Feedback
Table Of Contents
Using the nrcmd Commands
This chapter contains descriptions for all the nrcmd commands and their attributes, alphabetically arranged in sections by command. The command syntax appears at the beginning of each section, followed by the syntax descriptions, attribute descriptions, and any usage guidelines. See the "Attribute Flags" section on page 1-4 for the types of attributes—required, optional, and read-only.
Attributes with time values are described with a default unit of time. However, you can append the characters "w," "d," "h," "m," or "s" immediately after the time value to translate the unit into weeks, days, hours, minutes, or seconds, respectively, if it fits in the allowed range of values. You can also mix time units in a single value, such as "1d6h" and "1d360m" (which are equivalent to "30h" and "1800m").
Note
If you use the get keyword to get the value of a valid attribute, but its value is not defined, Network Registrar returns the unexpected error "308 Unknown parameter." However, using the show or list keyword shows the attribute in the resulting list.
Table 2-1 lists all the nrcmd commands.
address-block
The address-block command creates and sets attributes for Network Registrar address blocks.
An address block is a contiguous range of IP address space that is delegated to the DHCP server for assignment. The DHCP server expects to subdivide these address blocks for delegation to some other server or device, or for its own use in interaction with DHCP clients.
Address blocks can parent one or more subnets. Subnets are also contiguous ranges of IP address space that are bound to a specific client, usually a router or another DHCP server. Address blocks and subnets are similar to scopes in that they contain address ranges and other attributes necessary to configure the DHCP client-server interaction. Unlike scopes, address blocks and subnets do not have the address ranges available for assignment to DHCP clients and do not contain reserved addresses.
In a virtual private network (VPN) deployment where multiple VPNs use the same private address space, you can use logically identical address blocks simultaneously on multiple VPNs. See the "Virtual Private Network Configuration Example" section.
address-block name create address=netaddr [attribute=value...]
address-block name delete
address-block name set attribute=value [attribute=value...]
address-block name unset attribute
address-block name get attribute
address-block name [show]
address-block list
address-block listnames
address-block listsubnets
Syntax Description
See Table 2-2 for the address-block command attributes and their descriptions.
address-block name create address=netaddr [attribute=value...]
Creates an address block with a certain network address (including netmask prefix), and optionally adds attributes. See Table 2-2 for the attributes to use with this command. The policy is the only required attribute, which defaults to the default policy if omitted.
nrcmd> address-block red create address=10.1.0.0/16 policy=Policy1address-block name delete
Deletes an address block.
address-block name set attribute=value [attribute=value...]
Sets one or more attributes for the address block. The policy is the only required attribute, which defaults to the default policy if omitted.
nrcmd> address-block red set namespace=vpn-redaddress-block name unset attribute
Unsets an optional address block attribute. You cannot unset the policy attribute.
address-block name get attribute
Gets the value for an address block attribute.
address-block name [show]
Shows the values of all attributes of the address block.
address-block list
Lists all address blocks and their attributes.
address-block listnames
Lists only the names of all address blocks.
address-block listsubnets
Lists the subnets created from the address block.
Attributes
Table 2-2 describes the address-block command attributes and their values and defaults, if any.
Table 2-2 address-block Command Attributes
address
create
setIP address of the address block. Use the set command to rename the address block.
embedded-policy
get
The embedded policy object for this address-block. Read-only. Gets its value from the address-block-policy command.
initial-subnet
set=
get
unsetInitial subnet size of the address block, as a number of mask bits. Optional, no default.
nrcmd> address-block red set initial-subnet=16namespace
set=
get
unsetNamespace containing the address block. If set, it sets the both namespace and namespace-id attribute values. If you get the namespace value, it derives from the namespace-id value. Required, default is the default namespace.
namespace-id
set=
get
unsetNamespace in which the address block resides. You must define the namespace using the namespace name create namespace-id command See the "namespace" section. Network Registrar actually uses the namespace-id value. If unset, the global namespace is used. Optional, default is to use the current namespace as set by the session set current-namespace command, or, if undefined there, the global namespace.
nrcmd> address-block red set namespace-id=99policy
set=
getName of the policy associated with the address-block. See the policy command to create the policy. Required, default is default policy.
nrcmd> address-block red set policy=Policy1segment-name
set=
getA label for the LAN that this block is part of. To group multiple, logical IP subnets on a single, physical LAN, give each block the same segment-name string. The server ignores character case when comparing segment-name strings. Optional, no default.
selection-tags
set=
getA list of tag strings that are compared with incoming allocation requests' selection tags. All of a request's tags must match a block's selection tags in order for the block to be used to satisfy the request. Separate multiple tags with a comma. Do not include commas within a tag. Optional, no default.
Usage Guidelines
Virtual Private Network Configuration Example
This sample configuration provisions an address block for a VPN called vpn-red. Once provisioned, the DHCP server allocates and manages subnets in the block according to client requests for subnets.
First create a new namespace for the VPN. Network Registrar uses the vpn-id from incoming request messages to determine the namespace to use when processing requests from the VPN. See the "namespace" section.
nrcmd> namespace vpn-red createCreate an address block that Network Registrar will manage as it processes subnet allocation requests for vpn-red.
nrcmd> address-block red create 10.1.0.0/16 policy=Policy1nrcmd> address-block red set namespace-id=99nrcmd> address-block red set initial-subnet=24nrcmd> address-block red set subnet-increment=16Related Commands
address-block-policy, namespace, subnet
address-block-policy
The address-block-policy command configures DHCP embedded policies for address blocks. An address-block-policy is a policy object embedded within (and limited to) an address-block object. Each address block may contain option data within its embedded policy, and may refer to a named policy with more option data, such as a router IP address. For the priority of what option data the server returns to a subnet, see the "Policy Reply Options" section.
The DHCP server implicitly creates and deletes embedded address-block-policies when you create or delete the corresponding address blocks. You manipulate the address-block-policy using the name of the corresponding address-block.
For the syntax and descriptions, see the policy command.
Attributes
See Table 2-19 in the policy command section for the attribute descriptions. Except where noted in the table, many policy command attributes also apply to address block policies.
Usage Guidelines
address-block-policy Reply Options
When the server is getting ready to return option data to a client, it examines up to seven policies. See the "Policy Reply Options" section in the policy command.
Lease Times
An address block policy contains two lease times: the client lease time and the server lease time. The server controls these in the same way as it does with the policy command. See the "Lease Times" section in the policy command.
Specifying Arrays in Vendor Specific Options
The address-block-policy command accepts data in vendor-specific options in the same way as the policy command. See the "Specifying Arrays in Vendor-Specific Options" section in the policy command.
Related Commands
address-block, client-policy, client-class, client-class-policy, policy, scope
admin
The admin command configures administrators for the cluster. You can choose any string for the administrator's name. Network Registrar uses a password to authenticate each administrator.
admin name create password=password
admin name delete
admin name set password=password
admin name unset password
admin name get password
admin name enterPassword
admin name [show]
admin list
admin listnames
Syntax Description
For the usage of passwords, see the "Passwords" section.
admin name create password=password
Creates an administrator (and optionally sets the password). If an entry already exists, the command overwrites it. Note that adding a password exposes it as plain text during entry. If you do not want to expose the password, use the admin name enter password command.
admin name delete
Deletes an administrator.
admin name set password=password
Sets or changes an administrator password. Note that this exposes the password as plain text.
admin name unset password
Unsets an administrator password, which appears as blank (without asterisks).
admin name get password
Gets an administrator password, if it exists, and displays it as asterisks.
admin name enterPassword
Returns entry and confirmation prompts for a password, which is not echoed on the screen.
admin name [show]
Shows an administrator name and password as asterisks.
admin list
Lists all administrators and their passwords, as asterisks.
admin listnames
Lists just the administrators' names.
Usage Guidelines
Passwords
Network Registrar uses the password to authenticate the administrator. If you create an administrator without a password, Network Registrar cannot authenticate the name and denies that administrator access to the cluster.
The admin user has the predefined changeme password, but you should change this password as soon as you can after installing Network Registrar.
Because the password is sensitive information, Network Registrar displays its value as asterisks in output from the admin list, admin name show, and admin name get password commands. However, specifying a password on the command line exposes it as plain text to viewers. To prevent this, omit the password when you create the account, then use the admin name enterPassword command. Keep track of the password you enter at the "password" and "verify password" prompts, because it does not display on the screen.
nrcmd> admin bob create password=bob-pwd100 Okbob:password = ********nrcmd> admin bob create314 Duplicate object - admin 'bob' already existsnrcmd> admin bob enterPasswordpassword:verify password:100 Okclient
The client command assigns attributes to a specific client entry. These attributes determine what type of IP address or policy Network Registrar assigns to the requesting host. Network Registrar always stores the client identifier (MAC address or default) in lowercase characters.
client {macaddress | default} create [attribute=value...]
client {macaddress | default} delete
client {macaddress | default} set attribute=value [attribute=value...]
client {macaddress | default} unset attribute
client {macaddress | default} get attribute
client {macaddress | default} [show]
client list
client listnames
Syntax Description
See Table 2-3 for the client command attribute descriptions.
client macaddress create [attribute=value...]
client default create [attribute=value...]Creates the client identifier as a MAC address or the word default (and optionally defines its attributes). See the "Specifying MAC Addresses" section. The default client configuration applies to all clients that do not have an explicit configuration. If an entry for the client already exists, the command overwrites it. If you modify the default client configuration, you must reload the server. See the "Reloading the Server" section.
nrcmd> client 1,6,00:d0:ba:d3:bd:3b create client-class-name=externalclient macaddress delete
client default deleteDeletes the client entry.
client macaddress set attribute=value [attribute=value...]
client default set attribute=value [attribute=value...]Sets one or more attributes for the client.
client macaddress unset attribute
client default unset attributeUnsets the value of an attribute for the client.
client macaddress get attribute
client default get attributeGets the value of an attribute for the client.
client macaddress [show]
client default [show]Shows the values of all attributes assigned to the client.
client list
Lists all clients and any attributes assigned to them.
client listnames
Lists just the client identifiers.
Attributes
Table 2-3 describes the client command attributes and their values and defaults, if any.
Table 2-3 client Command Attributes
action
set=
get
unsetAction to take for the client. Optional, no default. Use one or more of the following comma-delimited tokens:
•
•
•
•
authenticate-until
set=
get
unsetLimits the authentication time to the duration that you specify, in a date format or the forever keyword. See the "Using the authenticate-until Attribute" section. Optional, no default.
client-class-name
set=
get
unsetFor clients only, the client-class to which the client belongs. If the client is not in a client-class, the DHCP server uses the default client-class. Optional, no default.
domain-name
set=
get
unsetDomain name of the zone to use when performing dynamic DNS updates. The server places the client's address (A) resource record in this zone. For the domain-name string to have an effect, you must use the scope name enable dynamic-dns command (the default) for the scope that allocated the address. Optional, no default.
embedded-policy
get
Embedded policy as set by the client-policy command. Read-only, but you can unset all the embedded policy attributes (while retaining the policy name).
host-name
set=
get
unsetClient hostname. Use this string to replace any host-name DHCP option the DHCP client sends. See the "Values for the host-name Attribute" section. For the host-name string to have an effect, you must set scope name enable dynamic-dns (the default) in the scope that includes the address. Optional, no default.
policy-name
set=
get
unsetPolicy to add to the Network Registrar DHCP policy search list for this client. Optional, no default.
selection-criteria
set=
get
unsetScope-selection tag or (comma-separated) tags to build the scope inclusion list. See the "scope-selection-tag" section for how to create scope-selection tags. Optional, no default.
selection-criteria-
excludedset=
get
unsetScope-selection tag or (comma-separated) tags to exclude when building the scope exclusion list. See the "scope-selection-tag" section for how to create scope-selection tags. Optional, no default.
unauthenticated-
client-class-nameset=
get
unsetFor clients only, the name of the client-class to use if the client is no longer authenticated. Optional, no default.
user-defined
set=
get
unsetUser-defined string, such as a foreign key in a separate authorization database. This attribute has no effect on server operation. Optional, no default.
Usage Guidelines
Specifying MAC Addresses
Identify a client by its MAC addresses or by the word default. Specify the MAC address in the form hardware,length,address (including the commas). A sample Ethernet MAC address is 1,6,00:d0:ba:d3:bd:3b.
•
•
•
Reloading the Server
The DHCP server reads the client configuration data each time it receives a request for an IP address. If you modify a client that a MAC address identifies, you do not have to reload the server. However, if you modify the default client configuration, you must reload the server.
Using the one-shot Action
Use the one-shot action to allocate provisional addresses. This is useful when you want a client to have an address for only a short time. Configure the default client (or the client-class that the default client specifies) with the one-shot action.
nrcmd> client default set action=one-shotThe server then gives a lease to an unknown client, but when the lease expires, the server does not respond to that client during the lease grace period. After this period expires, the server does not respond to the client until another client gets the lease. This final period could be short or long, depending on the number of leases in the scope and clients using them. Newly available leases go on the end of a queue. Because the server allocates leases from the beginning of the queue, it might be quite some time before another client gets the lease.
You can allow the client a relatively short lease time, such as one day, and specify a long grace period, such as two weeks. This way you can offer an incentive to the client to register with some authority and become a known client, while not re-allocating the lease to another client. After the lease expires, the client cannot get another address for the two-week grace period. When another client gets the lease, the first client, whose use of the lease is no longer on record, can get another lease as an unknown client and have another opportunity to register.
You can configure the lease and grace period differently for each scope, so that provisional leases can have different lease and grace periods than nonprovisional ones. Provisional addresses are less restrictive if you use multiple DHCP servers, because each server operates its one-shot capabilities independently. With the approach described and two DHCP servers, an unregistered client can get two days of provisional address use every two weeks.
Using the authenticate-until Attribute
By default, client entries apply to clients for an unlimited time period. Using the authenticate-until attribute, you can limit a client entry by specifying an expiration time.
When a client entry is no longer valid, the DHCP server uses the unauthenticated-client-class-
name attribute value for the name of the client-class entry to use in answering this DHCP request. If this attribute is not set or if there is no client-class entry in it, the DHCP server ignores the request and does not provide the client an address. The following are the valid authentication values:•
•
•
The following steps give an example of using the authenticate-until attribute to distinguish between clients that are authenticated and those that are not authenticated.
1.
nrcmd> scope-selection-tag AuthSelectionTag createnrcmd> scope-selection-tag UnauthSelectionTag create2.
nrcmd> client-class AuthClientClass createnrcmd> client-class AuthClientClass set selection-criteria=AuthSelectionTagnrcmd> client-class UnauthClientClass createnrcmd> client-class UnauthClientClass set selection-criteria=UnauthSelectionTag3.
nrcmd> client 01:02:03:04:05:06 create authenticate-until=+10mnrcmd> client 01:02:03:04:05:06 set client-class-name=AuthClientClassnrcmd> client 01:02:03:04:05:06 setunauthenticated-client-class-name=UnauthClientClass4.
nrcmd> scope AuthScope create 192.168.2.0 255.255.255.0nrcmd> scope AuthScope addRange 192.168.2.1 192.168.2.50nrcmd> scope AuthScope set selection-tags=AuthSelectionTagnrcmd> scope UnauthScope create 192.168.2.0 255.255.255.0nrcmd> scope UnauthScope addRange 192.168.2.51 192.168.2.100nrcmd> scope UnauthScope set selection-tags=UnauthSelectionTag5.
nrcmd> dhcp enable client-class6.
nrcmd> savenrcmd> dhcp reloadAfter the authentication expires and the client requests another address, the DHCP server assigns the client an address from the range defined in the UnauthScope scope.
Values for the host-name Attribute
The host-name attribute value can be in one of two general forms. The first is simply the hostname string, which overrides the DHCP client request hostname. When you enter a valid name, the DHCP server ignores the actual value of the host-name option in the client's DHCP packet and uses the client-entry option instead. The second form is a keyword that starts with the (@) symbol.
•
•
•
•
Client Caching
The DHCP server maintains a memory cache of client data so that the server does not need to read the database to get this information for each client transaction. This is particularly useful for LDAP. However, the server does not keep this data indefinitely in cache because it is bound to change over time and the server should have updated data. The cached value is not expected to last until the next request cycle or across client reboots. The server has a limit on the number of entries it caches, as well as the amount of time it holds onto each cached entry. You can adjust both of these parameters. Keep the time short to allow the number of entries that you expect to arrive during the time that you set as the time to live (TTL). Moreover, the server has limited memory. You can, therefore, set a limit on the number of clients that the server keeps in the client cache by using the dhcp set client-cache-count command.
nrcmd> dhcp set client-cache-count=1000The client cache, called the cache-time-to-live (TTL), is valid only for a short time (typically a few seconds). You can also configure this TTL using the dhcp set client-cache-ttl command. After the TTL expires, the server reads the client information from the database.
nrcmd> dhcp set client-cache-ttl=10When the client cache count reaches the specified maximum, the server cannot cache any more clients until the TTL expires, after which it reads from the database and begins caching again.
The values you set for these two parameters depend on the expected client requests over time. You should balance the values so that the server should refer to the client cache item only once before the cache expires and the server refreshes the information directly from the database.
Related Commands
client-policy, client-class, client-class-policy, policy, scope, scope-policy, scope-selection-tag
client-class
The client-class command applies a set of attributes to a group or class of DHCP client configurations. Unlike most client configurations, the DHCP server reads the client-class configurations at server startup time. Therefore, you must reload the server for changes to take effect.
client-class name create [attribute=value...]
client-class name delete
client-class name set attribute=value [attribute=value...]
client-class name unset attribute
client-class name get attribute
client-class name [show]
client-class list
client-class listnames
Note
nrcmd> dhcp enable client-classSyntax Description
See Table 2-3 for the client command attribute descriptions. Except where noted in the table, many client command attributes also apply to the client-class command.
client-class name create [attribute=value...]
