shutdown command in dial peer configuration mode.
In store-and-forward fax on the Cisco AS5300, the POTS dial peer defines the inbound faxing line characteristics from the sending fax device to the receiving Cisco AS5300 and the outbound line characteristics from the sending Cisco AS5300 to the receiving fax device. The Multimedia Mail over Internet Protocol (MMoIP) dial peer defines the inbound faxing line characteristics from the Cisco AS5300 to the receiving Simple Mail Transfer Protocol (SMTP) mail server. This command works with both on-ramp and off-ramp store-and-forward fax functions.
Note
Examples
The following example shows how to access dial peer configuration mode and configure a POTS peer identified as dial peer 10 and an MMoIP dial peer identified as dial peer 20:
dial-peer voice 10 potsdial-peer voice 20 mmoipThe following example deletes the MMoIP peer identified as dial peer 20:
no dial-peer voice 20 mmoipThe following example shows how the dial-peer voice command is used to configure the extended echo canceller. In this instance, pots indicates that this is a POTS peer using VoIP encapsulation on the IP backbone, and it uses the unique numeric identifier tag 133001.
Router(config)# dial-peer voice 133001 potsRelated Commands
discard-route (IPv6)
To reinstall either an external or internal discard route that was previously removed, use the discard-route command in router configuration mode. To remove either an external or internal discard route, use the no form of this command.
discard-route [external | internal]
no discard-route [external | internal]
Syntax Description
Command Default
External and internal discard route entries are installed.
Command Modes
Router configuration
Command History
12.2(15)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
External and internal discard route entries are installed in routing tables by default. During route summarization, routing loops may occur when data is sent to a nonexisting network that appears to be a part of the summary, and the router performing the summarization has a less specific route (pointing back to the sending router) for this network in its routing table. To prevent the routing loop, a discard route entry is installed in the routing table of the ABR or ASBR.
If for any reason you do not want to use the external or internal discard route, remove the discard route by entering the no discard-route command with either the external or internal keyword.
Examples
The following display shows the discard route functionality installed by default. When external or internal routes are summarized, a summary route to Null0 will appear in the router output from the show ipv6 route command. See the router output lines that appear in bold font:
Router# show ipv6 routeIPv6 Routing Table - 7 entriesCodes:C - Connected, L - Local, S - Static, R - RIP, B - BGPU - Per-user Static routeI1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summaryO - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2O 2001::/32 [110/0]via ::, Null0C 2001:0:11::/64 [0/0]via ::, Ethernet0/0L 2001:0:11:0:A8BB:CCFF:FE00:6600/128 [0/0]via ::, Ethernet0/0C 2001:1:1::/64 [0/0]via ::, Ethernet1/0L 2001:1:1:0:A8BB:CCFF:FE00:6601/128 [0/0]via ::, Ethernet1/0L FE80::/10 [0/0]via ::, Null0L FF00::/8 [0/0]via ::, Null0Router# show ipv6 route ospfIPv6 Routing Table - 7 entriesCodes:C - Connected, L - Local, S - Static, R - RIP, B - BGPU - Per-user Static routeI1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summaryO - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2O 2001::/32 [110/0]via ::, Null0When the no discard-route command with the internal keyword is entered, notice the following route change, indicated by the router output lines that appear in bold font:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ipv6 router ospf 1Router(config-router)# no discard-route internalRouter(config-router)# endRouter# show ipv6 route ospfIPv6 Routing Table - 6 entriesCodes:C - Connected, L - Local, S - Static, R - RIP, B - BGPU - Per-user Static routeI1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summaryO - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2Next, the no discard-route command with the external keyword is entered to remove the external discard route entry:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config-router)# no discard-route externalRouter(config-router)# endThe following router output from the show running-config command confirms that both the external and internal discard routes have been removed from the routing table. See the router output lines that appear in bold font:
Router# show running-configBuilding configuration...Current configuration :2490 bytes!version 12.3service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname Router!boot-start-markerboot-end-marker!logging snmp-authfaillogging buffered 20480 debugginglogging console warnings!clock timezone PST -8clock summer-time PDT recurringno aaa new-modelip subnet-zerono ip domain lookup!!ip audit po max-events 100ipv6 unicast-routingno ftp-server write-enable!...interface Ethernet0/0no ip addressipv6 address 2001:0:11::/64 eui-64ipv6 enableipv6 ospf 1 area 0no cdp enable!interface Ethernet1/0no ip addressipv6 address 2001:1:1::/64 eui-64ipv6 enableipv6 ospf 1 area 1no cdp enable...ipv6 router ospf 1router-id 2.0.0.1log-adjacency-changesno discard-route externalno discard-route internalarea 0 range 2001::/32redistribute rip 1!Related Commands
distance (IPv6 EIGRP)
To allow the use of two administrative distances—internal and external—that could be a better route to a node, use the distance command in router configuration mode. To reset these values to their defaults, use the no form of this command.
distance internal-distance external-distance
no distance
Syntax Description
Command Default
internal-distance: 90
external-distance: 170Command Modes
Router configuration
Command History
Usage Guidelines
An administrative distance is a rating of the trustworthiness of a routing information source, such as an individual router or a group of routers. Numerically, an administrative distance is an integer from 0 to 255. In general, the higher the value, the lower the trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored.
Use the distance command if another protocol is known to be able to provide a better route to a node than was actually learned via external EIGRP for IPv6, or if some internal routes should be preferred by EIGRP for IPv6.
Table 27 lists the default administrative distances.
Examples
The following example sets the internal distance to 95 and the external distance to 165:
distance 95 165distance (IPv6 Mobile)
To define an administrative distance for network mobility (NEMO) routes, use the distance command in router configuration mode. To return the administrative distance to its default distance definition, use the no form of this command.
distance [mobile-distance]
no distance
Syntax Description
mobile-distance
(Optional) Defines the mobile route, which is the default route for IPv6 over the roaming interface. The mobile default distance is 3.
Command Default
If no distances are configured, the default distances are automatically used.