Creates the client-class (and optionally defines its attributes). Client-class names are case-sensitive. You must enable client-class processing for this to go into effect.
nrcmd> dhcp enable client-classnrcmd> client-class internal createnrcmd> dhcp reloadclient-class name delete
Deletes the client-class.
client-class name set attribute=value [attribute=value...]
Sets one or more attributes for the client-class. See Table 2-3 for the attributes.
client-class name unset attribute
Unsets a client-class attribute.
client-class name get attribute
Gets an attribute value for the client-class.
client-class name [show]
Shows the values of all attributes assigned to the client-class.
client-class list
Lists all client-classes and any attributes assigned to them.
client-class listnames
Lists just the client-class names.
Attributes
See Table 2-3 in the client command for the attribute descriptions.
Usage Guidelines
See the "Usage Guidelines" in the "client" section.
Related Commands
client, client-policy, client-class-policy, dhcp, ldap, policy, scope-policy
client-class-policy
The client-class-policy command configures embedded policies for client-classes. Each client-class can contain option data in its embedded policy and can refer to a named policy with more option data, such as a router IP address. Network Registrar implicitly creates and deletes an embedded client-class policy when you create and delete the corresponding client-class. You manipulate the client-class policy using the name of the client-class to which the embedded policy is attached.
For the syntax and descriptions, see the "policy" section.
Attributes
See Table 2-19 in the policy command section for the attribute descriptions. Except where noted in the table, many policy command attributes also apply to client-class policies.
Related Commands
client, client-policy, client-class, policy, scope-policy
client-policy
The client-policy command configures embedded policies for clients. Each client can contain option data in its embedded policy and can refer to a named policy with more option data, such as a router IP address. Network Registrar implicitly creates and deletes an embedded client policy when you create or delete the corresponding client. You manipulate the client policy using the name of the client to which the embedded policy is attached.
For the syntax and descriptions, see the "policy" section.
Attributes
See Table 2-19 in the policy command section for the attribute descriptions.
Related Commands
client-class, client-class-policy, policy, scope-policy
custom-option
The custom-option command creates and deletes custom DHCP options. You can also use this command to redefine any predefined DHCP options. If you delete this option, its definition returns to its original value.
custom-option name create number type [desc="string"]
custom-option name delete
custom-option name set attribute=value [attribute=value...]
custom-option name unset attribute
custom-option name get attribute
custom-option name [show]
custom-option list
custom-option listnames
Syntax Description
custom-option name create number type [desc="string"]
Creates a custom option with a name, maps it to an option number, defines the data type, and optionally sets an attribute value. The positional attributes (in their correct order) are:
•
•
•
•
nrcmd> custom-option red create 100 IPADDRnrcmd> custom-option blue create 101 BYTE_ARRAYThe following example creates a custom option that overlays the public time-offset option with a new definition.
nrcmd> custom-option green create 2 INT desc="Option green overlays time-offset"
Note
nrcmd> custom-option option-192 create 192 INTcustom-option name delete
Deletes a custom option. If the custom option is an overlay of a public option, the option reverts to its previous definition.
custom-option name set attribute=value [attribute=value...]
Sets or resets one or more attributes for a custom option.
•
•
•
•
nrcmd> custom-option blue set desc="this is an option called blue"custom-option name unset attribute
Unsets the value of a custom option attribute.
custom-option name get attribute
Gets the value of an attribute for a custom option.
custom-option name [show]
Shows the attributes of a custom option.
custom-option list
Lists all custom options and any attributes assigned to them.
custom-option listnames
Lists just the names of the custom options.
Option Data Types
Table 2-4 lists the option data types that the nrcmd program supports.
Related Commands
option-datatype, vendor-option
dhcp
The dhcp command configures the DHCP server in the cluster. Because there is only one DHCP server in a cluster, you do not need to reference the server by name.
dhcp enable attribute
dhcp disable attribute
dhcp set attribute=value [attribute=value...]
dhcp unset attribute
dhcp get attribute
dhcp trimIPHist date [-namespace name] [-logfile filename]
dhcp [show]
dhcp attachExtension extension-point extension-name [sequence-number]
dhcp detachExtension extension-point [sequence-number]
dhcp listExtensions
dhcp setPartnerDown partner-server [date]
dhcp getRelatedServers column-separator=string
dhcp updateSMS [all]
Note
Syntax Description
See Table 2-5 for the dhcp command attribute descriptions.
dhcp enable attribute
Enables an attribute for the DHCP server.
nrcmd> dhcp enable client-classdhcp disable attribute
Disables an attribute for the DHCP server.
nrcmd> dhcp disable import-modedhcp set attribute=value [attribute=value...]
Sets one or more attributes for the DHCP server.
nrcmd> dhcp set failover-maximum-client-lead-time=60dhcp unset attribute
Unsets the value of a DHCP server attribute.
dhcp get attribute
Gets the value of an attribute for the DHCP server.
nrcmd> dhcp get discover-interfacesdhcp trimIPHist date [-namespace name] [-logfile filename]
Supplies the DHCP server with a cutoff time to apply to the history records. When you reload the server, it examines the history database and deletes any records with an expiration time older than the date value.
nrcmd> dhcp trimIPHist "Tue Dec 31 19:00:00 2002"101 Reload NeededThe effect of this command is not persistent; it only affects the next reload, not all subsequent reloads. You can specify to trim data in a specific namespace only. You can also redirect output to a log file, mainly for debugging purposes. Enter the date-string based on the local CLI time and date, in relative or fixed format:
•
•
For more information on trimming, refer to the chapter on configuring DHCP scopes and leases in the Network Registrar User's Guide.
dhcp [show]
Shows the values of the DHCP server attributes.
dhcp attachExtension extension-point extension-name [sequence-number]
Sets the specified extension point to call an extension. The following example adds an extension named test to the extension point post-packet-decode.
nrcmd> dhcp attachExtension post-packet-decode test 1If the extension point is already configured to call an extension, use the sequence number to specify the order in which Network Register is to execute the extensions (1, 2, 3,...). If you omit a sequence number, Network Registrar overwrites the existing extension with the new value. See Table 2-7 for descriptions of the extension-point values.
dhcp detachExtension extension-point [sequence-number]
Detaches extensions from an extension point. The following example removes the test extension from the post-packet-decode extension point. Network Registrar removes the extension at the specified sequence number. If you omit the sequence number, Network Registrar removes the extension at sequence number 1.
nrcmd> dhcp detachExtension post-packet-decode test 1dhcp listExtensions
Lists the currently configured extensions and their sequence numbers (if you configure multiple extensions) at each extension point. Cisco recommends that you run listExtensions for an extension point before attaching a new one. Check the results to ensure that the new extension has a different sequence number than an existing one.
dhcp setPartnerDown partner-server [date]
Notifies the DHCP server that its partner DHCP server is down and moves all appropriate scopes into the PARTNER-DOWN state. Optionally, you can specify the date and time when the partner was last known to operate. The default is the current date. This command is the equivalent of the server dhcp setParnterDown command. For more information, see the "Setting Partner Down" section.
Caution
dhcp getRelatedServers column-separator=string
Gets the status of the connection between the DHCP server and its DNS, LDAP, or failover servers. You can optionally specify that the report use string for separating columns. This command is the equivalent of the server dhcp getRelatedServers command. For more information, see the "Getting Related Servers" section.
dhcp updateSms [all]
Causes the DHCP server to perform System Management Server (SMS) network discovery. Optionally, including all sends out all leased addresses from the DHCP server to SMS. If you do not include this parameter, the server sends only those addresses leased since the last time you used this command. This command is the equivalent of the server dhcp updateSMS command. For more information, see the "Updating the System Management Server" section.
Attributes
Table 2-5 describes the dhcp command attributes and their values and defaults, if any.
Table 2-5 dhcp Command Attributes
activity-summary-interval
set=
get
unsetTime, in seconds, between activity summary log messages if enabled in the activity-summary setting in log-settings. Optional, default 300 seconds (five minutes).
addr-blocks-default-
selection-tagsset=
get
unsetSpecifies the default selection tag (or list of tags) to be associated with incoming subnet-allocation requests that do not contain any subnet name data. Optional, no default.
addr-blocks-use-client-
affinityenable
disable
unsetThe DHCP server tries to allocate subnets to clients using address blocks that they already used. Disabling this attribute causes the server to supply subnets from any suitable address block, based on other selection data in the clients' messages. Optional, default enable.
addr-blocks-use-lan-
segmentsenable
disable
unsetControls whether DHCP subnet-allocation uses the lan-segment attribute when configured on address blocks. Optional, default disable.
addr-blocks-use-selection-
tagsenable
disable
unsetControls whether the server compares the incoming subnet-allocation requests' subnet name data with each address block's selection tags. An address block will only be considered if the two match. Optional, default enable.
append-user-class-id-to-
selection-tagenable
disable
unsetMeaningful only if dhcp set map-user-class-id=1 (map the user class ID to the scope-selection tag). If you set this attribute to true (the default), Network Registrar appends the user class ID to existing scope-selection tags. If set to false, the user class ID replaces any existing tags. See the "scope-selection-tag" section. Optional, default enable.
client-cache-count
set=
get
unsetAllocates the specified maximum number of clients to the client cache. The DHCP server allocates the amount at startup and frees it up at shutdown. See the "Client Caching" section. Optional, default 1000 clients.
nrcmd> dhcp set client-cache-count=1000client-cache-ttl
set=
get
unsetTime to live for the client cache, in seconds. The DHCP server removes the entries in memory after this period. See the "Client Caching" section. Optional, default 10 seconds.
nrcmd> dhcp set client-cache-ttl=10client-class
enable
disable
unsetControls whether the DHCP server uses the client and client-class configuration objects to affect request processing. Optional, default disable.
cnr-5-0-upgraded
get
Shows whether the DHCP server was upgraded for Network Registrar Release 5.0. Read-only.
collect-performance-
statisticsenable
disable
unsetControls whether the DHCP server collects statistics for performance monitoring. Optional, default disable.
dbsn
get
Minor serial number of the specified server, which gets incremented after every set of configuration changes. Useful with the session assert commands. See the "Session Asserts" section. Read-only.
defer-lease-extensions
enable
disable
unsetControls whether the server renews a client's lease that is less than halfway to its expiration. By default, the server defers the lease extension—does not renew the lease, but grants another one while keeping the lease period. This way, the server can avoid extra database updates. However, if a client is more than halfway to expiration, this setting has no effect, and the server extends the lease to the full configured lease period. See the "Deferring Lease Extensions" section. Optional, default enable.
delete-orphaned-leases
enable
disable
unsetLeases that are in the lease state database can have a namespace-id recorded with them, or they can be orphaned. When the DHCP server initializes its cache from the lease state database, it expects every lease with a namespace-id to match a configured namespace. If the server finds a lease whose namespace-id does not match a configured namespace, this property controls whether to delete that lease from the database or to ignore that entry (the default), assuming that at some point the server is configured with the appropriate namespace. In either case, the server cannot use the lease. Optional, default disable.
delete-orphaned-subnets
enable
disable
unsetAs the DHCP server starts up, it tries to locate the parent namespace and address block of each subnet. If a subnet refers to a namespace that is no longer configured in the server, or if the server cannot locate a parent address block that contains the subnet, the server uses this attribute to decide whether to keep the subnet entry in the state database (the default) or to delete it permanently. Optional, default disable.
discover-interfaces
enable
disable
unsetControls whether the DHCP server looks at all the interface cards on the host and processes DHCP requests that it receives from any of them. However, it only offers addresses to requests from subnets defined with a valid scope with available addresses. If disabled, the DHCP server uses only its list of configured interfaces. See the "dhcp-interface" section. Optional, default enable.
dns-timeout
set=
getTime, in milliseconds, that the DHCP server waits for a response before retrying a dynamic DNS request. Required, default 60000 milliseconds.
docsis-version-id-missing
set=
get
unsetString (maximum 255 characters) that gets substituted with the %@docsis-vers% variable in the policy command's boot-file attribute. This substitution occurs if the DHCP request packet does not contain a vendor-class-id option or the option does not contain a DOCSIS version id. Optional, no default.
drop-old-packets
set=
get
unsetTime, in seconds, that a packet can age and still be processed. If the server is very busy, this could delay processing packets in the UDP input queue. The DHCP protocol allows clients to retry packets that are not processed in a few seconds. Therefore, allowing the server to process packets that are older than a few seconds could increase the congestion. If the age of a packet is greater than the value of this attribute when the server processes it, the server drops the packet. Optional, default 8 seconds.
drop-packet-on-extension-
failureenable
disable
unsetControls whether the server drops a packet (if possible) when it encounters a failure in an extension. Optional, default enable.
extension-trace-level
set=
get
unsetDefault value of the extension trace level for every request object. See the "extension" section. You can override this value by setting the extension-trace-level in a user-written extension. Setting the level to 0 (the default) causes very little tracing. Setting the level to 3 causes considerable tracing. Optional, default 0.
failover
enable
disable
unsetControls whether all scopes that use the server's failover configuration can engage in failover. See the "Failover Attribute States" section. If disabled (the default), those scopes with failover explicitly enabled for the scope are still available for failover. Optional, default disable.
failover-backup-percentage
set=
get
unsetWith failover enabled, the percentage of currently available (unleased) addresses that the main server should send to the backup server to allocate to new DHCP clients when the main server is down. The value is only meaningful for the main server. Optional, default 10 percent.
failover-backup-server
set=
get
unsetWith failover enabled, the DNS name of the backup server associated with all scopes if you did not use the scope name set failover-backup-server command. If this DNS name resolves to the IP address of the current server, this server operates as the backup server for all of these scopes. It is an error if both the main and backup server names resolve to addresses on the same server. Optional, no default.
failover-bulking
enable
disable
unsetWith failover enabled, controls whether a failover bind update (BNDUPD) contains multiple lease state updates. Affects only the lease state updates that DHCP client activity generates. Optional, no default.
failover-dynamic-bootp-
backup-percentageset=
get
unsetWith failover enabled, the percentage of currently available (unreserved) addresses that the main server should send to the backup server for scopes set with scope name enable bootp. See the "Setting the Failover Backup Percentage" section. Optional, no default.
failover-lease-period-factor
set=
get
unsetWith failover enabled, the multiple of the desired lease period used to update the backup server when the main server informs it of a new DHCP client lease period. See the "Setting the Failover Lease Period Factor" section. Optional, default factor of 1.5.
failover-main-server
set=
get
unsetWith failover enabled, the DNS name of the main server associated with all scopes where scope name set failover-main-server is not set. If this DNS name resolves to the IP address of the current server, this server operates as the main server for all of these scopes. It is an error if both the main and backup server names resolve to addresses on the same server. Optional, no default.
failover-maximum-client-
lead-timeset=
get
unsetWith failover enabled, the maximum client lead time (MCLT), in seconds. The MCLT is the maximum time that one server can extend a client's lease beyond what its partner knows it to be. You must define the MCLT on the main server, which communicates it to its partner. It is ignored on a backup server. See the "Setting the Maximum Client Lead Time" section. Optional, default 3600 seconds (60 minutes).
failover-poll-interval
set=
get
unsetWith failover enabled, the polling interval of the failover partners (in seconds) to confirm network connectivity. Optional, default 15 seconds.
failover-poll-timeout
set=
get
unsetWith failover enabled, the interval (in seconds) after which failover partners who cannot communicate know that they lost network connectivity. Optional, default 60 seconds.
failover-recover
set=
get
unsetWith failover enabled, time at which the server performs initialization and goes into RECOVER state. If server A is running, server B issues this command to ask for the state of server A. Enter the time as month (name or its first three letters), day, hour (24 hour) year (fully specified year or last two digits), all enclosed in double quotes; for example, "Jun 30 20:00:00 2002." Optional, default zero (0).
failover-safe-period
set=
get
unsetWith failover enabled and the failover-use-safe-period attribute set, the safe period, in seconds. You must define it in the main server. The safe period can differ on the main and backup servers. See the Network Registrar User's Guide for more information. Optional, default 86400 seconds (24 hours).
failover-use-safe-period
enable
disable
unsetWith failover enabled and the failover-use-safe-period attribute set, you must enable the failover-use-safe-period attribute to cause Network Registrar to go into the PARTNER-DOWN state automatically. If you disable this attribute (the default), Network Registrar never goes into the PARTNER-DOWN state automatically. You must then use the dhcp setPartnerDown command. See the "Setting Partner Down" section. Optional, default disable.
get-subnet-mask-from-
policyenable
disable
unsetControls whether the DHCP server searches all relevant policies for a subnet mask option when constructing a response to send to a client. Normally, the DHCP server retains the subnet mask configured in the scope containing the base being granted to the DHCP client. Optional, default disable.
hardware-unicast
enable
disable
unsetControls whether the DHCP server sends unicast rather than broadcast responses when a client indicates that it can accept a unicast. This attribute is only available on the following operating systems: Solaris, Windows 2000, and Windows NT. Optional, default enable.
ignore-icmp-errors
enable
disable
unsetWith this attribute enabled (the default), if you configured the DHCP server to send ICMP ECHO (ping-before-offer) requests, the server makes unavailable any address for which it receives an ECHO reply within its configured timeout period. If you disable this attribute, the DHCP server also treats ICMP DEST_UNREACHABLE and TTL_EXPIRED error messages that it receives after sending ICMP ECHO requests as grounds for making an address unavailable. Optional, default enable.
ignore-requests-for-other-
serversenable
disable
unsetControls whether to prevent the normal DHCP server response to client requests for other servers. Normally, if the DHCP server sees a client requesting a lease from another server for an address that this server is configured to control, it sets the lease to unavailable. However, some clients could send request packets with bad server ID options (rather than packets actually directed to other servers) that the server could wrongly interpret as the address being unavailable. You can set this attribute to prevent this from occurring. See also the "Setting a Lease to Unavailable" section. Optional, no default.
import-mode
enable
disable
unsetControls whether to have the DHCP server recognize only packets generated from the import leases command and to ignore all others. See the "Putting the Sever in Import Mode" section. You can use this attribute if you want to update your DHCP server and prevent clients from receiving addresses during this period. Optional, default disable.
inhibit-busy-optimization
enable
disable
unsetControls whether to prevent the server from using optimization to recover from periods of congestion. By default, the DHCP server determines that it is heavily loaded when the number of request packets reaches two-thirds of the total allocated. It logs a message and attempts to recover from the congestion by performing several optimizations. For example, it relaxes the requirement to keep the client's last transaction time updated to the granularity specified by the last-transaction-time-granularity attribute.
When the number of request packets drops to one-third of the total allocated, the server logs a message and returns to normal operation. If you enable the inhibit-busy-optimization attribute, the server does not use the optimizations or log the messages when it gets congested. Optional, default disable.
ip-history
enable
disable
unsetControls recording IP history data for the IP history database. See the Configuring DHCP Scopes and Leases chapter of the Network Registrar User's Guide. Default, disable.
ip-history-dir
set=
get
unsetPath to the directory of the database containing the IP (lease) history. It is best to store the history files on a different disk partition from the server's lease state database. Because of this, use absolute paths if possible. Relative paths are relative to the server logs directory. The server default logs directory is, on Solaris and Linux, in the /var/nwreg2/logs directory; on Windows, in the C:\Program Files\Network Registrar\Logs folder. Use forward slashes ("/") as path separators and quote paths containing space characters. Then, use the default statement.
Absolute paths are allowed for putting the IP history database on a separate file system from the logs or configuration directory.
You must set this attribute if you also use the dhcp enable ip-history command. Optional, default is the logs directory.
last-transaction-time-
granularityset=
get
unsetTime, in seconds, that Network Registrar guarantees that the last transaction time is accurate. Do not set this lower than the default of 60 seconds). For optimal performance, set it to a value that is greater than half of your lease interval. See the "Deferring Lease Extensions" section. Optional, default 60 seconds.
ldap-mode
set=
get
unsetDetermines the preference for using LDAP servers if more than one LDAP server is configured. Optional, no default. There are two possible values:
•
•
log-settings
set=
get
unsetDetermines which events to log in the log files. See Table 2-6. Logging additional detail about events can help analyze a problem. However, leaving detailed logging enabled for a long period can fill up the log files. Optional, the default flags are default, incoming-packets, and missing-options.
mac-address-only
enable
disable
unsetControls whether the DHCP server uses the client's MAC address as the only client identifier. The standard behavior, as specified in RFC 2132, is to use the client ID option (if it is present) as the unique client identifier. You can use this argument to identify all clients that use the server. Optional, default disable.
map-user-class-id
set=
get
unsetDetermines the handling of user class-id. This attribute is global and is set for all DISCOVER packets. Optional, default 0. The values are:
0—Ignore the user class-id option (default).
1—Map the user class-id option to the scope-selection tag. See the "scope-selection-tag" section.
2—Map the user class-id option to the client-class.max-dhcp-requests
set=
getNumber of buffers that the DHCP server allocates for receiving packets from DHCP clients and failover partners. You should allocate at least 100 buffers; perhaps as many as several thousand is reasonable in some installations. Required, default 500 buffers.
max-dhcp-responses
set=
getNumber of buffers that the DHCP server allocates for responding to DHCP clients and communicating with failover partners. The number of buffers allocated should be at least two times the number allocated for the max-dhcp-requests attribute. Perhaps as many as several thousand is reasonable in some installations. Required, default 1000 buffers (if failover is configured, the server configures additional responses).
max-dns-packets
set=
getNumber of DNS packet buffers that the DHCP server allocates for sending dynamic updates to the DNS server. You can reduce the DHCP server's memory requirement by reducing the number of DNS packets, at the risk of missing updates. Required, default 100 buffers.
max-dns-renaming-retries
set=
getNumber of times that the DHCP server can try to add a host in DNS even if it detects that the host's name is already present. This controls the number of times the DHCP server tries to modify a host's name to resolve a conflict on each failed update. Required, default 2 retries.
max-dns-retries
set=
getNumber of times that the server tries to send dynamic updates to a DNS server. Required, default three retries.
max-dns-ttl
set=
getTime to live (TTL) ceiling, in seconds, for DNS records added through dynamic DNS. When the DHCP server adds a DNS record, it sets the TTL to less than one-third of the lease time, or this ceiling value. Note that the DNS record's effective TTL could actually be the zone's minimum TTL. Required, default 86400 seconds.
max-ping-packets
set=
get
unsetNumber of buffers that the server allocates for sending and receiving ICMP ping messages, if you use the scope name enable ping-clients command. See Table 2-24 in the "scope" section. Optional, no default.
max-waiting-packets
set=
get
unsetNumber of packets that can wait for processing for an address. The server queues only the most recently received n packets (of an address) for processing. If an additional packet associated with that address arrives and n packets are already queued, the server drops the oldest packet and queues the new one. See the dropped-waiting-packets log setting attribute in Table 2-6. It also drops duplicate packets (whose XID, client-id, and MAC address are the same as one already queued). If you accept the default of 0, the server processes all packets. Optional, default 0.
mcd-blobs-per-bulk-read
set=
get
unsetNumber of blob objects for a bulk read. Use this attribute to tune DHCP start and reload times. Generally, a higher value results in faster server start and reload times, at the cost of using more memory. Optional, values from 1 through 2500, default 256 blobs.
one-lease-per-client
enable
disable
unsetControls whether to have the DHCP server release any other leases that the client may have had on this server. Because the default behavior for the Network Registrar DHCP server is to store all the leases that a client obtains, this command ensures that the DHCP server only stores one lease. A client might obtain a number of leases if a user with a laptop travels throughout the building and requests leases at different locations on the network. Optional, default disable.
return-client-fqdn-if-asked
enable
disable
unsetControls whether the system returns the client-fqdn (fully qualified domain name) option to the client in the outgoing packet if the client requests it in the parameter request list. For example, the client may want to know the status of the DNS activity. Optional, default enable.
The system always sets the flags in the option to 0x3 and the RCODE1 and RCODE2 to 255. It also sends back whatever string was sent in, even if the use-client-fqdn attribute is turned off and no matter what the actual name is (or may ultimately be) in DNS.
save-lease-renewal-time
enable
disable
unsetIf set to true, the server saves the lease renewal time (the minimum time in which the client is expected to issue a lease renewal) as part of the lease in persistent memory. Optional, default disable.
save-relay-agent-data
set=
get
unsetThe lease state database in Network Registrar 5.5 saves all relay agent data. Therefore, any changes to this attribute have no effect. Optional, no default.
save-vendor-class-id
enable
disable
unsetControls whether the server saves the value of the vendor-class-identifier DHCP option (60) in memory. This affects what you can store in an LDAP directory. Optional, default disable.
scope-selection-tags
set=
get
unsetList of scope-selection tags associated with the server. In this context, refers to a named entity that controls matching client and client-class entries with candidate scopes. See the "scope-selection-tag" section. Optional, no default.
skip-client-lookup
enable
disable
unsetIf enabled, causes the DHCP server to skip looking up the client entry for client-class processing. If disabled (the default), the DHCP server looks up the client entry first. Optional, default disable.
sms-lease-interval
set=
get
unsetSets the time interval, in milliseconds, between sending addresses to the System Management Server (SMS). After you install a future release of Microsoft BackOffice Resource Kit (which contains an enhanced version of smsrsgen.dll), reduce this interval or set it to 0. Optional, default 1100 milliseconds.
sms-library-path
set=
get
unsetOverrides the internal default value for the name of the SMS dll. The default is the empty string. If you specify an empty string, the system defaults to the internal server default of smsrsgen.dll. Optional, no default.
sms-network-discovery
set=
get
unsetCauses the DHCP server to generate SMS network discovery records. To enable this attribute, set it to 1; to disable it, set it to 0 (the default). Use this attribute in conjunction with the dhcp updateSms command. See the "server" section. Optional, default 0.
sms-site-code
set=
get
unsetSpecifies the site code of the SMS server that receives discovery records when you issue the updateSms keyword. You must initialize this attribute to the appropriate SMS site code for the updateSms keyword to operate. See the "server" section. Optional, no default.
update-dns-for-bootp
enable
disable
unsetIf the server replies to a BOOTP request and offers a lease from a scope that is configured for DNS updates, the DHCP server checks this attribute before beginning the update. You can use this attribute to prevent DNS updates for BOOTP clients, while allowing updates for DHCP clients. Optional, default enable.
use-client-fqdn
enable
disable
unsetControls whether the system examines the client-fqdn (fully qualified domain name) option for the hostname. If there are characters after the first dot in a client-fqdn option, the server ignores them because it determines the domain from the scope. Set this attribute to false if you do not want the server to determine a hostname from this option, possibly because the client is sending unexpected characters. Optional, default enable.
use-client-fqdn-first
enable
disable
unsetControls whether the system examines the client-fqdn option on incoming packets first, before the host-name option, when determining a hostname for a client. If there is a client-fqdn option with a hostname specified, the system uses that hostname. If the system finds no client-fqdn option in the incoming packet, the system uses the host-name option.
If the use-client-fqdn-first parameter is set to false, the system examines the host-name option first and uses any name found in that option. If that option does not appear, it examines the client-fqdn option for a hostname. Optional, default enable.
use-dns-update-prereqs
enable
disable
unsetBy default, the DHCP server uses prerequisites in its DNS update messages when it is performing DNS updates on behalf of clients. If disabled, the server does not include prerequisites. Without them, the server associates the last client who uses a given domain name with that name, even if another client was already associated with it. Optional, default enable.
use-host-name
enable
disable
unsetControls whether the system examines the host-name option for the hostname. Disable this attribute if you do not want the server to determine a hostname from this option, possibly because the client is sending unexpected or "junk" characters. Optional, default enable.
use-ldap-client-data
enable
disable
unsetControls whether the DHCP server attempts to read client-entry data using the configuration supplied by the ldap command. See the "ldap" section. Optional, default disable.
vpn-communication
enable
disable
unsetIf enabled (the default), the DHCP server can communicate with DHCP clients on a different virtual private network (VPN) from that of the DHCP server by using an enhanced DHCP relay agent capability. This enhanced capability is signalled by the appearance of the server-id-override sub-option in the relay-agent-information-option (DHCP option 82). Optional, default enable.
DHCP Log Settings
See Table 2-6 for the log flags that you can set using the dhcp command. The log setting that is enabled by default is incoming-packets.
You can modify the logging behavior of the DHCP server by setting flags on the log-settings attribute. For example, you can suppress warning messages for unconfigured or missing options.
nrcmd> dhcp set log-settings=default,incoming-packetsnrcmd> dhcp reloadYou can turn on client and client-class debugging for the DHCP server.
nrcmd> dhcp set log-settings=client-detailnrcmd> dhcp reloadYou can also turn off debugging entirely for the DHCP server.
nrcmd> dhcp set log-settings=defaultnrcmd> dhcp reload
Extension Points
Table 2-7 summarizes the extension points available for controlling the DHCP server (in general sequential order). See Chapter 4, "Using Extension Points."
Usage Guidelines
Deferring Lease Extensions
You can enable the defer-lease-extensions attribute to reduce the number of writes to the Network Registrar database. These writes can occur because the Network Registrar DHCP server commits fresh information to the database any time it changes the duration of a client's lease. Because the DHCP server renews leases for the full lease interval every time the client contacts the server, these database writes may impact performance if the server is on a busy network.
You can eliminate some database writes if the data being written is the same as the old data. Instead of granting the full lease duration, the server can regrant the lease with a new duration equal to the remaining time on the old lease. Because the absolute expiration time does not change, there is no need to write to the database.
There are three cases of lease extensions to consider:
•
•
•
As a complication, the server also keeps track of the time when it last heard from the client. Known as the last transaction time, sites sometime use this information as a debugging aid. Maintaining this time robustly requires a write to the database on every client interaction. See the last-transaction-time-granularity attribute in Table 2-5. Because the last transaction time is not integral to the protocol, you need not update it synchronously. Also, because it is primarily a debugging aid, it need not be entirely accurate. Furthermore, because the in-memory copy is always accurate, you can use the export leases -server command to display the current information, even if the data is not up-to-date in the database. See the "Considerations of the export leases Command" section.
Putting the Sever in Import Mode
You can put the DHCP server into import mode by enabling the import-mode attribute and then restarting the server. You take the server out of import mode by disabling the attribute and restarting the server. You can use import mode to exclude all DHCP lease requests except for the specially tagged ones that come from the nrcmd program during lease import. See the "Usage Guidelines" for the "import" section.
Configuring the sms-library-path Attribute
When you install the Microsoft BackOffice Resource Kit, the system path is not updated to reflect the location of the SMS dll. Use one of the following methods to configure this attribute.
•
To set the attribute to relative path, add the following line to the system path on the machine that has DHCP server:
sms-install-directory\diagnoseThen, set this attribute to the name of the dll:
nrcmd> dhcp set sms-library-path "smsrsgen.dll"You can also accept the system default:
nrcmd> dhcp unset sms-library-path•
If you do not want to change the system path, enter the following command to set this attribute to the absolute path of the dll location:
nrcmd> dhcp set sms-library-path"\\Program Files\\Resource Kit\\sms\\diagnose\\smsrsgen.dll"Setting the Failover Backup Percentage
For all servers or scopes for which you set dhcp enable failover or scope enable failover, you must set the failover-backup-percentage. This is the number of currently available (not reserved) leases that the backup server can use for allocations to new DHCP clients when the main server is down. You can use the default, which is 10 percent, or specify another value.
For scopes for which you set scope enable dynamic-bootp, use the failover-dynamic-bootp-backup-percentage attribute rather than the failover-backup-percentage attribute. The failover-dynamic-bootp-backup-percentage is the percentage of available addresses that the main server should send to the backup server for use with BOOTP clients.
Note
The failover-dynamic-bootp-backup-percentage is distinct from the failover-backup-percentage attribute, because if scope name enable bootp is set on a scope, a server never, even in PARTNER-DOWN state, grants leases on addresses that are available to the other server. Network Registrar does not grant leases because the partner might give them out using dynamic BOOTP, and you can never safely assume that they are available again.
To properly support dynamic BOOTP while using the failover protocol, do the following on every LAN segment in which you want BOOTP support:
•
•
•
For more information about dynamic BOOTP, see the Network Registrar User's Guide.
Setting the Maximum Client Lead Time
The failover-maximum-client-lead-time (MCLT) attribute is a key factor in failover. The MCLT adds a certain fixed amount to the client's expiration time as known by the backup server, as an insurance that the backup server does not give out the lease prematurely to another client in case the main server is down. By default, the MCLT extends the lease period by one hour. Failover requires the MCLT because the servers uses the failover lazy update feature. With this feature, a server can allocate an IP address or extend a lease without having first to notify its failover partner each time. It can notify its partner in batches of updates later as time permits, a performance advantage.
However, with lazy update, when a server fails before updating its partner about having updated a client's lease, the partner may consider the lease expired and allocate it to another client prematurely. The added MCLT period avoids this problem. Every time the partners reconnect, the main server sends its partner the MCLT extension period. The partner cannot give a lease to a client until after this short waiting period, which gives the client a chance to apply to the partner for a renewal while still maintaining the lease. If the period expires and the main server is still down, the partner can still give the client another address.
Setting the Failover Lease Period Factor
The client and the backup server can have different information about a lease expiration. The failover-lease-period-factor attribute controls how much ahead of the client's lease expiration the main server tells its partner that the expiration is.
The larger the lease period factor, the more independent the main server is of the operation of its partner, and the less performance impact the failover protocol has on the main server. However, the larger the factor, the longer the partner must wait to time out an expired lease and re-use it for a different client in the event that the main fails and the partner takes over DHCP functions. Possible values are:
•
•
•
You must define this attribute for the main DHCP server. If it is defined in a backup server, the main server ignores it (to enable duplicating the configurations through scripts).
The lease period interacts with the lease renewal period. If the lease renewal period is more than 50% of the lease, you must also increase the lease period factor. The calculation is as follows: lease factor (1) + renewal time percentage = renewal factor. The usual renewal time of 50% would require a (1 + .5 =) 1.5 renewal factor. A renewal time of 80% would require a (1 + .8 =) 1.8 renewal factor.
Enabling DHCP Forwarding
You can forward DHCP traffic from one DHCP server to another under the control of a Network Registrar extension. The DHCP forwarding attribute is important in situations where the other server is not one that you manage. This is most likely to occur in environments where multiple vendors supply DHCP services for clients on the same virtual LAN.
The DHCP forwarding attribute works in the following way:
1.
2.
–
–
–
As the DHCP server processes these scripts, it checks the environment dictionary for the following string:
cnr-forward-dhcp-request3.
4.
cnr-request-forward-address-listIt expects a list of comma-separated IP addresses with an optional colon-delimited port number, as in the following example:
192.168.168.15:1025,192.168.169.20:1027By default, the server forwards to port 67. It sends a copy of the entire client request to each IP address and port in turn. If any element in the list is invalid, the server stops trying to parse the list.
5.
The following example of a portion of a TCL extension script tells the DHCP server to forward a request to another server based on the information in the request. You can use such a script if there are multiple device provisioning systems in the same environment. In this case, you would run the extension script on the DHCP server to which routers forward broadcast requests. The script would determine which (if any) other server or servers should handle the request, and tell the original server to forward the request.