Command Modes
Router configuration (config-router)
Command History
Usage Guidelines
The Mobile IPv6 NEMO router maintains the following type of route:
•
An administrative distance is a rating of the trustworthiness of a routing information source, such as an individual router or a group of routers. Numerically, an administrative distance is an integer from 0 to 255. In general, the higher the value, the lower the trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored.
Examples
The following example defines the administrative distance for the mobile route as 10:
Router(config-router)# distance 10Related Commands
ipv6 router nemo
Enables the NEMO routing process on the home agent and places the router in router configuration mode.
distance (IPv6)
To configure an administrative distance for Intermediate System-to-Intermediate System (IS-IS), Routing Information Protocol (RIP), or Open Shortest Path First (OSPF) IPv6 routes inserted into the IPv6 routing table, use the distance command in address family configuration or router configuration mode. To return the administrative distance to its default setting, use the no form of this command.
distance [ospf {external | inter-area | intra-area}] distance
no distance [ospf {external | inter-area | intra-area}] distance
Syntax Description
Command Default
IS-IS: 115
RIP: 120
OSPF for IPv6: 110Command Modes
Address family configuration
Router configurationCommand History
Usage Guidelines
The distance (IPv6) command is similar to the distance (IP) command, except that it is IPv6-specific.
If two processes attempt to insert the same route into the same routing table, the one with the lower administrative distance takes precedence.
An administrative distance is an integer from 10 to 254. In general, the higher the value, the lower the trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored. Distance values are subjective; there is no quantitative method for choosing the values.
Examples
The following example configures an administrative distance of 190 for the IPv6 IS-IS routing process named area01:
Router(config)# router isis area01Router(config-router)# address-family ipv6Router(config-router-af)# distance 190The following example configures an administrative distance of 200 for the IPv6 RIP routing process named cisco:
Router(config)# ipv6 router rip ciscoRouter(config-router)# distance 200The following example configures an administrative distance of 200 for external type 5 and type 7 routes for OSPF for IPv6:
Router(config)# ipv6 router ospfRouter(config-router)# distance ospf external 200distance bgp (IPv6)
To allow the use of external, internal, and local administrative distances that could be a better route than other external, internal, or local routes to a node, use the distance bgp command in address family configuration mode. To return to the default values, use the no form of this command
distance bgp external-distance internal-distance local-distance
no distance bgp
Syntax Description
Command Default
external-distance: 20
internal-distance: 200
local-distance: 200Command Modes
Address family configuration
Command History
Usage Guidelines
The distance bgp (IPv6) command is similar to the distance bgp command, except that it is IPv6-specific. Settings configured by the distance bgp (IPv6) command will override the default IPv6 distance settings. IPv6 BGP is not influenced by the distance settings configured in IPv4 BGP router mode.
An administrative distance is a rating of the trustworthiness of a routing information source, such as an individual router or a group of routers. Numerically, an administrative distance is a positive integer from 1 to 255. In general, the higher the value, the lower the trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored. Distance values are subjective; there is no quantitative method for choosing the values.
Use this command if another protocol is known to be able to provide a better route to a node than was actually learned via external BGP (eBGP), or if some internal routes should be preferred by BGP.
For IPv6 multicast BGP (MBGP) distance, the distance assigned is used in reverse path forwarding (RPF) lookup. Use the show ipv6 rpf command to display the distance assigned.
Caution
Examples
In the following address family configuration mode example, internal routes are known to be preferable to those learned through Interior Gateway Protocol (IGP), so the IPv6 BGP administrative distance values are set accordingly:
router bgp 65001neighbor 2001:0DB8::1 remote-as 65002address-family ipv6distance bgp 20 20 200neighbor 2001:0DB8::1 activateexit-address-familyRelated Commands
show ipv6 rpf
Displays RPF information for a given unicast host address and prefix.
distribute-list prefix-list (IPv6 EIGRP)
To apply a prefix list to Enhanced Interior Gateway Routing Protocol (EIGRP) for IPv6 routing updates that are received or sent on an interface, use the distribute-list prefix-list command in router configuration mode. To remove the prefix list, use the no form of this command.
distribute-list prefix-list list-name
no distribute-list prefix-list list-name
Syntax Description
Command Default
Prefix lists are not applied to EIGRP for IPv6 routing updates.
Command Modes
Router configuration
Command History
Usage Guidelines
The prefix list is applied to routing updates received or sent on all interfaces.
Examples
The following example applies prefix list list1 to routes received and sent on all interfaces:
Router(config)# ipv6 router eigrp 1Router(config-router)# distribute-list prefix-list list1Related Commands
ipv6 prefix-list
Creates an entry in an IPv6 prefix list.
show ipv6 prefix-list
Displays information about an IPv6 prefix list or prefix list entries.
distribute-list prefix-list (IPv6 RIP)
To apply a prefix list to IPv6 Routing Information Protocol (RIP) routing updates that are received or sent on an interface, use the distribute-list prefix-list command in router configuration mode. To remove the prefix list, use the no form of this command.
distribute-list prefix-list listname {in | out} [interface-type interface-number]
no distribute-list prefix-list listname
Syntax Description
Command Default
Prefix lists are not applied to IPv6 RIP routing updates.
Command Modes
Router configuration
Command History
Usage Guidelines
If no interface is specified, the prefix list is applied to all interfaces.
Examples
The following example applies the prefix list named cisco to IPv6 RIP routing updates that are received on Ethernet interface 0/0:
Router(config)# ipv6 router rip ciscoRouter(config-rtr-rip)# distribute-list prefix-list cisco in ethernet 0/0Related Commands
ipv6 prefix-list
Creates an entry in an IPv6 prefix list.
show ipv6 prefix-list
Displays information about an IPv6 prefix list or prefix list entries.
distribute-list prefix-list (IPv6 OSPF)
To apply a prefix list to Open Shortest Path First (OSPF) for IPv6 routing updates that are received or sent on an interface, use the distribute-list prefix-list command in router configuration mode. To remove the prefix list, use the no form of this command.
distribute-list prefix-list list-name {in [interface-type interface-number] | out routing-process [as-number]}
no distribute-list prefix-list list-name {in [interface-type interface-number] | out routing-process [as-number]}
Syntax Description
Command Default
Prefix lists are not applied to OSPF for IPv6 routing updates.