The sample script uses a static mapping of MAC address prefix to send modems from a specific vendor to a specific system.
proc postPktDecode {req resp env} {set mac [$req get chaddr]set addrs "";# Very simple, static classifier that forwards all requests from devices;# with a vendor-id of 01:0c:10 to the DHCP servers at 10.1.2.3 and 10.2.2.3:switch -glob -- $mac {01:0c:10* {set addrs "10.1.2.3,10.2.2.3"}};# If we decide to forward the packet, the $addrs var will have the IP addresses;# where to forward the packet:if {$addrs != ""} {;# Tell the DHCP server to forward the packet...$env put cnr-forward-dhcp-request true;# ...and where to forward it:$env put cnr-request-forward-address-list $addrs;# No more processing is required.return}}A more flexible script could use a per-client configuration object, such as the Network Registrar client entry, to indicate which DHCP server should get the request. See also the "extension" section.
Troubleshooting MAC Addresses
As an additional aid to troubleshooting your configuration, you can use the example extension, dextrace, distributed on the Network Registrar CD-ROM. It looks for a particular MAC address in every input packet. When it finds that MAC address, it enables packet sniffing for just that input and any corresponding output packet. You can configure this extension using the CLI; the configuration commands are in the example source file for dexextension.c. This extension places only a very small load on the server and is suitable for long-term use when trying to diagnose a DHCP problem in which a troublesome MAC address is known, but it is not possible (or perhaps not convenient) to manually stimulate that DHCP client directly to find the problem.
Enabling SMS Network Discovery
To enable SMS network discovery and specify the site code of the SMS server as "aic," enter these commands:
nrcmd> dhcp set sms-network-discovery 1nrcmd> dhcp set sms-site-code aicnrcmd> dhcp reloadnrcmd> dhcp updateSmsRelated Commands
dhcp-interface, lease, policy, scope, server
dhcp-interface
The dhcp-interface command adds, removes, and lists Network Registrar DHCP interfaces.
In Network Registrar, a DHCP interface is a logical representation of the hardware interface (such as a server's Ethernet or Token Ring network interface card) that the DHCP server uses. DHCP interfaces get the name of the address and subnet mask of the physical device they represent. Additionally, Network Registrar uses the interface named default to provide configurable default values for interfaces that the DHCP server discovers automatically. If you delete the default interface, the DHCP server uses hardcoded default values for port numbers and socket buffer sizes for the interfaces that it autodiscovers.
dhcp-interface ipaddress/maskbits create
dhcp-interface {ipaddress/maskbits | default} delete
dhcp-interface ipaddress/maskbits set {mask=value | ignore=true | false}
dhcp-interface {ipaddress/maskbits | default} get {addr | mask | ignore}
dhcp-interface {ipaddress/maskbits | default} [show]
dhcp-interface list
dhcp-interface listnames
Syntax Description
dhcp-interface ipaddress/maskbits create [attribute=value...]
Creates a DHCP interface specification named by the IP address and network prefix bits of the physical interface. You can specify the mask bits as 24 (for a 24-bit network, such as a 255.255.255.0 netmask) or 16 (for a 16-bit network, such as a 255.255.0.0 netmask).
dhcp-interface {ipaddress/maskbits | default} delete
Deletes a DHCP interface. If you delete the default interface, the DHCP server uses hardcoded default values for port numbers, and socket buffer sizes for the interfaces that it autodiscovers.
nrcmd> dhcp-interface 10.1.2.3/24 deletedhcp-interface ipaddress/maskbits set {mask=value | ignore=true | false}
Sets the subnet mask or ignore attribute, or both.
The ignore attribute enables or disables the server to ignore this interface, which might be the case if you had several interfaces. You can disable to temporarily disable a specific interface in a list. To change the interface address, delete and recreate the interface. Optional, no default.
nrcmd> dhcp-interface 10.1.2.3/24 set ignore=truedhcp-interface {ipaddress/maskbits | default} get {addr | mask | ignore}
Gets the value of an attribute for the DHCP interface.
dhcp-interface {ipaddress/maskbits | default} [show]
Shows the values of all attributes assigned to the DHCP interface.
nrcmd> dhcp-interface 10.1.2.3/24 showdhcp-interface list
Lists all DHCP interfaces and any attributes assigned to them. See the "Listing DHCP Interfaces" section.
dhcp-interface listnames
Lists just the DHCP interface names.
Usage Guidelines
Listing DHCP Interfaces
You can list the interfaces to provide either an explicit list of interfaces that the DHCP server should listen on, or an explicit list of interfaces that the DHCP server should not listen on.
•
•
Related Commands
dns
The dns command sets and enables or disables DNS server attributes. Note that in Network Registrar there is only one DNS server per cluster, hence you do not need to reference the server by name.
dns enable attribute
dns disable attribute
dns set attribute=value [attribute=value...]
dns unset attribute
dns get attribute
dns [show]
dns addRootHint name ipaddress [ipaddress...]
dns removeRootHint name
dns listRootHints
dns addException name ipaddress [ipaddress...]
dns removeException name
dns listExceptions
dns addForwarder ipaddress [ipaddress...]
dns removeForwarder ipaddress
dns listForwarders
dns flushCache
dns rebuildRR-Indexes
dns forceXfer secondary
dns scavenge
Note
Syntax Description
See Table 2-8 for a list of the dns command attribute descriptions.
dns enable attribute
Enables a DNS server attribute.
dns disable attribute
Disables a DNS server attribute, such as to disable NOTIFY for all the zones.
nrcmd> dns disable notifydns set attribute=value [attribute=value...]
Sets one or more attributes of the DNS server.
dns unset attribute
Unsets the value of a DNS attribute.
dns get attribute
Gets the value of an attribute for the DNS server.
dns [show]
Shows all the DNS server attributes.
dns addRootHint name ipaddress [ipaddress...]
Adds the named root server at a specific IP address using the root hint method. After you specify these servers, Network Registrar queries them for their root name server records that resolve other names. These values need not be exact, but should be accurate enough for the DNS server to retrieve the correct information.
nrcmd> dns addRootHint a.root-servers.net 198.41.0.4dns removeRootHint name
Removes a root name server.
nrcmd> dns removeRootHint a.root-servers.netdns listRootHints
Lists a root name server.
dns addException name ipaddress [ipaddress...]
Adds an exception server at a specific IP address. See the "Resolution Exception Domain" section.
nrcmd> dns addException blue.com. 192.168.1.4dns removeException name
Removes an exception server.
dns listExceptions
Lists all the exception name servers.
dns addForwarder ipaddress [ipaddress...]
Adds the IP address of any name servers that you want your Network Registrar DNS server to use as forwarders. Network Registrar forwards recursive queries to these servers before forwarding queries to the Internet-at-large. Note that you can use the exception method to override forwarding for specific domains.
nrcmd> dns addForwarder 192.168.1.4dns removeForwarder ipaddress
Removes a forwarder server at the IP address.
dns listForwarders
Lists all the forwarder servers.
dns flushCache
Flushes the cache file to stop it from growing. The behavior depends on whether your DNS server is running or stopped. See the "Flushing the Cache" section.
dns rebuildRR-Indexes
Rebuilds the resource records indexes. See the "Rebuilding Resource Records Indexes" section.
dns forceXfer secondary
Forces full zone transfers for every secondary zone, regardless of the SOA serial numbers, to synchronize DNS data store. If a normal zone transfer is already in progress, the command schedules a full zone transfer for that zone immediately after the normal zone transfer finishes.
dns scavenge
Causes scavenging on all zones that have enabled the scvg-enabled attribute.
Attributes
Table 2-8 describes the dns command attributes and their values and defaults, if any.
Table 2-8 dns Command Attributes
checkpoint-interval
set=
get
unsetInterval (in seconds) at which to checkpoint zones (take the latest snapshot in the zone checkpoint database). The zone checkpoint interval overrides anything set at this level for a particular zone. See the "Logging Checkpoint Files and Scavenging" section. Required, range 3600-604800 seconds (1-168 hours), default 19800 seconds or three hours.
fake-ip-name-
responseenable
disableControls whether the server, if queried for a domain name that resembles an IP address (for example, an A record like 192.168.40.40), automatically responds with a NXDOMAIN status without even trying to query (or forward to) other servers. See the "Handling Rogue Address Records" section. Required, default enable.
hide-subzones
enable
disableCauses the server to provide recursion even when queried without recursion. Do not use on servers queried for nonauthoritative data.
ixfr-enable
enable
disableControls the incremental transfer behavior for zones for which you did not configure a specific behavior. If incremental transfer is enabled, then you must also set the value of the ixfr-expire-interval attribute or accept the default value. Required, default enable.
ixfr-expire-interval
set=
getLongest interval to maintain a secondary zone solely with incremental transfers. After this period, the server requests a full zone transfer. Required, default 604800 seconds (7 days), range 0 through 2147483647 seconds.
lame-deleg-notify
enable
disableControls whether you want Network Registrar to log when a DNS server listed in a parent zone's delegation of subzones does not know that it is authoritative for the zone. Required, default disable.
local-port-num
set=
getUDP and TCP port number on which the DNS server listens for queries. Required, default port 53, range 1 through 65535.
log-settings
set=
getDetermines which events to log, as set using a bit mask. See Table 2-9. Logging additional details about events can help analyze a problem. However, leaving detailed logging enabled for a long period can fill the log files. Required, default is all settings except scavenge-detailed.
max-cache-ttl
set=
getMaximum amount of time to retain cached data. Required, default 604800 seconds (7 days), range 0 through 2147483647 seconds.
mem-cache-size
set=
getSize of the in-memory record cache, in kilobytes. Required, default 200 KB, range 1 through 4194303 KB.
neg-cache-ttl
set=
getHow long to cache information learned from other name servers about nonexistent names or data, in seconds. Required, default 600 seconds (10 minutes), range 0 through 2147483647 ms.
no-fetch-glue
enable
disableControls whether you want the DNS server, when composing a response to a query, to fetch missing glue records. Glue records are A records with the address of a domain's authoritative name server. Normal DNS responses include NS records and their A records related to the name being queried. Required, default disable.
no-recurse
enable
disableControls whether you want to disable forwarding client queries to other name servers when your DNS server is not authoritative for data being queried. If you enable no-recurse queries, you make your name server a noncaching server. Required, default disable.
notify
enable
disableControls sending notification for zones for which you did not configure a specific behavior. See the "NOTIFY" section. You must also set the other notify-xxx attributes or accept their defaults. Required, default enable.
notify-defer-cnt
set=
getWith NOTIFY enabled, the maximum number of UPDATE changes to accumulate during the notify-wait period. If this number is exceeded, Network Registrar sends notification before the notify-wait period passes. Required, default 100 changes.
notify-min-interval
set=
getWith NOTIFY enabled, the minimum interval required before sending notification of consecutive changes on the same zone to a particular server. Required, default 2 seconds, range 0 through 2147483647 seconds.
notify-rcv-interval
set=
getWith NOTIFY enabled, for secondary zones, the minimum amount of time between the completion of processing of one notification (serial number testing or zone transfer) and the start of processing of another notification. Required, default 5 seconds, range 0 through 2147483647 seconds.
notify-send-stagger
set=
getWith NOTIFY enabled, the interval to stagger notification of multiple servers of a particular change. Required, default 1 second, range 0 through 2147483647 seconds.
notify-wait
set=
getWith NOTIFY enabled, the period of time to delay, after an initial zone change, before sending change notification to other name servers. Use this attribute to accumulate multiple changes. Required, default 5 seconds, range 0 through 2147483647 seconds.
remote-port-num
set=
getUDP and TCP port to which the DNS server sends queries to other servers. Required, default port 53, range 1 through 65535.
round-robin
enable
disableControls whether to round-robin equivalent records in responses to queries. Equivalent records are records of the same name and type. Because clients often only look at the first record of a set, enabling this attribute can help balance loads and keep clients from forever trying to talk to an out-of-service host. Required, default enable.
save-negative-
cache-entriesenable
disableControls whether to have the server store negative-query-results cache entries in its cache.db file. If disabled, the server discards negative cache entries evicted from the in-memory cache instead of storing them in the cache.db file. See the "Handling Rogue Address Records" section. Required, default enable.
scvg-ignore-
restarts-intervalset=
getInterval, in seconds, for which a server restart does not recalculate a start scavenging time. Required, default 7200 seconds (two hours).
scvg-interval
set=
getWith scavenging enabled, the interval, in seconds, at which the zone is scheduled for scavenging. The zone setting of the same attribute overrides this setting. See the "Logging Checkpoint Files and Scavenging" section. Range 3600 (one hour) through 31536000 seconds. Required, default 604800 seconds (seven days).
scvg-no-refresh-
intervalset=
getWith scavenging enabled, the interval, in seconds, during which actions, such as dynamic updates, do not refresh the timestamp on a record. The zone setting of the same attribute overrides this setting. Range 3600 (one hour) through 31536000 seconds. Required, default 604800 seconds (seven days).
scvg-refresh-
intervalset=
getWith scavenging enabled, the interval, in seconds, during which the record can have a timestamp refreshed. The zone setting of the same attribute overrides this setting. Range 3600 (one hour) through 31536000 seconds. Required, default 604800 seconds (seven days).
slave-mode
enable
disableControls whether the server should be a slave server that relies entirely on forwarders for data not in its cache. This attribute has no effect unless you also specify the corresponding forwarders. Note that you can override slave mode for specific domains with the DNS exception method. See the "Resolution Exception Domain" section. Required, default disable.
subnet-sorting
enable
disableControls whether to re-order address records in responses to queries based on the subnet of the client. Because clients often only look at the first record of a set, enabling this attribute can help localize network traffic onto a subnet. This attribute applies only to answers to queries from clients located on the same subnet as the DNS server. Required, default disable (as implemented in BIND 4.9.7).
update-relax-zone-
nameenable
disableControls relaxing of the RFC 2136 restriction on the zone name record in dynamic updates. This attribute allows updates to specify a zone name, which is any name within an authoritative zone, rather than the exact name of the zone. Required, default disable.
DNS Log Settings
Table 2-9 describes the flags you can set with the log-settings attribute, along with their numerical equivalents. All the settings are enabled by default except the scavenge-details setting. If you make changes to the settings, reload and restart the server.
Usage Guidelines
NOTIFY
Using NOTIFY, a Network Registrar DNS master server can inform its slave servers that changes occurred to its zone. It does not communicate the changes themselves in the NOTIFY packet. Instead, the slave servers respond with a zone transfer request.
Because a master server for a zone does not know specifically which slave servers transfer from it, Network Registrar notifies all registered name servers for the zone (name servers listed in the NS Resource Records) when the zone changes. The sole exception to this policy is that Network Registrar does not notify the server named in the SOA mname field (the primary master). For more information about NOTIFY, see RFC 1996.
You can use IXFR and NOTIFY together, but this is not necessary. You can disable NOTIFY for a quickly changing zone for which immediate updates on all secondaries does not warrant the constant NOTIFY traffic. Such a zone might benefit from having a short refresh time and a disabled NOTIFY. For example:
nrcmd> zone example.com set refresh=30mnrcmd> zone example.com disable notifyFor more information about setting zone attributes, see the "zone" section.
Resolution Exception Domain
Use the dns addException name ipaddress [ipaddress...] command only if you do not want your DNS server to use the standard name resolution for names outside the local authoritative zone. The exception method allows you to specify the resolution exception domains and the associated servers' IP addresses.
The resolution exception covers subzone delegations. If the global forwarding is set and a subzone is in the resolution exception list, the query for that subzone goes to the name server that appears in the exception list and not to the forwarder. To achieve subzone queries, both the subzone delegation and the resolution exception must be defined.
Note
For example, the sample company, example.com, has four subsidiaries—red, blue, yellow, and green. Each of them has its own domain in the .com domain. However, when users at red.com. want to use resources at blue.com., their DNS server knows that it is not authoritative for blue.com., and thus attempts to locate blue.com. by asking the root name servers.
To use exception handling, the administrator at red.com.configures exceptions for all the domains that require special resolution handling, and at least one corresponding name server for each. In this case, the administrator would list the three other domains for the example.com company.
To remove an exception, use the dns removeException name command. To replace the server address to which the extension points, remove the extension and re-add it. You must also stop the DNS server, flush the cache, and restart the server. See the following "Flushing the Cache" section.
Flushing the Cache
Use the dns flushCache command to stop the disk cache file from growing, but the actual behavior depends on whether your DNS server is running or stopped.
•
•
To clear a cache that grew too large, or when changing a resolution exception, stop the server, enter the command, and restart the server. Stopping the server does not terminate the server process, but stops it from handling further requests. For details on resolution exception, see the "Resolution Exception Domain" section.
Rebuilding Resource Records Indexes
Use the dns rebuildRR-Indexes command if you need to rebuild the resource records indexes used by the user interface. For example, if you observe inconsistent resource or host list data or missing data, then rebuild the resource record indexes. Rebuilding the resource record indexes should correct any inconsistencies that the user interface displays. It may not correct inconsistencies that the command line interface displays. This index rebuild does not affect the DNS server, except that Network Registrar removes duplicate records detected during the process.
Note
101 Ok, with warnings
Error Protocol Error removing record for name host_name, zone zone_name
while loading config changes.
This warning is normal and you can safely ignore it.Handling Rogue Address Records
You may become victim of a suspicious denial-of-service attack where a rogue host targets Address (A) resource record queries to a caching DNS server. These queries are for names that resemble IP addresses. To avoid overloading the DNS server's CACHE.db file with negative responses from the root, the server will not try to resolve these queries. The fake-ip-name-response DNS attribute is enabled by default to affect this. When the server receives a query (for a nonauthoritative name), it consults its in-memory cache and, if it cannot resolve the query there, queries its cache.db file. If the server cannot resolve the query in either place, it examines the queried name and, if that resembles an IP address (four octets, each separated by a dot with no trailing or preceding characters), does not forward the query. Instead, the server responds with a NXDOMAIN status and does not include the negative response in its caches.
Another control over having the CACHE.db fill with negative entries is the save-negative-cache-entries attribute. The server acts on the save-negative-cache-entries attribute when it saves entries from in-memory cache to the cache.db file. It typically saves positive and negative query responses from in-memory cache when that cache is full and the server needs to make room for a new entry—the server evicts the least-recently-used entry. If you disable save-negative-cache-entries, the server does not store evicted negative entries in the cache.db file; the server simply discards them.
Related Commands
exit
The exit command writes all unsaved changes to the database and then terminates the current nrcmd session. If Network Registrar cannot save your changes, it displays an error code. See the "save" section for descriptions of save error messages.
To quit the Network Registrar command line interface while in interactive mode, enter:
nrcmd> exitRelated Commands
export
The export command exports Network Registrar DHCP and DNS server information.
export addresses file=CSV-text-file
[namespace=name]
[config=config-file]
[dhcp-only]
[time-ascii | time-numeric]export addresses database=db-name user=username password=password [table=name]
[namespace=name]
[config=config-file]
[dhcp-only]
[time-ascii | time-numeric]export hostfile [file]
export leases {-client | -server}
[-namespace name]
[-time-ascii | -time-numeric] fileexport zone name {static | dynamic | both} file
export zonenames {forward | reverse | both} file
Syntax Description
export addresses file=CSV-text-file [namespace=name] [config=config-file] [dhcp-only]
[time-ascii | time-numeric]Exports all active IP addresses into a comma-separated value (CSV) text file, if specified. If you omit the file, it writes the output in CSV format to the standard output. See the "Specifying Clusters for the export addresses Command" section. For the namespace usage, see the "Specifying a Namespace on Export" section.
export addresses database=db-name user=username password=password [table=name]
[namespace=name] [config=config-file] [dhcp-only]
[time-ascii | time-numeric]Exports all active IP addresses into a database table. See the "Database Output Format of the export addresses Command" section. For the namespace usage, see the "Specifying a Namespace on Export" section.
export hostfile [file]
Creates a host file, in UNIX host file format, from all the zones in the server, ignoring reverse zones. It creates hostfile records from A records, CNAME records, and HINFO records. Each host file record consists of the IP address, FQDN, aliases created from the A and CNAME records, and comments created from HINFO records.
export leases {-client | -server} [-namespace name] [-time-ascii | -time-numeric] file
Writes the state of all the current leases to the output file. The export leases -client command writes out the lease time as a string in the month, day, time, year format, such as Apr 15 16:35:48 2002.
nrcmd> export leases -client leaseout.txtThe export leases -server command writes out the state of all current and expired leases to the DHCP server's log directory using the output file that you specify. It writes lease times as integers representing the number of seconds since midnight GMT Jan 1, 1970, for example, 903968580.
nrcmd> export leases -server leaseout.txtThe file is either the name of the output file or a dash (-) for the standard output for client-side exports. You cannot use the dash with the -server keyword. In addition, the server-side export does not permit any nonalphanumeric character such as a dot (.) in filenames. See the "Considerations of the export leases Command" section. For the syntax of the entries in the output file, see the Network Registrar User's Guide.
For the namespace usage, see the "Specifying a Namespace on Export" section.
export zone name {static | dynamic | both} file
Writes the specified DNS zone into a file in the BIND format, where name is the domain whose data you want to write to a file. The following example exports the contents of the example.com domain to the hosts.local file.
nrcmd> export zone example.com. static hosts.localexport zonenames {forward | reverse | both} file
Exports just the zone names for a particular zone type—forward, reverse, or both—to a file.
Usage Guidelines
Specifying Clusters for the export addresses Command
The export addresses command exports all active IP addresses into a specified database or CSV text file. You can determine which clusters the command pertains to in many ways. Network Registrar follows a precedence order, as follows. Any of the specific cluster specifications can override the default specification or previous specification.
•
•
•
•
Cluster information for export addresses[export addresses]clusters=machine1 username password, machine2 username password [...]clusters=host1 admin, host2, host3 admin3 passwd3Separate cluster specifications with commas. Within each cluster specification, separate the three arguments with spaces. For long lines you can use continuation lines. You can embed carriage returns; you do not need to use continuation escape indicators.
You can optionally specify a username and password for the cluster. If you omit a username or password for a particular cluster, Network Registrar uses the last username or password listed. If you omit usernames or passwords, Network Registrar uses the information from the command line -N and -P arguments, and then the Windows Registry or environment variables AIC_NAME and AIC_PASSWORD. See the "Invoking the nrcmd Command" section on page 1-1.
If Network Registrar cannot find a username or password or the supplied username and password are incorrect, the command issues a warning for that cluster.
Specifying a Namespace on Export
The output of the export command can include the namespace specification. The value can be any valid, predefined namespace name, or the reserved words global and all. Global indicates all addresses not in any of the defined namespaces. All indicates all namespaces, including the global one. If you omit the namespace, the current one applies, as set by the session set current-namespace command. If the current namespace is undefined, the global namespace applies. Network Registrar adds the ID of the namespace at the end of each output line in the export file.
Command Keywords for the export addresses Command
Use the following conventions for export addresses keywords.
•
Each line of the configuration file must begin with the character # (comment), a section header enclosed in square brackets, or a parameter=value pair or its continuation. For example:
[export addresses]clusters=machine1 username password, machine2 username password [...]Network Registrar strips leading white space from each line and ignores blank lines.
•
•
•
Error Reports for the export addresses Command
The export addresses command attempts to establish communication with the clusters you specify. It reports an error in the following cases:
•
•
•
Note
Database Output Format of the export addresses Command
The export addresses command writes the database output to the ip_addresses table or to the specified table name. Table 2-10 shows the columns in the ip_addresses table.
If the target database does not support the data type of a field, the export command replaces it with a text (varchar) field as listed in Table 2-11. Column names that exceed the target database's supported maximum name width get truncated to the allowable width.
Text File Output Format of the export addresses Command
If you specify writing the output to a CSV text file, the export addresses command writes each line in the file as one row in the database. The export addresses command outputs each field to the text file in the order listed in Table 2-10. The first line in the file is not a table row, but instead contains a hash (#) symbol followed by the text of each of the column names separated by commas. The command handles all fields that require text substitution as the previous section describes.
Note
Addresses Reported by the export addresses Command
The export addresses command reports every address configured in every server that is specified in the configuration file. This includes addresses specified in DHCP scope ranges, DNS static addresses, and explicitly reserved addresses both for DNS and DHCP servers. However, unused (unallocated and unreserved) addresses in DHCP scope ranges do not appear in the table.
The report displays multiple entries for an address if the address is served by more than one server, is in more than one scope, or has multiple DNS names. Thus, you cannot use a unique column as a key, but you can generate a unique key from a set of columns such as ip_address, type, cluster_name, scope_pool_name, or dns_name.
Considerations of the export leases Command
When you use the export leases -client command, Network Registrar reads the database. If the servers are running, executing this command may affect system performance.
When you use the export leases -server command, Network Registrar does not read the database, so it is significantly faster. You can execute the command only if the server is running. Because the server is doing some extra work while it is building the export file, it may slow down somewhat. However, the time involved is usually so short that you may not notice the performance impact.
Related Commands
extension
The extension command configures and integrates user-written DHCP extensions into the DHCP server.
extension name create language file entry [init-args=value init-entry=value]
extension name delete
extension name set attribute=value [attribute=value...]
extension name unset attribute
extension name get attribute
extension name [show]
extension list
extension listnames
Note
Syntax Description
See Table 2-12 for the extension command attribute descriptions.
extension name create language file entry [init-args=value init-entry=value]
Creates a client and optionally assigns initial entry point attributes. The command line attributes are:
•
•
•
•
The following example configures an extension named ext1 using the Tcl file tclfile1.tcl having the entry mytclentry.
nrcmd> extension ext1 create Tcl tclfile1.tcl mytclentryextension name delete
Deletes an extension.
extension name set attribute=value [attribute=value...]
Sets one or more attributes for the extension.
extension name unset attribute
Unsets the value of an extension attribute.
extension name get attribute
Gets the value of an attribute for the extension.
extension name [show]
Shows the values of all attributes assigned to the extension identified by name.
extension list
Lists all extensions and any attributes assigned to them.
extension listnames
Lists just the extension names.
Attributes
Table 2-12 describes the extension command attributes and their values and defaults, if any.
Table 2-12 extension Command Attributes
entry
set=
getName of the entry point for the module. This function is called from any extension point to which this module is bound. Required, no default.
file
set=
get
unsetFilename relative to the directory extensions in the installation, or as an absolute pathname, but cannot contain a sequence of two dots (..). Required, no default.
init-args
set=
get
unsetArguments to pass to the init-entry point function. See Chapter 4, "Using Extension Points." Optional, no default.
init-entry
set=
get
unsetName of the init-entry point. If you set it, Network Registrar calls this function when the server loads the module and when the server shuts down. See Chapter 4, "Using Extension Points." Optional, no default.
lang
set=
getLanguage in which the extension or module is implemented:
•
•
Required, no default.
Usage Guidelines
To extend the DHCP server, do the following:
Step 1
•
For C or C++ this is /opt/nwreg2/extensions/DHCP/dex•
For C or C++ this is \program files\network registrar\extensions\dhcp\dexIt is best to place these extensions in the appropriate directory for TCL or C/C++ extensions. Then, when configuring the filename, just enter the filename itself, without slash (/) or backslash (\).
If you want to place extensions in subdirectories, enter the filename with a path separator. These are different depending on the operating system on which your DHCP server is running.
Note
Step 2
Step 3
Step 4
Related Commands
force-lock
When you execute a nrcmd command, it tries to get an exclusive lock for the cluster to which it is connected. If it cannot get an exclusive lock, it displays a warning.
Without an exclusive lock, you can issue only these commands:
•
•
•
•
•
Caution
If you use the force-lock command to unlock a cluster, the command writes the warning to the log file on the client machine, not on the cluster.
To force an exclusive lock, enter:
nrcmd> force-lockhelp
The help command displays the nrcmd program online help.
help
help command [section...]
Syntax Description
help
If you enter the help command without any arguments, Network Registrar displays a list of all the commands.
help command [section...]
If you specify the help command with a command name, Network Registrar displays the help page for the command of that name. Optionally, you can use the section attribute to limit the response to a specified section of the command message.
The section names are:
•
•
•
•
•
The following example prints the synopsis section of the help file for the help command.
nrcmd> help help synopsis100 OkSYNOPSIShelphelp <cmd> [<section>...]Usage Guidelines
You can set the screen buffer size and window size to view the entire content of the help item.
import
The import command imports DHCP lease data or a BIND named.boot file into the DNS server configuration.
import leases file
import named.boot file
Syntax Description
import leases file
Imports the leases in the file to the DHCP server. See the "Import File" section. For the namespace usage, see the "Specifying the Namespace on Import" section.
nrcmd> import leases LeaseInimport named.boot file
Imports the BIND 4.x.x named.boot file. This points the server to its database files, such as the /etc/named.boot file on UNIX or Windows. See the "Named.boot File" section.
nrcmd> import named.boot /etc/named.boot
Note
If successful, the import command prints "100 Ok" both before and after Network Registrar imports the file. The first "100 Ok" means that the command is being processed (without rejection because of existing locks, licensing problems, or command syntax errors). The second "100 Ok" indicates that the command successfully completed its processing.Usage Guidelines
Before you can import leases, you must perform several configuration steps:
Step 1
Step 2
Step 3
For all the time fields, use either the number of seconds since midnight GMT January 1, 1970, or day, month, date, time, year format (Mon Apr 15 16:35:48 2002).
Step 4
Note
Import File
The client is given the lesser of the lease times:
•
•
For example, it is 2:00 p.m. and your scope is configured for a one-hour lease. According to the file that you import, the lease time does not expire until 5:00 p.m. After you import the file, the lease expires at 3:00 p.m. and not at 5:00 p.m.
If your import file specifies a DNS zone name, the server does not use the zone name when it updates DNS. If the file specifies a hostname, then the server uses the hostname when updating DNS, unless the hostname was overridden by a host-name specification in a client or client-class entry.
The only way to indicate to the DHCP server that the client's hostname should be in a zone other than the default associated with the scope is to specify that zone in a client or client-class entry.
Specifying the Namespace on Import
You can specify the namespace for imported leases at the end of each lease entry in the import file. The namespace must be predefined. See the "namespace" section. All leases without explicit namespace entries are assigned to the current (or global) namespace.
Named.boot File
BIND 4.x.x uses a boot file, called named.boot, to point the server to its database files. You can import your entire BIND 4.x.x configuration using the import command.
When a BIND file contains an $INCLUDE directive, BIND searches for the include file relative to the directory that the directory directive in the named.boot file specifies. In contrast, the nrcmd program searches for the include file relative to the directory containing the zone file being processed.
To avoid this problem, ensure that the BIND configuration uses absolute paths whenever specifying an include file in a zone file. If your zone files contain relative paths when specifying include files, and the directory containing the zone file is not the same as the directory that the directory directive in the named.boot file specifies, your configuration cannot load properly. You need to convert the relative paths in your zone files to absolute paths so that you can import your BIND configuration into Network Registrar. Here is an example of a configuration and how to fix paths in directory hierarchy, configuration files, and zone files:
•
/etc/named.boot/usr/local/domain/primary/db.example/usr/local/domain/primary/db.include/usr/local/domain/secondary•
#BIND searches for zone files and include files relative to /usr/local/domaindirectory /usr/local/domain#BIND finds zone file in /usr/local/domain/primaryprimary example.com primary/db.exampleend of /etc/named.boot•
#BIND searches for include file relative to /usr/local/domain$INCLUDE primary/db.include#end of /usr/local/domain/primary/db.exampleTo make the configuration loadable, change the relative path ($INCLUDE primary/db.include) in the file db.example to an absolute path ($INCLUDE /usr/local/domain/primary/db.include).
Mapping BIND 4 Boot File Directives to nrcmd
Table 2-13 describes the named.boot file directives that the BIND 4.9.6 distribution supports and the corresponding nrcmd command syntax that is generated. Network Registrar marks the directives it does not support with the word Unsupported, and marks the ones that require no action with the word None.
Related Commands
ldap
The ldap command associates remote Lightweight Directory Access Protocol (LDAP) servers with Network Registrar and sets their attributes.
ldap server create hostname [attribute=value...]
ldap server delete
ldap server enable attribute
ldap server disable attribute
ldap server set attribute=value [attribute=value...]
ldap server unset attribute
ldap server get attribute
ldap server setEntry dictionary-attribute-key=value
ldap server unsetEntry dictionary-attribute-key
ldap server getEntry dictionary-attribute-key=value
ldap server [show]
ldap list
ldap listnames
Syntax Description
See Table 2-14 for the ldap command attributes and their descriptions.
ldap server create hostname [attribute=value...]
Creates a name entry for the LDAP server at the hostname (and optionally assigns values to its attributes). The following example creates the LDAP server object myserver with a hostname of myserver.mycompany.com.
nrcmd> ldap myserver create myserver.mycompany.comldap server delete
Deletes the entry for an LDAP server.
nrcmd> ldap myserver deleteldap server enable attribute
Enables an LDAP server attribute. After you enable an attribute, you can set its values.
ldap server disable attribute
Disables an LDAP attribute.
ldap server set attribute=value [attribute=value...]
Sets one or more attributes for the LDAP server.
ldap server unset attribute
Unsets the value of an LDAP attribute.
ldap server get attribute
Displays the value of an attribute of the LDAP server.
ldap server setEntry dictionary-attribute-key=value
Use the setEntry, getEntry, and unsetEntry commands to set, query, and clear elements of the various dictionary properties in the LDAP server configuration. These dictionary properties provide a convenient mapping from string keys to string values. The dictionary values are as follows. See also the "Dictionary Examples" section:
create-dictionary—Maps LDAP attributes to dhcp lease attributes. If an entry does not exist, this sets entries in this dictionary to the value of its corresponding DHCP lease attribute. Optional, no default.
create-string-dictionary—Maps LDAP attributes to user specified strings. If an entry does not exist, this sets entries in this dictionary to the matching string. Optional, no default. See the "Using the create-string-dictionary Attribute" section.
env-dictionary—The server can retrieve additional LDAP attributes along with client-entry attributes. If any of these are in a query's results, their values are made available to scripts through the request's environment dictionary. This keys the LDAP value by the value in the query env-dictionary. Optional, no default.
query-dictionary—Mapping between the names of LDAP attributes and DHCP attributes. The server tries to retrieve all the LDAP attributes specified in the dictionary. When a query succeeds, the server sets the values for any LDAP attributes that it returns in the corresponding client-entry attribute. Optional, no default.
This attribute also controls the mapping of an LDAP attribute name to the embedded policy. The LDAP attribute name associated with the embedded-policy value is used to create an embedded policy. If the server finds the particular LDAP attribute name, it decodes the attribute data as if it were an encoding of the client-embedded policy. For details about LDAP configuration, see the Network Registrar User's Guide.
update-dictionary—Maps LDAP attributes to DHCP lease attributes. When an LDAP object is modified, each LDAP attribute present in this dictionary is set to the value of its corresponding DHCP lease attribute. Optional, no default.
ldap server unsetEntry dictionary-attribute-key
Unsets the value of a dictionary attribute. See the setEntry syntax description and the "Dictionary Examples" section.
ldap server getEntry dictionary-attribute-key=value
Retrieves information from various dictionaries in the LDAP server configuration. See the setEntry syntax description and the "Dictionary Examples" section.
ldap server [show]
Shows the values of the attributes of the named LDAP server.
ldap list
Lists the names of the remote LDAP servers and any attributes assigned to them.
ldap listnames
Lists just the names of the remote LDAP servers.
Attributes
Table 2-14 describes the ldap command attributes and their values and defaults, if any.