Command Modes
Router configuration
Command History
Usage Guidelines
If no interface is specified when using the in keyword, the prefix list is applied to routing updates received on all interfaces.
Examples
The following example applies prefix list PL1 to routes received on Ethernet interface 0/0, and applies prefix list PL2 to advertised routes that came from process bgp 65.
Router(config)# ipv6 router ospf 1Router(config-router)# distribute-list prefix-list PL1 in Ethernet0/0Router(config-router)# distribute-list prefix-list PL2 ospf out bgp 65Related Commands
ipv6 prefix-list
Creates an entry in an IPv6 prefix list.
show ipv6 prefix-list
Displays information about an IPv6 prefix list or prefix list entries.
dns-server (IPv6)
To specify the Domain Name System (DNS) IPv6 servers available to a Dynamic Host Configuration Protocol (DHCP) for IPv6 client, use the dns-server command in DHCP for IPv6 pool configuration mode. To remove the DNS server list, use the no form of this command.
dns-server ipv6-address
no dns-server ipv6-address
Syntax Description
ipv6-address
The IPv6 address of a DNS server.
This argument must be in the form documented in RFC 2373 where the address is specified in hexadecimal using 16-bit values between colons.
Command Default
When a DHCP for IPv6 pool is first created, no DNS IPv6 servers are configured.
Command Modes
DHCP for IPv6 pool configuration
Command History
Usage Guidelines
Multiple Domain Name System (DNS) server addresses can be configured by issuing this command multiple times. New addresses will not overwrite old addresses.
Examples
The following example specifies the DNS IPv6 servers available:
dns-server 2001:0DB8:3000:3000::42Related Commands
domain-name (IPv6)
To configure a domain name for a Dynamic Host Configuration Protocol for IPv6 (DHCPv6) client, use the domain-name command in DHCPv6 pool configuration mode. To return to the default for this command, use the no form of this command.
domain-name domain-name
no domain-name
Syntax Description
domain-name
Default domain name used to complete unqualified hostnames.
Note
Command Default
No default domain name is defined for the DNS view.
Command Modes
DHCPv6 pool configuration mode (config-dhcp)
Command History
Usage Guidelines
Use the domain-name command in IPv6 configure a domain name for a DHCPv6 client.
Examples
The following example configures a domain name for a DHCPv6 client:
Router(config)# ipv6 dhcp pool pool1Router(cfg-dns-view)# domain-name domainv6dspfarm profile
To enter DSP farm profile configuration mode and define a profile for digital signal processor (DSP) farm services, use the dspfarm profile command in global configuration mode. To delete a disabled profile, use the no form of this command.
dspfarm profile profile-identifier {conference | mtp | transcode} [security]
no dspfarm profile profile-identifier
Syntax Description
Command Default
No default behavior or values
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use this command to create a new profile or delete a disabled profile. After you create a new profile in dspfarm profile configuration mode, use the no shutdown command to enable the profile configuration, allocate resources and associate the profile with the application(s). If the profile cannot be enabled due to lack of resources, the system prompts you with a message "Can not enable the profile due to insufficient resources, resources available to support X sessions; please modify the configuration and retry."
If the DSP farm profile is successfully created, you enter the DSP farm profile configuration mode. You can configure multiple profiles for the same service.
Use the no dspfarm profile command to delete a profile from the system. If the profile is active, you cannot delete it; you must first disable it using the shutdown command. To modify a DSP farm profile, use the shutdown command in dspfarm profile configuration mode before you begin configuration.
The profile identifier uniquely identifies a profile. If the service type and profile identifier are not unique, the user is prompted with a message to choose a different profile identifier.
You must use the security keyword in order to enable secure DSP farm services such as secure transcoding.
Examples
The following example enables DSP farm services profile 20 for conferencing:
Router(config)# dspfarm profile 20 conferenceNote the response if the profile is already being used:
Router(config)# dspfarm profile 6 conferenceProfile id 6 is being used for service TRANSCODINGplease select a different profile idRelated Commands
eigrp event-log-size
To set the size of the Enhanced Interior Gateway Routing Protocol (EIGRP) event log, use the eigrp event-log-size command in router configuration mode or address-family topology configuration mode. To reset the size of the EIGRP event log to its default value, use the no form of this command.
eigrp event-log-size size
no eigrp event-log-size
Syntax Description
size
Size of the EIGRP event log; valid values are from 0 to half of the available memory on the system at the time of configuration. Default value is 500.
Command Default
The EIGRP event log size is 500.
Command Modes
Router configuration (config-router)
Address-family topology configuration (config-router-af-topology)Command History
12.2(18)SXF
This command was introduced in Cisco IOS Release 12.2(18)SXF.
15.0(1)M
This command was modified. Address-family topology configuration mode was added.
Usage Guidelines
When the configured size (number of lines) of the event log is exceeded, the last configured number of lines is retained, and the log becomes a rolling number of events with the most recent at the top of the log.
Examples
The following example shows how to set the size of the EIGRP event log to 5000010:
Router# configure terminalRouter(config)# router eigrp 2Router (config-router)# eigrp event-log-size 5000010Router (config-router)#The following example shows how to set the size of the EIGRP event log in an EIGRP named configuration to 10000:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 1Router(config-router-af)# topology baseRouter(config-router-af-topology)# eigrp event-log-size 10000Related Commands
eigrp log-neighbor-changes
To enable the logging of changes in Enhanced Interior Gateway Routing Protocol (EIGRP) neighbor adjacencies, use the eigrp log-neighbor-changes command in router configuration mode, address-family configuration mode, or service-family configuration mode. To disable the logging of changes in EIGRP neighbor adjacencies, use the no form of this command.
eigrp log-neighbor-changes
no eigrp log-neighbor-changes
Syntax Description
This command has no arguments or keywords.
Command Default
Adjacency changes are logged.
Command Modes
Router configuration (config-router)
Address-family configuration (config-router-af)
Service-family configuration (config-router-sf)Command History
Usage Guidelines
This command enables the logging of neighbor adjacency changes to monitor the stability of the routing system and to help detect problems. Logging is enabled by default. To disable the logging of neighbor adjacency changes, use the no form of this command.
To enable the logging of changes for EIGRP address-family neighbor adjacencies, use the eigrp log-neighbor-changes command in address-family configuration mode.
To enable the logging of changes for EIGRP service-family neighbor adjacencies, use the eigrp log-neighbor-changes command in service-family configuration mode.
Examples
The following configuration disables logging of neighbor changes for EIGRP process 209:
Router(config)# router eigrp 209Router(config-router)# no eigrp log-neighbor-changesThe following configuration enables logging of neighbor changes for EIGRP process 209:
Router(config)# router eigrp 209Router(config-router)# eigrp log-neighbor-changesThe following example shows how to disable logging of neighbor changes for EIGRP address-family with autonomous-system 4453:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# no eigrp log-neighbor-changesRouter(config-router-af)# exit-address-family
The following configuration enables logging of neighbor changes for EIGRP service-family process 209:
Router(config)# router eigrp 209Router(config-router)# service-family ipv4 autonomous-system 4453Router(config-router-sf)# eigrp log-neighbor-changesRouter(config-router-sf)# exit-service-familyRelated Commands
eigrp log-neighbor-warnings
To enable the logging of Enhanced Interior Gateway Routing Protocol (EIGRP) neighbor warning messages, use the eigrp log-neighbor-warnings command in router configuration mode, address-family configuration mode, or service-family configuration mode. To disable the logging of EIGRP neighbor warning messages, use the no form of this command.
eigrp log-neighbor-warnings [seconds]
no eigrp log-neighbor-warnings
Syntax Description
seconds
(Optional) The time interval (in seconds) between repeated neighbor warning messages. The range is from 1 to 65535. The default is 10.
Command Default
Neighbor warning messages are logged at 10-second intervals.
Command Modes
Router configuration (config-router)
Address-family configuration (config-router-af)
Service-family configuration (config-router-sf)Command History
Usage Guidelines
When neighbor warning messages occur, they are logged by default. With this command, you can disable and enable neighbor warning messages, and you can configure the interval between repeated neighbor warning messages.
To enable the logging of warning messages for an EIGRP address family, use the eigrp log-neighbor-warnings command in address-family configuration mode.
To enable the logging of warning messages for an EIGRP service family, use the eigrp log-neighbor-warnings command in service-family configuration mode.
Examples
The following command will log neighbor warning messages for EIGRP process 209 and repeat the warning messages in 5-minute (300 seconds) intervals:
Router(config)# router eigrp 209Router(config-router)# eigrp log-neighbor-warnings 300The following example logs neighbor warning messages for the service family with autonomous system number 4453 and repeats the warning messages in five-minute (300 second) intervals:
Router(config)# router eigrp virtual-nameRouter(config-router)# service-family ipv4 autonomous-system 4453Router(config-router-sf)# eigrp log-neighbor-warnings 300The following example logs neighbor warning messages for the address family with autonomous system number 4453 and repeats the warning messages in five-minute (300 second) intervals:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# eigrp log-neighbor-warnings 300Related Commands
eigrp router-id
To set the router ID used by Enhanced Interior Gateway Routing Protocol (EIGRP) when communicating with its neighbors, use the eigrp router-id command in router configuration mode, address-family configuration mode, or service-family configuration mode. To remove the configured router ID, use the no form of this command.
eigrp router-id router-id
no eigrp router-id router-id
Syntax Description
Command Default
EIGRP automatically selects an IP address to use as the router ID when an EIGRP process is started. The highest local IP address is selected and loopback interfaces are preferred. The router ID is not changed unless the EIGRP process is removed with the no router eigrp command or if the router ID is manually configured with the eigrp router-id command.
Command Modes
Router configuration (config-router)
Address-family configuration (config-router-af)
Service-family configuration (config-router-sf)Command History
Usage Guidelines
The router ID is used to identify the originating router for external routes. If an external route is received with the local router ID, the route is discarded. The router ID can be configured with any IP address with two exceptions; 0.0.0.0 and 255.255.255.255 are not legal values and cannot be entered. A unique value should be configured for each router.
In EIGRP named IPv4, named IPv6, and Cisco Service Advertisement Framework (SAF) configurations, the router-id is also included for identifying internal routes and loop detection.
Examples
The following example configures 172.16.1.3 as a fixed router ID:
Router(config)# router eigrp 209Router(config-router)# eigrp router-id 172.16.1.3The following example configures 172.16.1.3 as a fixed router ID for service-family autonomous-system 4533:
Router(config)# router eigrp 209Router(config-router)# service-family ipv4 autonomous-system 4453Router(config-router-sf)# eigrp router-id 172.16.1.3The following example configures 172.16.1.3 as a fixed router ID for address-family autonomous-system 4533:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# eigrp router-id 172.16.1.3
Related Commands
eigrp stub
To configure a router as a stub using Enhanced Interior Gateway Routing Protocol (EIGRP), use the eigrp stub command in router configuration mode or address-family configuration mode. To disable the EIGRP stub routing feature, use the no form of this command.
eigrp stub [receive-only] [leak-map name] [connected] [static ] [summary] [redistributed]
no eigrp stub [receive-only] [leak-map name] [connected] [static ] [summary] [redistributed]
Syntax Description
Command Default
Stub routing is not enabled by default.
Command Modes
Router configuration (config-router)
Address-family configuration (config-router-af)Command History
Usage Guidelines
Use the eigrp stub command to configure a router as a stub where the router directs all IP traffic to a distribution router, unless stub leaking is configured.
The eigrp stub command can be modified with several options, and these options can be used in any combination except for the receive-only keyword. The receive-only keyword will restrict the router from sharing any of its routes with any other router in that EIGRP autonomous system, and the receive-only keyword will not permit any other option to be specified because it prevents any type of route from being sent. The four other optional keywords (connected, static, summary, leak-map, and redistributed) can be used in any combination but cannot be used with the receive-only keyword.
If any of these five keywords is used with the eigrp stub command, only the route types specified by the particular keyword(s) will be sent. Route types specified by the remaining keywords will not be sent.