Usage Guidelines
Dictionary Examples
Configure a query-dictionary to search for the surname (sn) and use its data to specify the client's DHCP hostname.
nrcmd> ldap ldapserver setEntry query-dictionary sn=host-nameConfigure a query-dictionary to search for the first name (givenname) to use for the specific client-class name:
nrcmd> ldap ldapserver setEntry query-dictionary givenname=client-class-nameConfigure a query-dictionary to search for the locality name to use for the domain name:
nrcmd> ldap ldapserver setEntry query-dictionary localityname=domain-nameCreate a string-dictionary with an attribute named myattribute assigned to a string named my string:
nrcmd> ldap ldapserver setEntry create-string-dictionary myattribute="my string"Using the create-string-dictionary Attribute
The dictionary associated with the create-string-dictionary attribute can contain multiple pairs of LDAP attributes. Each pair is set using a separate setEntry keyword. The following examples assign different string values to the attributes givenname and carlicense.
nrcmd> ldap ldapserver setEntry create-string-dictionary givenname=abcdefgnrcmd> ldap ldapserver setEntry create-string-dictionary carlicense=123-456
Note
Related Commands
lease
Use the lease command to view and manipulate the current DHCP leases in the cluster. All lease command attributes are read-only, and all actions take effect immediately. The ipaddress value can be a simple IP address or can include the namespace, in the syntax namespacename/ipaddress. See the "namespace" section. You do not need to reload the server with this command.
lease ipaddress activate
lease ipaddress deactivate
lease ipaddress send-reservation
lease ipaddress delete-reservation
lease ipaddress force-available
lease ipaddress get-scope-name
lease ipaddress macaddr
lease ipaddress get attribute
lease ipaddress [show]
lease list
lease list -lansegment ipaddress mask
lease list -macaddr macaddress
lease list -subnet ipaddress mask
Syntax Description
See Table 2-15 for the lease command attribute descriptions.
lease ipaddress activate
Activates a lease, but does not change the state of a lease marked as unavailable. The ipaddress value can include the address' namespace, in the following slash-separated format:
namespacename/ipaddress
If there is no namespace prefix for the address, the value set by the session set current-namespace applies. See the "session" section, or the global namespace if the current namespace is not set.
nrcmd> lease 192.168.1.9 activatelease ipaddress deactivate
De-activates a lease from being given out or renewed, but does not change the state of the lease.
lease ipaddress send-reservation
Sends an existing reservation to the server immediately without having to reload the server. Use this keyword in conjunction with the scope name addReservation command.
lease ipaddress delete-reservation
Deletes an existing reservation from the DHCP server immediately without requiring a server reload. To delete the lease from the internal nrcmd database, follow this command with the scope name removeReservation command.
lease ipaddress force-available
Makes a currently held lease available, even a lease marked as unavailable. Because using the force-available action may compromise the integrity of your IP address allocations, ensure that, before you use the keyword, the client holding the lease stopped using the lease.
lease ipaddress get-scope-name
Shows the scope to which a lease belongs.
lease ipaddress macaddr
Shows the most recent MAC address associated with a lease. If no MAC address was ever associated with this lease (or if the lease became unavailable), then Network Registrar displays the error message, "302 Not Found."
lease ipaddress get attribute
Gets the value of an attribute for a lease.
lease ipaddress [show]
Shows the lease attributes for a specific address.
lease list
Lists all the leases in all namespaces. Note that there is no namespace modifier for this command.
lease list -lansegment ipaddress mask
Lists all leases in a LAN segment, including all leases in primary scopes for the address and mask. It also includes all leases in secondary scopes whose primary scope matches the address and mask.
lease list -macaddr macaddress
Lists all leases associated with the specified MAC address. Examples of acceptable formats for the MAC address are:
•
•
•
lease list -subnet ipaddress mask
Lists all leases in a subnet for the network address and mask.
Attributes
Table 2-15 describes the lease command attributes and their values. They are all read-only attributes.
Table 2-15 lease Command Attributes
address
get
IP address of the lease.
client-binary-client-
idget
Binary form of the client's MAC address, if any.
client-dns-name
get
The DHCP server attempted (possibly successfully) to enter this name into the DNS server for this client. It is related to the client-host-name, but may not be identical due to name collisions in the DNS server database.
client-domain-name
get
Domain (if any) to which the client's DNS name belongs.
client-flags
get
The client-flags attribute value can be any of the following flags:
•
•
•
•
client-host-name
get
DNS name that the client requested the DHCP server place into the DNS server.
client-id
get
Client ID that the client specifies, or one that the DHCP server for this client synthesizes (if client-id-created-from-mac-address is set in the client-flags).
client-last-
transaction-timeget
Date and time when the client most recently contacted the DHCP server.
client-mac-addr
get
MAC address that the client presented to the DHCP server.
client-os-type
get
Operating system of the leased client. This attribute is used only by the updateSms keyword and has no other purpose. If you enable failover, the main server transmits this value to the backup server. The syntax of this attribute's value is OS-name major.minor.
Other examples are: LANMAN Server, LANMAN Workstation, MAC OS, Microsoft Windows, Microsoft Windows 2000 Professional, Microsoft Windows 95, Microsoft Windows 9x, Microsoft Windows for Workgroups, Microsoft Windows NT Advanced Server, Microsoft Windows NT Server, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0, Netware, and OS/2.
expiration
get
Date and time when the lease expires.
flags
get
Flags for the lease are backup, deactivated, dynamic, or reserved:
•
•
•
•
Flags can also include initialized, valid, and failover-updated.
lease-renewal-time
get
Minimal time in which the client is expected to issue a lease renewal.
namespace-id
get
Identifier for the namespace, if any.
relay-agent-circuit-
idget
Accesses and manipulates the relay-agent circuit id data as stored with a response's lease.
relay-agent-option
get
Contents of the relay agent information option from the most recent client interaction.
relay-agent-remote-
idget
Accesses and manipulates the relay-agent-remote-id data as stored with a response's lease.
relay-agent-server-
id-overrideget
IP address in the server-id-override suboption of the relay agent information option.
relay-agent-subnet-
selectionget
IP address in the subnet selection suboption of the relay agent information option.
relay-agent-vpn-id
get
Contents of the vpn-id suboption of the relay agent information option. For a description of the VPN ID format, see Table 2-17.
start-time-of-state
get
Date and time when the state last changed to its current value. Use this attribute to determine when the lease was made unavailable.
state
get
Current state of the lease. This can be any of the following:
•
•
•
•
•
•
•
•
vendor-class-id
get
Client ID specified by the client.
Usage Guidelines
Using the send-reservation Keyword
When using the send-reservation keyword:
•
•
•
The following example creates a reservation for IP address 192.168.1.9 and adds it to the open cluster's database without reloading the DHCP server.
nrcmd> scope myscope addReservation 192.168.1.9 1,6,00:d0:ba:d3:bd:3bnrcmd> savenrcmd> lease 192.168.1.9 send-reservation
Note
For more information about the scope name addReservation command, see the "scope" section.
Using the delete-reservation Keyword
When using the delete-reservation keyword:
•
•
a.
b.
c.
The following example creates a reservation and sends it to server 192.168.1.9.
nrcmd> lease 192.168.1.9 delete-reservationnrcmd> scope myscope removeReservation 192.168.1.9 1,6,00:d0:ba:d3:bd:3bnrcmd> save
Note
For details about the scope name removeReservation command, see the "scope" section.
Reserving an Address That Is Currently Leased
It is possible to delete a reservation for one client and send a reservation for a second client, even though the first client still has the lease. The following example describes how Network Registrar behaves in this situation.
Assume that you set up a reservation and lease, as follows:
nrcmd> scope my-scope addReservation 192.168.96.180 1,6,00:d0:ba:d3:bd:3bnrcmd> savenrcmd> lease 192.168.96.180 send-reservationnrcmd> lease 192.168.96.180 activatenrcmd> saveClient 1,6,00:d0:ba:d3:bd:3b does a DHCPDISCOVER and gets an offer for 192.168.96.180. The client then does a DHCPREQUEST and gets an ACK message for the same IP address.
As time passes, client 1,6,00:d0:ba:d3:bd:3b does several DHCPREQUESTs that are renewals, which the server acknowledges. Then, at some time prior to the expiration time of the lease by client 1,6,00:d0:ba:d3:bd:3b on 192.168.96.180, you terminate the reservation as follows:
nrcmd> lease 192.168.96.180 de-activatenrcmd> scope my-scope removeReservation 192.168.96.180nrcmd> savenrcmd> lease 192.168.96.180 delete-reservationNext you add a reservation for a different client for that IP address, even though the address is still leased to the first client:
nrcmd> scope my-scope addReservation 192.168.96.180 1,6,02:01:02:01:02:01nrcmd> savenrcmd> lease 192.168.96.180 send-reservationnrcmd> lease 192.168.96.180 activatenrcmd> saveNow you have an IP address that is leased to one client, but reserved for another. If the new client (1,6,02:01:02:01:02:01) does a DHCPDISCOVER prior to the original client (1,6,00:d0:ba:d3:bd:3b) doing a DHCPDISCOVER, it does not get 192.168.96.180. Instead, it receives a random IP address from the dynamic pool.
When the original client (1,6,00:d0:ba:d3:bd:3b) sends its next DHCPREQUEST to renew the lease on 192.168.96.180, it gets a NAK message. Generally, upon receipt of the not-acknowledged message, the client immediately sends a DHCPDISCOVER. On receipt of that DHCPDISCOVER, the DHCP server cancels the remaining lease time on its lease for 192.168.96.180.
After this, the server gives client 1,6,00:d0:ba:d3:bd:3b whatever lease is appropriate for it—some reservation other than 192.168.96.180, some dynamic lease (if one is available), or nothing, if no dynamic leases are available.
When the new client 1,6,02:01:02:01:02:01 does a DHCPDISCOVER, it gets 192.168.96.180.
You could force the availability of a lease, as follows:
nrcmd> lease 192.168.96.180 force-availableHowever, that does not stop the original client (1,6,00:d0:ba:d3:bd:3b) from using 192.168.96.180. Also, it does not prevent the new client (1,6,02:01:02:01:02:01) from getting 192.168.96.180.
In other words, this means that making a reservation for a client is independent of the lease state (and actual lease client) of the IP address for which the reservation is made. This is as true of reservations made by the send-reservation keyword as it is of reservations made solely in nrcmd in the configuration database. Thus, making a reservation for one client does not cause another client to lose that lease right away, although that client receives a NAK response the next time it contacts the DHCP server (which could be seconds or days). Additionally, the client that reserved the IP address does not get it if some other client already has it. Instead, it gets some other IP address until the:
•
•
•
Setting a Lease to Unavailable
While the DHCP server is running, it can set an address to the unavailable state for any of the following three reasons:
•
•
•
If you have reason to believe that the client is sending "bad" server-id options (rather than packets actually directed to other servers), you can prevent addresses from being marked unavailable by enabling the ignore-requests-for-other-servers attribute at the DHCP server level.
nrcmd> dhcp enable ignore-requests-for-other-serversRelated Commands
dhcp, lease-notification, namespace, scope, session
lease-notification
Use the lease-notification command to receive notification about the number of available addresses in a scope. You can specify the notification limit either as the number of free addresses or the percentage of free addresses. You can also specify who should receive e-mail notification.
lease-notification available={number | percentage%}
[config=config file]
[leasing-only]
[recipients=recipient[,recipient] [mail-host=name [errors-to=recipient]]]
[scopes={{scopename | address-range}[,scopename | address-range,....]}]
[namespace=name]Although you can use the lease-notification command interactively, its primary use is as an automated command. See the "Running the lease-notification Command Automatically on UNIX" section or the "Running the lease-notification Command Automatically on Windows" section.
Syntax Description
lease-notification available={number | percentage%}
[config=config file]
[leasing-only]
[recipients=recipient[,recipient] [mail-host=name [errors-to=recipient]]]
[scopes={{scopename | address-range}[,scopename | address-range,...]}]
[namespace=name]Table 2-16 describes the lease-notification keywords. Note that keywords and attributes associated with the recipients and scopes keywords apply only in connection with those keywords. The following example specifies scope 1 with an available value of 10% and e-mail recipients billy, joe, and jane.
nrcmd> lease-notification available=10% scopes=scope1 recipients=billy,joe,jane mail-host=mailhostTo specify the range of scopes 192.68.1.0 to 192.68.1.255, the configuration file .nrNotification, the recipients administrator, an available value of 13 leases, and the Windows mail host as mailhost, enter:
nrcmd> lease-notification scopes=192.68.1.0-192.68.1.255config=/home/bob/.nrNotification recipients=admin@comco.com available=13mail-host=mailhost
Note
Table 2-16 lease-notification Command Keywords
available
Specify either a number or percentage of available addresses. If the number or percentage of available addresses is equal to or less than the specified value for the scopes being checked, Network Registrar generates a report listing information about the scopes that reach or exceed the available value.
config
Specify a configuration file. If you omit a configuration file, Network Registrar searches for the default .nrconfig file. See the "Specifying the Configuration File" section.
errors-to
If you specify a mail-host, you can also specify the e-mail address of the sender of the e-mail to provide a return path for bounced e-mail. The default value is postmaster.
leasing-only
If you specify leasing-only, Network Registrar displays only the scopes that can offer leases. If failover is enabled, this includes scopes for which one of the following conditions applies:
•
•
mail-host
On Windows, you must specify a mail-host.
On UNIX, the mail host is generally already configured for the sendmail program. You can verify that your UNIX system is properly configured by issuing the command
date | mail your-email-address and observing whether or not the date is e-mailed to you. If mail is not configured, you must specify a mail-host.namespace
If you specify a namespace, you can enter the namespace name or the keywords all or global. The all keyword notifies of addresses in all the configured namespaces. The global keyword notifies of all addresses not in any specific namespace.
recipients
If you specify the e-mail addresses of one or more recipients, Network Registrar sends an e-mail report to those addresses. Otherwise, Network Registrar directs the report to standard output.
scopes
Specify the scopes either by their names or as a range or ranges of addresses. Network Registrar checks any scope containing any address that falls within the range of addresses. If you omit any scopes or addresses, Network Registrar checks all scopes that the specified cluster manages.
Usage Guidelines
Running the lease-notification Command Automatically on UNIX
You can run the lease-notification command periodically by means of the cron(1) command by supplying crontab(1) with the command to run. The following example, specified to crontab, runs the lease-notification command at 00:15 and 12:15 (15 minutes after midnight and noon), Monday through Friday.
15 0,12 * * 1-5 . .profile; /opt/nwreg2/usrbin/nrcmd lease-notification available=10\% config=/home/jsmith/.nrconfig addresses=192.32.1.0-192.32.128.0 recipients=jsmith,jdoe@example.com >/dev/null 2>&1You can perform crontab editing by running the UNIX crontab -e command. Set your EDITOR environment variable before running the command, unless you want to use ed(1). See the crontab(1) man page for additional details.
Note that you must supply the nrcmd command's full pathname on the crontab command line. You can determine the full pathname in your environment with the UNIX which nrcmd command.
Also, note that when you run the nrcmd lease-notification command by means of crontab, the server ignores the user environment variables AIC_CLUSTER, AIC_NAME, and AIC_PASSWORD. Because other viewers can view the command being run, do not provide the password through the -P option on the command line, for security reasons.
You should supply the cluster name, user, and password information for the cluster you want the nrcmd command to run from in a .profile or other file in the home directory of the user running crontab -e, as shown in the following example:
AIC_CLUSTER=host1export AIC_CLUSTERAIC_NAME=admin1export AIC_NAMEAIC_PASSWORD=passwd1export AIC_PASSWORDThe . .profile specification in the crontab entry explicitly reads the file. The first dot (.) is the shell command that reads the file and you must follow it with whitespace. For notification on a different cluster, or clusters, than the one on which ncrmd is running, specify the following information:
•
•
You can prevent others from examining or changing the contents of the .profile and the configuration file that you create by changing its permissions with the chmod go-rw config_file UNIX command.
Running the lease-notification Command Automatically on Windows
Use the Scheduled Tasks service available in Windows Explorer under My Computer to schedule the nrcmd lease-notification command. If you do not find a Scheduled Tasks folder under My Computer, you need to add this optional component from Microsoft Internet Explorer 4.0 or later, or use some third-party task scheduler. You can also use the at command to schedule the nrcmd lease-notification command. Put multiple entries into the at queue, one for each time of day at which you want to run the job.
Specifying the Configuration File
If you omit a config file, the lease-notification command looks for a default .nrconfig file in your current directory, then in your home directory, and finally in the AIC_INSTALL_PATH/conf directory. Network Registrar uses the first file it encounters.
Each line of the file must either begin with the character # (comment), a section header enclosed in square brackets, or a parameter=value pair or its continuation. Network Registrar strips leading white space from each line and ignores blank lines.
Specifying Clusters
You can specify clusters in different ways. Network Registrar follows a precedence order:
1.
2.
3.
4.
Cluster information for lease notification[lease-notification]clusters=clustername username password...clusters=host1 admin, host2, host3 admin3 passwd3Separate the three cluster arguments with spaces. For long lines, you can use continuation lines without using escape indicators. You can optionally specify a username and password for the cluster. If you omit a username or password, Network Registrar uses the last one listed. Network Registrar uses the information from the command line -N and -P arguments, and then the Windows Registry or environment variables AIC_NAME and AIC_PASSWORD.
If Network Registrar cannot find a username or password, or the supplied username and password are incorrect, the lease-notification command issues a warning for that cluster.
Related Commands
license
The license command specifies the license key for a cluster or allows you to view the license key or the license's expiration date. Your license key is located on the back of the Cisco Network Registrar CD-ROM case. You must enter your license key the first time you configure any cluster.
•
•
•
•
license set key=value
license get {expiration | key}
license [show]
Syntax Description
license set key=value
Sets the key value for the license. To set the license, you must run the nrcmd program in interactive mode, then exit and rerun the nrcmd program. The following example sets the license to key 1234 abcd 5678 efgh.
nrcmd -C cluster1 -N admin -P changemenrcmd> license set key=1234-abcd-5678-efgh100 Oknrcmd> exitlicense get {expiration | key}
Gets the expiration or key values for the license.
license [show]
Shows the values of the attributes assigned to the license.