The connected keyword permits the EIGRP stub routing feature to send connected routes. If the connected routes are not covered by a network statement, it may be necessary to redistribute connected routes with the redistribute connected command under the EIGRP process. This option is enabled by default.
The static keyword permits the EIGRP stub routing feature to send static routes. Without the configuration of this option, EIGRP will not send any static routes, including internal static routes that normally would be automatically redistributed. It will still be necessary to redistribute static routes with the redistribute static command.
The summary keyword permits the EIGRP stub routing feature to send summary routes. Summary routes can be created manually with the summary address command or automatically at a major network border router with the auto-summary command enabled. This option is enabled by default.
The redistributed keyword permits the EIGRP stub routing feature to send other routing protocols and autonomous systems. Without the configuration of this option, EIGRP will not advertise redistributed routes.
The leak-map keyword permits the EIGRP stub routing feature to reference a leak map that identifies routes that are allowed to be advertised on an EIGRP stub router that would normally have been suppressed.
Examples
In the following example, the eigrp stub command is used to configure the router as a stub that advertises connected and summary routes:
Router(config)# router eigrp 1Router(config-router)# network 10.0.0.0Router(config-router)# eigrp stubIn the following named configuration example, the eigrp stub command is used to configure the router as a stub that advertises routes learned from a directly connected client:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# network 10.0.0.0Router(config-router-af)# eigrp stub connectedIn the following example, the eigrp stub command is issued with the connected and static keywords to configure the router as a stub that advertises connected and static routes (sending summary routes will not be permitted):
Router(config)# router eigrp 1Router(config-router)# network 10.0.0.0Router(config-router)# eigrp stub connected staticIn the following named configuration example, the eigrp stub command is issued with the connected and static keywords to configure the router as a stub that advertises connected and static routes (sending summary routes will not be permitted):
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# network 10.0.0.0Router(config-router-af)# eigrp stub connected staticIn the following example, the eigrp stub command is issued with the receive-only keyword to configure the router as a receive-only neighbor (connected, summary, and static routes will not be sent):
Router(config)# router eigrp 1Router(config-router)# network 10.0.0.0 eigrpRouter(config-router)# eigrp stub receive-onlyIn the following named configuration example, the eigrp stub command is issued with the receive-only keyword to configure the router as a receive-only neighbor (connected, summary, and static routes will not be sent):
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# network 10.0.0.0Router(config-router-af)# eigrp stub receive-onlyIn the following example, the eigrp stub command is issued with the redistributed keyword to configure the router to advertise other protocols and autonomous systems:
Router(config)# router eigrp 1Router(config-router)# network 10.0.0.0 eigrpRouter(config-router)# eigrp stub redistributedIn the following named configuration example, the eigrp stub command is issued with the redistributed keyword to configure the router to advertise other protocols and autonomous systems:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# network 10.0.0.0Router(config-router-af) eigrp stub redistributedIn the following example, the eigrp stub command is issued with the leak-map name keyword/argument pair to configure the router to reference a leak map that identifies routes that would normally have been suppressed:
Router(config)# router eigrpRouter(config-router)# network 10.0.0.0Router(config-router) eigrp stub leak-map map1In the following named configuration example, the eigrp stub command is issued with the leak-map name keyword/argument pair to configure the router to reference a leak map that identifies routes that would normally have been suppressed:
Router(config)# router eigrp virtual-nameRouter(config-router)# address-family ipv4 autonomous-system 4453Router(config-router-af)# network 10.0.0.0Router(config-router-af) eigrp stub leak-map map1Related Commands
enabled
To enable an aggregation cache, use the enabled command in aggregation cache configuration mode.
enabled
Syntax Description
This command has no arguments or keywords.
Command Default
The cache is disabled.
Command Modes
Aggregation cache configuration
Command History
Examples
The following example shows how to use the enabled command:
cache timeout active 30cache timeout inactive 7cache entries 100enabledRelated Commands
ipv6 flow-aggregation cache
Confiugres the aggregation cache configuration scheme for NetFlow Version 9 IPv6 configuration.
encapsulation
To set the encapsulation method used by the interface, use the encapsulation command in interface configuration mode. To remove the encapsulation, use the no form of this command.
encapsulation encapsulation-type
no encapsulation encapsulation-type
Syntax Description
Defaults
The default depends on the type of interface. For example, synchronous serial interfaces default to HDLC and asynchronous interfaces default to SLIP.
Command Modes
Interface configuration
Command History
Usage Guidelines
SLIP and PPP
To use SLIP or PPP, the router or access server must be configured with an IP routing protocol or with the ip host-routing command. This configuration is done automatically if you are using old-style slip address commands. However, you must configure it manually if you configure SLIP or PPP via the interface async command.
On lines configured for interactive use, encapsulation is selected by the user when they establish a connection with the slip or ppp EXEC command.
IP Control Protocol (IPCP) is the part of PPP that brings up and configures IP links. After devices at both ends of a connection communicate and bring up PPP, they bring up the control protocol for each network protocol that they intend to run over the PPP link such as IP or IPX. If you have problems passing IP packets and the show interface command shows that line is up, use the negotiations command to see if and where the negotiations are failing. You might have different versions of software running, or different versions of PPP, in which case you might need to upgrade your software or turn off PPP option negotiations. All IPCP options as listed in RFC 1332, PPP Internet Protocol Control Protocol (IPCP), are supported on asynchronous lines. Only Option 2, TCP/IP header compression, is supported on synchronous interfaces.
PPP echo requests are used as keepalive packets to detect line failure. The no keepalive command can be used to disable echo requests. For more information about the no keepalive command, refer to the chapter "IP Services Commands" in the Cisco IOS IP Command Reference, Volume 1 of 4: Addressing and Services and to the chapter "Configuring IP Services" in the Cisco IOS IP Configuration Guide.
To use SLIP or PPP, the Cisco IOS software must be configured with an IP routing protocol or with the ip host-routing command. This configuration is done automatically if you are using old-style slip address commands. However, you must configure it manually if you configure SLIP or PPP via the interface async command.
Note
SS7
The SS7 encapsulation command is new with the Integrated SLT feature and is available only for interface serial objects created by the channel-group command. For network access server (NAS) platforms, the encapsulation for channel group serial interface objects defaults to HDLC. You must explicitly set the encapsulation type to SS7 to override this default.
When encapsulation is set to SS7, the encapsulation command for that object is no longer available. A serial SS7 link is deleted only when its associated dial feature card (DFC) card is removed. As with existing Cisco 26xx-based SLTs, you do not need to specify whether the SS7 link is to be used as an A-link or an F-link.
By itself this command does not select the correct encapsulation type. Therefore, once created, you must set the encapsulation type to the new SS7 value, as well as assign a session channel ID to the link at the serial interface command level. The configuration on a digital SS7 link can be saved (no shutdown) only when its encapsulation is successfully set to SS7 and it has been assigned a channel identifier.
VLANs
Do not configure encapsulation on the native VLAN of an IEEE 802.1q trunk without the native keyword. (Always use the native keyword when the vlan-id is the ID of the IEEE 802.1q native VLAN.)
For detailed information on use of this command with VLANs, refer to the Cisco IOS Switching Services Configuration Guide and the Cisco IOS Switching Services Command Reference.
Examples
The following example shows how to reset HDLC serial encapsulation on serial interface 1:
Router(config)# interface serial 1Router(config-if)# encapsulation hdlcThe following example shows how to enable PPP encapsulation on serial interface 0:
Router(config)# interface serial 0Router(config-if)# encapsulation pppThe following example shows how to configure async interface 1 for PPP encapsulation:
Router(config)# interface async 1Router(config-if)# encapsulation pppTo learn more about the virtual serial interface and check SS7 encapsulation, enter the show interfaces serial slot/trunk:channel-group command in privileged EXEC mode, as in the following example:
Router# show interfaces serial 7/3:1Serial7/3:1 is up, line protocol is downHardware is PowerQUICC SerialMTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,reliability 255/255, txload 4/255, rxload 1/255Encapsulation SS7 MTP2, loopback not setKeepalive set (10 sec)Last input never, output 00:00:00, output hang neverLast clearing of "show interface" counters 03:53:40Queueing strategy: fifoOutput queue 0/40, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 26000 bits/sec, 836 packets/sec0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort11580159 packets output, 46320636 bytes, 0 underruns0 output errors, 0 collisions, 1 interface resets0 output buffer failures, 0 output buffers swapped out2 carrier transitionsDCD=up DSR=down DTR=down RTS=down CTS=downRelated Commands
encapsulation frame-relay mfr
To create a multilink Frame Relay bundle link and to associate the link with a bundle, use the encapsulation frame-relay mfr command in interface configuration mode. To remove the bundle link from the bundle, use the no form of this command.
encapsulation frame-relay mfr number [name]
no encapsulation frame-relay mfr number [name]
Syntax Description
Command Default
Frame Relay encapsulation is not enabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the name argument to assign a LID name to a bundle link. This name will be used to identify the bundle link to peer devices and to enable the devices to determine which bundle links are associated with which bundles. The LID name can also be assigned or changed by using the frame-relay multilink lid command on the bundle link interface. If the LID name is not assigned, the default name is the name of the physical interface.
Tips
To remove a bundle link from a bundle, use the no encapsulation frame-relay mfr command or configure a new type of encapsulation on the interface by using the encapsulation command.
Examples
The following example shows serial interface 0 being associated as a bundle link with bundle interface "mfr0." The bundle link identification name is "BL1."
interface mfr0!interface serial 0encapsulation frame-relay mfr0 BL1Related Commands
encryption (IKE policy)
To specify the encryption algorithm within an Internet Key Exchange (IKE) policy, use the encryption command in Internet Security Association Key Management Protocol (ISAKMP) policy configuration mode. IKE policies define a set of parameters to be used during IKE negotiation. To reset the encryption algorithm to the default value, use the no form of this command.
encryption {des | 3des | aes | aes 192 | aes 256}
no encryption
Syntax Description
Command History
The 56-bit DES-CBC encryption algorithm
Command Modes
ISAKMP policy configuration
Command History
Usage Guidelines
Use this command to specify the encryption algorithm to be used in an IKE policy.
If a user enters an IKE encryption method that the hardware does not support, a warning message will be displayed immediately after the encryption command is entered.
Examples
The following example configures an IKE policy with the 3DES encryption algorithm (all other parameters are set to the defaults):
crypto isakmp policyencryption 3desexitThe following example is a sample warning message that is displayed when a user enters an IKE encryption method that the hardware does not support:
encryption aes 256WARNING:encryption hardware does not support the configuredencryption method for ISAKMP policy 1Related Commands
enrollment terminal (ca-trustpoint)
To specify manual cut-and-paste certificate enrollment, use the enrollment terminal command in ca-trustpoint configuration mode. To delete a current enrollment request, use the no form of this command.
enrollment terminal [pem]
no enrollment terminal [pem]
Syntax Description
Command Default
No default behavior or values
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
A user may want to manually cut-and-paste certificate requests and certificates when he or she does not have a network connection between the router and certification authority (CA). When this command is enabled, the router displays the certificate request on the console terminal, allowing the user to enter the issued certificate on the terminal.
The pem Keyword
Use the pem keyword to issue certificate requests (via the crypto ca enroll command) or receive issued certificates (via the crypto ca import certificate command) in PEM-formatted files through the console terminal. If the CA server does not support simple certificate enrollment protocol (SCEP), the certificate request can be presented to the CA server manually.