Related Commands
namespace
The namespace command creates, deletes, sets, and lists attributes for namespaces. A namespace distinguishes a set of DHCP server objects that are independent of otherwise identical objects in other namespaces. The DHCP server groups address blocks and their associated subnets, and scopes and their associated leases by namespace. A namespace has a descriptive name.
There are two ways to use namespaces:
•
•
In virtual private network (VPN) deployments, for example, you can create a namespace for each VPN, based on the vpn-id. The namespaces allow the DHCP server to distinguish among multiple instances of a single logical IP subnet when that subnet is used in multiple independent VPNs. The server also groups each lease in the subnet by namespace, so that the server can interact with clients on VPNs that use the same IP address space. See the "Virtual Private Network Configuration Example" section.
namespace name create id=id [attribute=value]
namespace name delete
namespace name set attribute=value
namespace name unset attribute
namespace name get attribute
namespace name [show]
namespace list
namespace listnames
Syntax Description
namespace name create id=id [attribute=value]
Creates a namespace using a unique name and unique namespace identifier. The namespace requires the name and an id. You cannot use the reserved words all or global for the namespace name.
The namespace can take two attributes, the VPN Routing and Forwarding instance (VRF) name and the VPN identifier (See Table 2-17). Network Registrar associates an incoming packet with the namespace if either the VRF name or VPN ID appears in the vpn-id option or vpn-id suboption (each can carry only one at a time in the packet).
You can change the namespace name using the set command, unless the namespace is the current namespace defined by the session set current-namespace command or the new name is not unique. You cannot change the namespace-id value. See the "session" section.
namespace name delete
Deletes a namespace.
namespace name set attribute=value
Changes the namespace name or sets one of the other attributes (see Table 2-17). You can change the namespace name only to another unique name. You cannot change the namespace-id value.
namespace name unset attribute
Unsets the value of an attribute.
namespace name get attribute
Gets the value of an attribute.
namespace name [show]
Shows the values of all attributes assigned to the namespace.
namespace list
Lists the namespaces and their properties.
namespace listnames
Lists just the names of all the namespaces.
Attributes
Table 2-17 describes the namespace command attributes and attribute=value pairs.
Related Commands
address-block, scope, session, subnet
option-datatype
The option-datatype command allows you to define DHCP option data types as required to accommodate devices from a variety of vendors. You can create a collection of standard DHCP option data types, such as IPADDR, BYTE and IPADDR_ARRAY, to support requirements for complex data types.
Note
option-datatype name create
option-datatype name delete
option-datatype name defineField field position datatype [flags]
option-datatype name undefineField field
option-datatype name listFields
option-datatype name enable read-only
option-datatype name disable read-only
option-datatype name [show]
option-datatype list
option-datatype listnames
Syntax Description
option-datatype name create
Creates an option data type.
option-datatype name delete
Deletes an option data type.
option-datatype name defineField field position datatype [flags]
Defines a field of an option data type. Specifies the field name, numeric position among other fields, data type, and optional formatting flags. The attributes of this command are as follows:
•
•
•
•
The supported flags are:
•
•
•
option-datatype name undefineField field
Undefines a field name for an option data type.
option-datatype name listFields
Lists any fields defined for an option data type.
option-datatype name enable read-only
Prevents further changes to the definition of an option data type.
Note
option-datatype name disable read-only
Allows you to make changes to the definition of an option data type (the default).
option-datatype name [show]
Shows the attributes for an option data type.
option-datatype list
Lists the DHCP option data types and any attributes assigned to them.
option-datatype listnames
Lists just the names of the DHCP option data types.
Option Data Types
Table 2-18 lists the data type values that Network Registrar supports.
Usage Guidelines
See the "Defining Vendor-Specific DHCP Options" section.
policy
The policy command configures DHCP policy configurations. A policy is a collection of DHCP option values to associate with a range of addresses in a scope, or with a specific client or client-class configuration. Network Registrar considers policy reply options in a hierarchy of options. See the "Policy Reply Options" section.
The policy command can stand alone. However, there are four additional policy object types that you indicate as hyphenated prefixes to the policy command:
•
•
•
•
policy name create [attribute=value...]
[type-]policy name delete
[type-]policy name enable attribute
[type-]policy name disable attribute
[type-]policy name set attribute=value [attribute=value...]
[type-]policy name unset attribute
[type-]policy name get attribute
[type-]policy name [show]
policy list
policy listnames
[type-]policy name setOption option value
[type-]policy name unsetOption option
[type-]policy name getOption option
[type-]policy name listOptions
[type-]policy name setVendorOption vendoroption suboption-syntax field value
[type-]policy name unsetVendorOption vendoroption suboption-syntax field
[type-]policy name getVendorOption vendoroption suboption-syntax field
[type-]policy name listVendorOptions [vendoroption]
[type-]policy name setLeaseTime value
Syntax Description
See Table 2-19 for the policy command attribute descriptions.
policy name create [attribute=value...]
Creates a policy (and optionally assigns attribute values).
nrcmd> policy CompanyB create[type-]policy name delete
Deletes a policy.
[type-]policy name enable attribute
Enables the attribute for a policy.
[type-]policy name disable attribute
Disables the attribute for a policy.
[type-]policy name set attribute=value [attribute=value...]
Sets an attribute to a value for a policy.
nrcmd> policy default set grace-period=3dnrcmd> address-block-policy 10.10.0.0/16 set offer-timeout=2mnrcmd> client-policy 1,6,00:d0:ba:d3:bd:3b set server-lease-time=5dnrcmd> client-class-policy CableModem set dhcp-reply-options=all-subnets-localnrcmd> scope-policy testScope set bootp-reply-options=time-offsetnrcmd> dhcp reload[type-]policy name unset attribute
Unsets the value of an attribute for a policy. You cannot unset required attributes.
[type-]policy name get attribute
Gets the value of an attribute for a policy.
[type-]policy name [show]
Shows the values of all attributes assigned to a policy.
policy list
Lists all policies and any attributes assigned to them.
policy listnames
Lists just the names of all policies.
[type-]policy name setOption option value
Sets the value of a standard DHCP option name to a value for a policy.
nrcmd> policy default setOption dhcp-lease-time 608400For a list of all the DHCP options that you can configure, enter the nrcmd program help dhcp-option command.
[type-]policy name unsetOption option
Unsets the value of an option for a policy.
[type-]policy name getOption option
Gets the value of an option for the policy.
[type-]policy name listOptions
Lists the standard options in a policy.
nrcmd> policy default listOptions(51)dhcp-lease-time: 604800[type-]policy name setVendorOption vendoroption suboption field value
[type-]policy name setVendorOption vendoroption {suboption[index]} field valueAssociates a vendor-supplied DHCP option (vendoroption) and its suboption with the policy and assigns a value to a field of the suboption. Use the suboption-index syntax when a suboption is an array that requires braces and square brackets. See the "Specifying Arrays in Vendor-Specific Options" section. See also the "Defining Vendor-Specific DHCP Options" section.
You must create the name of the vendor option using the option-datatype and vendor-option commands before you can use it in the policy command.
[type-]policy name unsetVendorOption vendoroption suboption field
[type-]policy name unsetVendorOption vendoroption {suboption[index]} fieldDeletes the association between the specified policy and a vendor-supplied DHCP option suboption field. Use the suboption-index syntax for arrays. See the "Specifying Arrays in Vendor-Specific Options" section.
[type-]policy name getVendorOption vendoroption suboption-syntax field
[type-]policy name getVendorOption vendoroption {suboption[index]} fieldGets vendor-specific option data for the policy.
[type-]policy name listVendorOptions [vendoroption]
Lists data for all vendor options in a policy or, optionally, lists data for a specific vendor option.
nrcmd> policy 168.1-net listVendorOptions[type-]policy name setLeaseTime value
Sets the client lease time to value for a policy. The lease time is the value of the dhcp-lease-time DHCP option. See the "Lease Times" section.
To view the lease time value, use the [type-]policy name listOptions command. The time is displayed in seconds.
Attributes
Table 2-19 describes the [type-] policy command attributes.
Table 2-19 type-policy Command Attributes
allow-client-a-
record-updateenable
disable
unsetAllows the client to update the A record. If the client sets the flags in the FQDN option to indicate an A record update in the request, and if this attribute is enabled, the server allows the client to do the A record update. Otherwise, the server does the A record update based on other server configurations. Optional, default enable.
allow-dual-zone-
dns-updateenable
disable
unsetIf enabled, the DHCP server returns the client-fqdn option (81) so that the client can perform an A record update itself. Also, the server performs an A record update on the client's behalf. This is required to support certain DHCP deployments that represent their clients in two DNS zones. If both the allow-client-a-record-update and allow-dual-dns-update attributes are enabled, the latter takes precedence. Optional, default disable.
allow-lease-time-
overrideenable
disable
unsetClients can request a specific lease time. The server does not honor requested lease times if this attribute is false, or if the time is longer than the server's normal lease time. Optional, default enable.
bootp-reply-
optionsset=
get
unsetList of names of options to return in any replies to BOOTP clients. You do not need to configure the options themselves in the same policy as the reply-options list; the server searches the hierarchy of policies for each option named in the list. See the "Policy Reply Options" section. Optional, no default.
dhcp-reply-
optionsset=
get
unsetList of names of options to return in any replies to DHCP clients. You do not need to configure the options themselves in the same policy as the reply-options list; the server searches the hierarchy of policies for each option named in the list. See the "Policy Reply Options" section. Optional, no default.
grace-period
set=
get
unsetTime, in seconds, between the expiration of a lease and the time it is made available for re-assignment. Optional, default 300 seconds (five minutes).
offer-timeout
set=
get
unsetThe time, in seconds, that the server waits to re-offer a lease if a client does not accept it. Optional, default 120 seconds (two minutes).
packet-file-name
set=
get
unsetName of the boot file for a client's boot process. The server returns this filename in the file field of its replies. Optional, no default, but cannot be longer than 127 characters. This attribute can also contain the following variable substitution values:
•
•
packet-server-
nameset=
get
unsetHostname of a server to use in a client's boot process. The server returns this hostname in the sname field of its replies. Optional, no default, but cannot be longer than 64 characters.
packet-siaddr
set=
get
unsetIP address of the next server in a client's boot process. For example, this might be the address of a TFTP server BOOTP clients use. The server returns this address in the siaddr field of its reply. Optional, no default.
permanent-leases
enable
disable
unsetWhen enabled, grants permanent leases to clients. Optional, default disable.
server-lease-time
set=
get
unsetTime that the server believes the lease is valid. It may help for the server to consider leasing for a longer period than the client requests so as to get more frequent client communication, along with the stability of long lease times. This value is not used unless it is longer than the lease time in the dhcp-lease-time option found through the normal traversal of policies. See the "Lease Times" section. Optional, no default.
split-lease-times
enable
disable
unsetControls whether the server uses the value of the server-lease-time attribute to determine the length of a lease, rather than using the lease time returned to the client. Optional, default disable.
Usage Guidelines
Policy Reply Options
When the server is getting ready to return option data to a client, it examines up to seven policies in the following order:
1.
2.
3.
4.
5.
6.
7.
Then, the server looks through the policies for a reply-options list. It looks for bootp- or dhcp-reply-options, depending on the client. The server uses the first list it finds. For each option in the list, the server looks through all of the policies, in order, and returns the data from the first policy that has a matching option. There is no requirement that the data from the server must come from the same policy as the reply-options list. If the server finds a reply-options list, it looks for each option in the list individually, and searches all the related policies if necessary.
Also, you do not need to have the options mentioned in a reply-options list present in the policy containing the list. You can enter a string that can name any option. The Network Registrar GUI, however, presents a special dialog box for adding a reply-options attribute to a policy that restricts you to the options already configured in the policy. This is a GUI-only restriction; the server does not impose this restriction.
Lease Times
A policy contains two lease times—the client lease time and the server lease time.
•
•
You can establish these two different lease times if you want to retain information about clients' DNS names and yet have them renew their leases frequently. When you use a single lease time and it expires, the server no longer keeps that client's DNS name. However, if you use a short client lease time and a longer server lease time, then the client information is retained even after the client's lease expires.
Caution
Specifying Arrays in Vendor-Specific Options
The following example sets data for the boot_server_type field in array index 0 of the suboption named suboption_8. Include the braces and square brackets as part of the suboption and index specification. Enter the 200 as a string and not in hexidecimal.:
nrcmd> policy 168.1-net setVendorOption IntelPXE_vso {suboption_8[0]} boot_server_type 200If the data type of the option field (in this example, boot_server_IP_list) is an array, use comma-separated values, such as the two IP addresses in the following example, as a string and not in hexidecimal.
nrcmd> policy network-1.2.3 setVendorOption IntelPXE_vso {suboption_8[0]}boot_server_IP_list 192.168.25.4,192.168.25.5See the "Defining Vendor-Specific DHCP Options" section.
Related Commands
admin, client-class, client-class-policy, client-policy, dhcp, scope, scope-policy, vendor-option
remote-dns
The remote-dns command controls the behavior of the DNS server when it is communicating with other DNS servers. Use it either to control incremental transfer or to send multiple records per transmission control protocol (TCP) packet.
remote-dns ipaddress[/maskbits] create [ixfr={true | false} | multirec={true | false}]
remote-dns ipaddress[/maskbits] delete
remote-dns ipaddress[/maskbits] enable {ixfr | multirec}
remote-dns ipaddress[/maskbits] disable {ixfr | multirec}
remote-dns ipaddress[/maskbits] unset {ixfr | multirec}
remote-dns ipaddress[/maskbits] [show]
remote-dns list
remote-dns listnames
Syntax Description
remote-dns ipaddress[/maskbits] create [ixfr={true | false} | multirec={true | false}]
Creates a remote DNS server description. See the enable syntax description for the optional attributes. The following example creates the remote server description 192.168.1.1 with the net mask of 255.255.0.0.
nrcmd> remote-dns create 192.168.1.1/16
Note
remote-dns ipaddress[/maskbits] delete
Deletes a remote DNS server description.
remote-dns ipaddress[/maskbits] enable {ixfr | multirec}
Enables incremental zone transfers (IXFRs), multiple records, or both for a remote DNS server.
•
•
When you enable or disable incremental transfer, Network Registrar looks for the most specific match. That is, it matches the machine with the longest mask. You can use this attribute to specify a group of servers with a single command.
The following example enables all DNS servers on this network to perform incremental transfer.
nrcmd> remote-dns create 128.103.0.0/16 ixfr=trueThe following example disables incremental transfers on all DNS servers on this network.
nrcmd> remote-dns create 128.103.1.0/24 ixfr=falseremote-dns ipaddress[/maskbits] disable {ixfr | multirec}
Disables incremental zone transfers or multiple records for a remote DNS server. See the enable syntax description.
remote-dns ipaddress[/maskbits] unset {ixfr | multirec}
Unsets the incremental zone transfers or multiple records attribute for the remote DNS server.
remote-dns ipaddress[/maskbits] [show]
Shows the attributes for the remote DNS server.
remote-dns list
Lists all remote DNS server descriptions and any attributes assigned to them.
remote-dns listnames
Lists just the names of the remote DNS servers.
Related Commands
report
The report command produces a summary of dynamic and static IP address utilization for one or more clusters.
report [config=config file] [column-separator=character-string] [dhcp-only]
[file=output-file] [leasing-only] [mask-bits=value] [namespace=name]Syntax Description
report [config=config-file] [column-separator=character-string] [dhcp-only]
[file=output-file] [leasing-only] [mask-bits=value] [namespace=name]When you use the report command with no keywords, it creates a report of static DNS addresses and dynamic DHCP addresses for the cluster on which it is running and sends the report to the standard output. You can limit the report, redirect it to a file, and change its column delimiters by using the keywords. Table 2-20 describes the report command attributes.
Note
Usage Guidelines
Specifying Clusters
You can specify cluster in a variety of ways and Network Registrar follows a precedence order. Any of the cluster specifications can override the default specification or previous specification.
•
•
•
•
Cluster information for summary reports[report]clusters= clustername username password, ...clusters=host1 admin, host2, host3 admin3 passwd3
Note
You can optionally specify a username and password for the cluster. If you do not provide a username or password for a particular cluster, Network Registrar uses the last username or password listed. If you do not provide usernames or passwords, Network Registrar uses the information from the command line -N and -P arguments, and then the Windows Registry or environment variables AIC_NAME and AIC_PASSWORD.If Network Registrar cannot find a username or password, or if the supplied username and password are incorrect, then the report command issues a warning for that cluster.
Displaying the Summary
The report command displays a row of information for each subnet specified by scope or deduced from DNS static address assignments outside of scopes.
The report command displays subtotal rows when more than one scope shares a common subnet, and when addresses share a common subnet as specified by their address and mask. Note that the report command assumes that there is no overlap between static addresses and scope ranges.
For each scope or subnet, the report command displays the following information:
•
•
•
For each scope-specified subnet, the report command also displays the following values:
•
•
•
•
•
•
•
•
•
•
•
•
•
Addresses have both a current state and a pending state after their leases expire. Table 2-21 summarizes address states.
For each subtotal row, the report command provides summaries of any scope values in the subnet, and additionally, displays the following values:
•
•
•
At the end of the report, a grand total summarizes all the data in the subnets.
The rows and columns in Table 2-22 represent potential states and flags that an address within a DHCP scope can possess. The cells within the table indicate the category into which Network Registrar places addresses with a given state and flag. When setting multiple flags, deactivated takes priority over reserved, and reserved takes priority over any remaining flags for reporting purposes.
Table 2-22 lists and describes the potential states and flags for IP addresses.
Related Commands
save
The save command validates and saves your changes to the database.
save
Usage Guidelines
Validation
The nrcmd program performs validation when you create objects or modify their attributes. It checks that you supplied the required attributes and that their values are valid. It also checks the validity of attribute values when you set them.