Note
Examples
The following example shows how to manually specify certificate enrollment via cut-and-paste. In this example, the CA trustpoint is "MS."
crypto ca trustpoint MSenrollment terminalcrypto ca authenticate MS!crypto ca enroll MScrypto ca import MS certificateRelated Commands
enrollment url (ca-trustpoint)
To specify the enrollment parameters of a certification authority (CA), use the enrollment url command in ca-trustpoint configuration mode. To remove any of the configured parameters, use the no form of this command.
enrollment [mode] [retry period minutes] [retry count number] url url [pem]
no enrollment [mode] [retry period minutes] [retry count number] url url [pem]
Syntax Description
mode
(Optional) Specifies the registration authority (RA) mode, if your CA system provides an RA. By default, RA mode is disabled.
retry period minutes
(Optional) Specifies the period in which the router will wait before sending the CA another certificate request. The default is 1 minute between retries. (Specify from 1 to 60 minutes.)
retry count number
(Optional) Specifies the number of times a router will resend a certificate request when it does not receive a response from the previous request. The default is 10 retries. (Specify from 1 to 100 retries.)
url url
Specifies the URL of the file system where your router should send certificate requests. For enrollment method options, see Table 28.
pem
(Optional) Adds privacy-enhanced mail (PEM) boundaries to the certificate request.
Command Default
Your router does not know the CA URL until you specify it using the url url keyword and argument.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Use the mode keyword to specify the mode supported by the CA. This keyword is required if your CA system provides an RA.
Use the retry period minutes option to change the retry period from the default of 1 minute between retries. After requesting a certificate, the router waits to receive a certificate from the CA. If the router does not receive a certificate within a specified period of time (the retry period), the router will send another certificate request. By default, the router will send a maximum of ten requests until it receives a valid certificate, until the CA returns an enrollment error, or until the configured number of retries (specified via the retry count number option) is exceeded.
Use the pem keyword to issue certificate requests (using the crypto pki enroll command) or receive issued certificates (using the crypto pki import certificate command) in PEM-formatted files.
Note
Use the url url option to specify or change the URL of the CA. Table 28 lists the available enrollment methods.
Table 28 Certificate Enrollment Methods
bootflash
Enroll via bootflash: file system
cns
Enroll via Cisco Networking Services (CNS): file system
flash
Enroll via flash: file system
ftp
Enroll via FTP: file system
null
Enroll via null: file system
nvram
Enroll via NVRAM: file system
rcp
Enroll via remote copy protocol (rcp): file system
scp
Enroll via secure copy protocol (scp): file system
SCEP1
Enroll via Simple Certificate Enrollment Protocol (SCEP) (an HTTP URL)
system
Enroll via system: file system
TFTP2
Enroll via TFTP: file system
1 If you are using SCEP for enrollment, the URL must be in the form http://CA_name, where CA_name is the host Domain Name System (DNS) name or IP address of the CA.
2 If you are using TFTP for enrollment, the URL must be in the form tftp://certserver/file_specification. (The file_specification is optional. See the section "TFTP Certificate Enrollment" for additional information.)
TFTP Certificate Enrollment
TFTP enrollment is used to send the enrollment request and retrieve the certificate of the CA and the certificate of the router. If the file_specification is included in the URL, the router will append an extension onto the file specification. When the crypto pki authenticate command is entered, the router will retrieve the certificate of the CA from the specified TFTP server. As appropriate, the router will append the extension ".ca" to the filename or the fully qualified domain name (FQDN). (If the url url option does not include a file specification, the FQDN of the router will be used.)
Note
Examples
The following example shows how to declare a CA named "trustpoint" and specify the URL of the CA as "http://example:80":
crypto pki trustpoint trustpointenrollment url http://example:80Related Commands
eui-interface
To use the Media Access Control (MAC) address from a specified interface for deriving the IPv6 mobile home address, use the eui-interface command in IPv6 mobile router configuration mode. To disable this function, use the no form of this command.
eui-interface interface-type interface-number
no eui-interface interface-type interface-number
Syntax Description
Command Default
A MAC address is not used to derive the IPv6 mobile home address.
Command Modes
IPv6 mobile router configuration (IPv6-mobile-router)
Command History
Usage Guidelines
Use the eui-interface command to physically connect to the MAC to get the EUI-64 interface ID.
Examples
In the following example, the router derives the EUI-64 interface ID from the specified interface:
eui-interface Ethernet 0/0Related Commands
ipv6 mobile router
Enables IPv6 NEMO functionality on the router and places the router in IPv6 mobile router mode.
evaluate (IPv6)
To nest an IPv6 reflexive access list within an IPv6 access list, use the evaluate (IPv6) command in IPv6 access list configuration mode. To remove the nested IPv6 reflexive access list from the IPv6 access list, use the no form of this command.
evaluate access-list-name [sequence value]
no evaluate access-list-name [sequence value]
Syntax Description
Command Default
IPv6 reflexive access lists are not evaluated.
Command Modes
IPv6 access list configuration
Command History
Usage Guidelines
The evaluate (IPv6) command is similar to the evaluate (IPv4) command, except that it is IPv6-specific.
This command is used to achieve IPv6 reflexive filtering, a form of session filtering.
Before this command will work, you must define the IPv6 reflexive access list using the permit (IPv6) command.
This command nests an IPv6 reflexive access list within an IPv6 access control list (ACL).
If you are configuring an IPv6 reflexive access list for an external interface, the IPv6 ACL should be one that is applied to inbound traffic. If you are configuring IPv6 reflexive access lists for an internal interface, the IPv6 ACL should be one that is applied to outbound traffic. (In other words, use the access list opposite of the one used to define the IPv6 reflexive access list.)
This command allows IPv6 traffic entering your internal network to be evaluated against the reflexive access list. Use this command as an entry (condition statement) in the IPv6 ACL; the entry "points" to the IPv6 reflexive access list to be evaluated.
As with all IPv6 ACL entries, the order of entries is important. Normally, when a packet is evaluated against entries in an IPv6 ACL, the entries are evaluated in sequential order, and when a match occurs, no more entries are evaluated. With an IPv6 reflexive access list nested in an IPv6 ACL, the IPv6 ACL entries are evaluated sequentially up to the nested entry, then the IPv6 reflexive access list entries are evaluated sequentially, and then the remaining entries in the IPv6 ACL are evaluated sequentially. As usual, after a packet matches any of these entries, no more entries will be evaluated.
Note
Examples
The evaluate command in the following example nests the temporary IPv6 reflexive access lists named TCPTRAFFIC and UDPTRAFFIC in the IPv6 ACL named OUTBOUND. The two reflexive access lists are created dynamically (session filtering is "triggered") when incoming TCP or UDP traffic matches the applicable permit entry in the IPv6 ACL named INBOUND. The OUTBOUND IPv6 ACL uses the temporary TCPTRAFFIC or UDPTRAFFIC access list to match (evaluate) outgoing TCP or UDP traffic related to the triggered session. The TCPTRAFFIC and UDPTRAFFIC lists time out automatically when no IPv6 packets match the permit statement that triggered the session (the creation of the temporary reflexive access list).
Note
ipv6 access-list INBOUNDpermit tcp any any eq bgp reflect TCPTRAFFICpermit tcp any any eq telnet reflect TCPTRAFFICpermit udp any any reflect UDPTRAFFICipv6 access-list OUTBOUNDevaluate UDPTRAFFICevaluate TCPTRAFFICRelated Commands
event-log
To enable event logging for applications, use the event-log command in application configuration monitor configuration mode. To disable event logging, use the no form of this command.
event-log [size [number of events]] [one-shot] [pause]
no event-log
Syntax Description
Command Default
By default, event logging is not enabled.
When event logging is enabled, it is cyclical by default.Command Modes
Application configuration monitor configuration mode
OSPF for IPv6 router configuration modeCommand History
Usage Guidelines
This command enables event logging globally for all voice applications. To enable or disable event logging for a specific application, use one of the following commands:
param event-log (application parameter configuration mode)
paramspace appcommon event-log (service configuration mode)
Note
Examples
The following example shows event logging enabled:
applicationmonitorevent-logThe following example shows OSPF for IPv6 event logging enabled. The router instance is 1, the event-log size is 10,000, and the mode is one-shot.
ipv6 router ospf 1event-log size 10000 one-shotRelated Commands
explicit-prefix
To register IPv6 prefixes connected to the IPv6 mobile router, use the explicit-prefix command in IPv6 mobile router configuration mode. To disable this function, use the no form of this command.
explicit-prefix
no explicit-prefix
Syntax Description
This command has no arguments or keywords.
Command Default
No IPv6 prefixes are specified.
Command Modes
IPv6 mobile router configuration (IPv6-mobile-router)
Command History
Usage Guidelines
The mobile router presents a list of prefixes to the home agent as part of the binding update procedure. If the home agent determines that the mobile router is authorized to use these prefixes, it sends a bind acknowledgment message.
Examples
The following example shows how to register connected IPv6 prefixes:
Router(IPv6-mobile-router)# explicit-prefixRelated Commands
ipv6 mobile router
Enables IPv6 NEMO functionality on the router and places the router in IPv6 mobile router mode.
fingerprint
To preenter a fingerprint that can be matched against the fingerprint of a certification authority (CA) certificate during authentication, use the fingerprint command in ca-trustpoint configuration mode. To remove the preentered fingerprint, use the no form of this command.
fingerprint ca-fingerprint
no fingerprint ca-fingerprint
Syntax Description
Defaults
A fingerprint is not preentered for a trustpoint, and if the authentication request is interactive, you must verify the fingerprint that is displayed during authentication of the CA certificate. If the authentication request is noninteractive, the certificate will be rejected without a preentered fingerprint.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Note
Preenter the fingerprint if you want to avoid responding to the verify question during CA certificate authentication or if you will be requesting authentication noninteractively. The preentered fingerprint may be either the MD5 fingerprint or the SHA1 fingerprint of the CA certificate.
If you are authenticating a CA certificate and the fingerprint was preentered, if the fingerprint matches that of the certificate, the certificate is accepted. If the preentered fingerprint does not match, the certificate is rejected.
If you are requesting authentication noninteractively, the fingerprint must be preentered or the certificate will be rejected. The verify question will not be asked when authentication is requested noninteractively.
If you are requesting authentication interactively without preentering the fingerprint, the fingerprint of the certificate will be displayed, and you will be asked to verify it.
Examples
The following example shows how to preenter an MD5 fingerprint before authenticating a CA certificate:
Router(config)# crypto pki trustpoint myTrustpointRouter(ca-trustpoint)# fingerprint 6513D537 7AEA61B7 29B7E8CD BBAA510BRouter(ca-trustpoint) exitRouter(config)# crypto pki authenticate myTrustpointCertificate has the following attributes:Fingerprint MD5: 6513D537 7AEA61B7 29B7E8CD BBAA510BFingerprint SHA1: 998CCFAA 5816ECDE 38FC217F 04C11F1D DA06667ETrustpoint Fingerprint: 6513D537 7AEA61B7 29B7E8CD BBAA510BCertificate validated - fingerprints matched.Trustpoint CA certificate accepted.Router (config)#The following is an example for Cisco Release 12.3(12). Note that the SHA1 fingerprint is not displayed because it is not supported by this release.
Router(config)# crypto ca trustpoint myTrustpointRouter(ca-trustpoint)# fingerprint 6513D537 7AEA61B7 29B7E8CD BBAA510BRouter(ca-trustpoint)# exitRouter(config)# crypto ca authenticate myTrustpointCertificate has the following attributes:Fingerprint: 6513D537 7AEA61B7 29B7E8CD BBAA510BTrustpoint Fingerprint: 6513D537 7AEA61B7 29B7E8CD BBAA510BCertificate validated - fingerprints matched.Trustpoint CA certificate accepted.Router(config)#Related Commands
crypto ca authenticate
Authenticates the CA (by getting the certificate of the CA).
crypto ca trustpoint
Declares the CA that your router should use.
frame-relay interface-dlci
To assign a data-link connection identifier (DLCI) to a specified Frame Relay subinterface on the router or access server, to assign a specific permanent virtual circuit (PVC) to a DLCI, or to apply a virtual template configuration for a PPP session, use the frame-relay interface-dlci command in interface configuration mode. To remove this assignment, use the no form of this command.
frame-relay interface-dlci dlci [ietf | cisco] [voice-cir cir] [ppp virtual-template-name]
no frame-relay interface-dlci dlci [ietf | cisco] [voice-cir cir] [ppp virtual-template-name]
BOOTP Server Only
frame-relay interface-dlci dlci [protocol ip ip-address]
Syntax Description