When you issue the save command, Network Registrar ensures that:
•
•
•
Status Codes
All nrcmd commands return a status code as the first line of output. The first word on the line is a three-digit status code. The remaining output is the descriptive text. The first digit of the status code determines the class of the status.
Table 2-23 lists the save command status codes.
For details about error codes, see Appendix A, "Codes and Formats."
Related Commands
scope
The scope command creates and edits DHCP scopes.
scope name create addr mask [attribute=value...]
scope name delete
scope name enable attribute
scope name disable attribute
scope name set attribute=value [attribute=value...]
scope name unset attribute
scope name get attribute
scope name [show]
scope list
scope listnames
scope name listLeases
scope name changeMask netmask
scope name clearUnavailable
scope name addRange start end
scope name removeRange start end
scope name listRanges
scope name addReservation ipaddr macaddr
scope name removeReservation {ipaddr | macaddr}
scope name listReservations
Syntax Description
See Table 2-24 for the scope command attribute descriptions.
scope name create ipaddress mask [attribute=value...]
Creates a scope (and optionally sets an attribute). Specify the scope mask in base-10 (such as 255.255.255.0), not in hexadecimal.
nrcmd> scope testscope create 192.168.1.0 255.255.255.0scope name delete
Deletes a scope.
scope name enable attribute
Enables an attribute for a scope.
nrcmd> scope testscope enable dynamic-dnsscope name disable attribute
Disables a attribute for a scope.
nrcmd> scope testscope disable dynamic-bootpscope name set attribute=value [attribute=value...]
Sets one or more attributes for a scope.
nrcmd> scope testscope set dns-reverse-zone-name=10.in-addr.arpa.scope name unset attribute
Unsets an attribute for a scope. You cannot unset required attributes.
scope name get attribute
Gets the value of an attribute for a scope. The following example gets the DNS zone name.
nrcmd> scope testscope get dns-zone-namescope name [show]
Shows the values of all attributes assigned to a scope.
scope list
Lists all scopes and any attributes assigned to them.
scope listnames
Lists just the names of scopes.
scope name listLeases
Lists the leases in a scope. This list can be very long.
scope name changeMask netmask
Changes the network mask of a scope. See the "Changing the Mask of a Scope" section.
nrcmd> scope testScope changemask 255.255.254.0scope name clearUnavailable
Clears the unavailability of leases in a scope to make them all available.
scope name addRange start end
Adds a range of addresses to a scope. The start and end values can be host numbers or IP addresses. However, they must fall within the network addresses that the scope address and mask define. If adding addresses to a scope creates a continuous set of addresses, Network Registrar merges the current list of ranges, if possible.
nrcmd> scope testScope addRange 192.168.1.10 192.168.1.20scope name removeRange start end
Removes a range of available addresses in a scope, starting with a start address and ending with an end address. If removing a range creates a discontinuous set of addresses, Network Registrar modifies or splits the existing ranges.
nrcmd> scope testscope removeRange 192.168.1.10 192.168.1.15scope name listRanges
Lists the available addresses in a scope.
scope name addReservation ipaddr macaddr
Adds a reservation to a scope.
nrcmd> scope testScope AddReservation 192.168.1.10 1,6,00:d0:ba:d3:bd:3b
Tip
scope name removeReservation {ipaddress | macaddress}
Removes a reservation from a scope. Specifying the MAC address or IP address of the client.
nrcmd> scope testscope removeReservation 192.168.1.10scope name listReservations
Lists the reservations in a scope.
Attributes
Table 2-24 describes the scope command attributes and their values and defaults, if any.
Table 2-24 scope Command Attributes
addr
set=
get
unsetAddress of the subnet for which this scope contains addresses (read-only). Optional, no default.
bootp
enable
disable
unsetControls whether the server accepts BOOTP requests. If you want clients to always receive the same addresses, you need to reserve IP addresses for all your BOOTP clients. Optional, default disable.
deactivated
enable
disable
unsetA scope that does not extend leases to clients. It treats all of the addresses in its ranges as if they were individually de-activated. Optional, no default.
dhcp
enable
disable
unsetControls whether the DHCP server does accept DHCP requests for this scope. Disable DHCP for a scope to use the scope for BOOTP exclusively, or to temporarily de-activate it. Optional, default enable.
dns-reverse-
zone-nameset=
get
unsetName of the inverse (in.addr.arpa) zone that is updated with PTR and TXT records. Optional, no default.
dns-rev-server-
addrset=
get
unsetAddress of the reverse DNS server for the zone into which the server should add PTR records. Optional, no default.
dns-server-addr
set=
get
unsetIP address of the primary DNS server on which the forward zone resides. Optional, no default.
dns-zone-name
set=
get
unsetName of the DNS zone to which to add a DHCP client's host (A record). Optional, no default.
dynamic-bootp
enable
disable
unsetControls whether the server accepts dynamic BOOTP requests for this scope. Dynamic BOOTP requests are BOOTP requests that do not match a reservation, but can come from the available lease pool. To use this attribute, you must also enable bootp. Optional, default disable.
dynamic-dns
enable
disable
unsetControls whether the DHCP server should attempt to update a DNS server with the name and address information from leases granted to requesting clients. Optional, default disable.
embedded-
policyget
Embedded policy for the scope. Read-only. The embedded policy attribute gets its value from the scope-policy command.
failover
set=
get
unsetControls whether the scope should participate in failover, with three possible values:
•
•
•
See the "Failover Attribute States" section. Optional, default is use-server-settings (dhcp enable/disable failover).
failover-backup-
percentageset=
get
unsetPercentage of available addresses that the main server should send to the backup server. If defined for a scope, you must define it for the scope in the main server. If defined in a backup server, it is ignored (to enable copying of configurations). The value overrides the server values for failover-backup-percentage and failover-dynamic-bootp-backup-
percentage, and the value defined here is used for this scope, whether or not this scope supports dynamic-bootp. If defined as zero (0), no addresses go to the backup server. Because zero is a significant value, once defined, you must unset this attribute for the scope to use the server default values for failover-backup-percentage or failover-dynamic-bootp-backup-percentage. Optional, no default.failover-backup-server
set=
get
unsetString representing the DNS name of the backup server associated with this LAN segment. If the DNS name resolves to the IP address of the current server, then this server operates as the backup server for this scope. It is an error if the names of both the main and backup server resolve to the IP addresses that reside on the same server. If the failover- main-server is set to "local" or is not configured on this scope or in the server-wide default, this server is considered to be the main server for the scope. Optional, no default.
failover-main-
serverset=
get
unsetString representing the DNS name of the main server associated with this LAN segment. If the DNS name resolves to the IP address of the current server, then this server operates as the main server for this scope. It is an error if the names of both the main and backup server resolve to the IP addresses that reside on the same server. If you do not configure the backup server on this scope or in the server-wide default, then this server is the main server for this scope. If the failover-backup-server is set to "local" or is not configured on this scope or in the server-wide default, this server is considered to be the main server for the scope. Optional, no default.
mask
set=
get
unsetSubnet mask associated with the scope's network address. Optional, no default.
namespace
set=
get
unsetNamespace in which the addresses in the scope reside. You must define the namespace using the namespace name create namespace-id command. See the "namespace" section. Network Registrar actually uses the namespace-id value. If unset, the global namespace is used. Optional, default is to use the current namespace as set by the session set current-namespace command, or, if undefined there, the global namespace.
namespace-id
set=
get
unsetID of the namespace in which the addresses in the scope reside. An alternative to specifying the namespace attribute. See the namespace attribute for details. If unset, the ID of the global namespace is used. Optional, default is the current namespace.
ping-clients
enable
disable
unsetControls whether the server should attempt to ping an address. If enabled, also indicate a ping timeout. Optional, default disable.
ping-timeout
set=
get
unsetThe number of milliseconds that the DHCP server should wait for ping responses. If you make this value too large, you slow down the lease offering process. If you make this value too small, you reduce the effectiveness of pinging addresses before offering them. Three hundred milliseconds is a frequent compromise. Optional, default 300 ms.
policy
set=
get
unsetName of the policy associated with the scope. Required, default is default policy. This means that the scope uses all the properties set in the default policy (including the lease time), unless specifically reset.
primary-addr
get
IP address of the primary scope for a secondary scope. Read-only.
primary-mask
get
Subnet mask of a secondary scope's primary scope. Read-only.
primary-scope
set=
get
unsetPrimary scope for a secondary scope. Setting the value of the primary-scope attribute on a scope designates the scope as being secondary to another scope. You must specify a primary scope if you have multiple logical subnets on the same physical network segment and if you allow DHCP to offer addresses from any of the subnets. To remove the status of secondary from the scope (that is, promote it to being a primary scope), you must unset the primary-scope attribute. Optional, no default.
renew-only
enable
disable
unsetControls whether to allow existing clients to re-acquire their leases, but not to offer any leases to new clients. Note that a renew-only scope does not change the client associated with any of its leases, other than to allow a client currently using an available IP address to continue to use it. Optional, no default.
selection-tags
set=
get
unsetComma-separated list of selection criteria associated with a scope. The scope compares a client's selection criteria to this list to determine whether the client can obtain a lease from the scope. Optional, no default.
synthesize-name
enable
disable
unsetControls whether the DHCP server automatically creates DNS hostnames for DHCP clients who do not provide them. The server can synthesize unique names for clients based on the synthetic-name-stem attribute. Optional, default disable.
synthetic-name-stem
set=
get
unsetPrefix of the default hostname to use if clients do not supply hostnames. Optional, no default.
trap-free-
address-highenable
disable
unsetControls whether you set a trap on the scope to alert you when the number of free addresses gets high. When a scope is created, the trap-free-address-high attribute is enabled. Also, the trap-free-address-low, trap-free-address-low-threshold and trap-free-address-high-threshold attributes are undefined. See the "trap" section. See also the trap-free-address-high-threshold attribute. Optional, default enable.
trap-free-
address-high-
thresholdset=
get
unsetNumber or percentage threshold for the free-address trap on this scope. Percentages must be followed by a (%) sign.The high threshold must be greater than or equal to the low threshold. See the "trap" section. See also the trap-free-address-high attribute. Optional, no default.
trap-free-
address-lowenable
disable
unsetControls whether you set a trap on the scope to alert you when the number of free addresses gets low. See the "trap" section. See also the trap-free-address-low-threshold attribute. Optional, no default.
trap-free-
address-low-
thresholdset=
get
unsetNumber or percentage threshold for the free-address trap on this scope. Percentages must be followed by a (%) sign. The low threshold must be less than or equal to the high threshold. See the "trap" section. See also the trap-free-address-low attribute. Optional, no default.
trap-free-
address-resetset=
get
unsetNumber or percentage, followed by a (%) sign, of the reset value for the free-address trap on this scope. See the "trap" section. Optional, no default.
update-dns-first
enable
disable
unsetControls whether the DNS server is updated before the lease is granted. Optional, default disable.
update-dns-for-
bootpenable
disable
unsetIf the server replies to a BOOTP request and offers a lease from a scope that is configured to perform DNS updates, it checks this attribute before beginning the DNS update. This attribute prevents DNS updates for BOOTP clients while allowing updates for DHCP clients. You can also control this attribute globally using the dhcp enable/disable update-dns-for-bootp command, but the scope setting overrides it. Optional, no default.
use-dns-update-prereqs
enable
disable
unsetBy default, the DHCP server uses prerequisites in its DNS update messages when it is performing DNS updates on behalf of clients. If disabled, the server does not include prerequisites. Without them, the server associates the last client who uses a given domain name with that name, even if another client was already associated with it. The scope setting overrides the DHCP server setting. Optional, default enable.
Usage Guidelines
Changing the Mask of a Scope
The changemask action:
•
•
•
•
•
Failover Attribute States
The failover attribute has three possible states:
•
If more than one scope on the same LAN segment is scope-enabled for failover, then the main and backup servers must be identical for each. An error occurs if one scope on a LAN segment is scope-enabled and another is scope-disabled, unless the other scope has failover enabled server-wide.
•
•
Note
Related Commands
admin, client-class, client-class-policy, client-policy, dhcp, policy, scope-policy, scope-selection-tag
scope-policy
The scope-policy command configures DHCP embedded policies for scopes. A scope-policy is a policy object embedded within (and limited to) a scope object. Each scope may contain option data within its embedded policy, and may refer to a named policy with more option data, such as a router IP address.
The DHCP server implicitly creates and deletes embedded scope-policies when you create or delete the corresponding scopes. You manipulate the scope-policy using the name of the corresponding scope.
For the syntax and descriptions, see the policy command.
Attributes
See Table 2-19 in the policy command section for the attribute descriptions.
Usage Guidelines
scope-policy Reply Options
When the server is getting ready to return option data to a client, it examines up to seven policies. See the "Policy Reply Options" section.
Lease Times
A scope policy contains two lease times—the client lease time and the server lease time. The server controls these the same as with the policy command. See the "Lease Times" section.
Specifying Arrays in Vendor Specific Options
The scope-policy command accepts data in vendor-specific options in the same way as the policy command. See the "Specifying Arrays in Vendor-Specific Options" section.
Related Commands
client-policy, client-class, client-class-policy, policy, scope
scope-selection-tag
The scope-selection-tag command defines the tags that you add for the scope selection criteria for scopes, clients, and client-classes.
scope-selection-tag name create
scope-selection-tag name delete
scope-selection-tag list
Syntax Description
scope-selection-tag name create
Creates a scope-selection tag.
nrcmd> scope-selection-tag internal createscope-selection-tag name delete
Deletes a scope-selection tag.
nrcmd> scope-selection-tag internal delete
Note
scope-selection-tag list
Lists all scope-selection tags.
nrcmd> scope-selection-tag listUsage Guidelines
Inclusion and Exclusion Criteria
When the DHCP server reads a client entry (from the local database or from LDAP), the server checks its scope-selection inclusion and exclusion criteria against the tags defined for the scopes on this network. If the client entry refers to tags that are not present in any scope in the network, the server handles the tags depending on whether the reference is to include or exclude tags. If the reference is for exclusion, the tags have no effect. If the tags are not present and the reference is for inclusion, the server determines that there is no acceptable scope on that network for this client.
Related Commands
admin, client-class, client-class-policy, dhcp
server
The server command affects the behavior of the server. After you use the server command, or any other time you change the server configuration, use the server command or the Network Registrar GUI to reload the server.
Timesaver
[server] {dns | dhcp | tftp} enable [start-on-reboot]
[server] {dns | dhcp | tftp} disable [start-on-reboot]
[server] {dns | dhcp | tftp} start
[server] {dns | dhcp | tftp} stop
[server] {dns | dhcp | tftp} get version
[server] {dns | dhcp | tftp} getHealth
[server] {dns | dhcp | tftp} getStats
[server] {dns | dhcp | tftp} reload
[server] dhcp getRelatedServers [column-separator=string]
[server] dhcp setPartnerDown partner-server [date]
[server] dhcp updateSms [all]
[server] {dns | dhcp | tftp} serverLogs nlogs=value logsize=value
[server] {dns | dhcp | tftp} serverLogs [show]
Syntax Description
The syntax descriptions use the convention {dns | dhcp | tftp} to indicate that you can use the command with the DNS, DHCP, or TFTP servers. There are no attributes other than those specified in the syntax. You can omit the server keyword in each case.
[server] {dns | dhcp | tftp} enable [start-on-reboot]
Enables a server. With the additional start-on-reboot attribute, the AIC Server Agent starts the server when you reboot. You might want to disable this attribute for clusters that provide a single protocol service. By default, the DNS and DHCP servers are enabled, while the TFTP server is disabled, to start on reboot.
[server] {dns | dhcp | tftp} disable [start-on-reboot]
Disables a server or the optional start-on reboot attribute. You might want to disable this attribute for clusters that provide a single protocol service. By default, the DNS and DHCP servers are enabled, while the TFTP server is disabled, to start on reboot.
nrcmd> server DNS disable start-on-reboot[server] {dns | dhcp | tftp} start
Starts a server (DNS, DHCP, or TFTP).
[server] {dns | dhcp | tftp} stop
Stops a server (DNS, DHCP, or TFTP). Stopping the server does not terminate the server process, but stops it from handling further requests.
[server] {dns | dhcp | tftp} get version
Gets the version number of the server software. Useful when describing version information to the Cisco Technical Assistance Center (TAC).
[server] {dns | dhcp | tftp} getHealth
Gets the current health of a server. A return of 0 indicates that the server is not running. Values of 1 through 10 indicate how well the server is running. A value of 10 indicates the highest health, and 0 indicates that the server is not running. The DNS and TFTP server return values of either 10 or 0 only. If there is an incremental drop in the server health value, look at the log files for the particular server as the best indication of health.
[server] {dns | dhcp | tftp} getStats
Gets a server's current statistics.
[server] {dns | dhcp | tftp} reload
Stops and immediately restarts the server. When the server restarts, it rereads all of its configuration information and its previously saved state information and then begins operating.
[server] dhcp getRelatedServers [column-separator=string]
Gets the status of the connection between the DHCP server and its DNS, LDAP, or failover servers. You can optionally specify that the report use string for separating columns. See the "Getting Related Servers" section.
[server] dhcp setPartnerDown partner-server [date]
Notifies the DHCP server that its partner DHCP server is down and moves all appropriate scopes into the PARTNER-DOWN state. Optionally, you can specify the date and time when the partner was last known to operate. The default is the current date. See the "Setting Partner Down" section.
Caution
[server] dhcp updateSms [all]
Causes the DHCP server to perform System Management Server (SMS) network discovery. Optionally, including all sends out all leased addresses from the DHCP server to SMS. If you do not include this parameter, the server sends only those addresses leased since the last time you used this command. See the "Updating the System Management Server" section.
[server] {dns | dhcp | tftp} serverLogs nlogs=value logsize=value
Sets or changes nlogs, the number of server logs, and logsize, the size of the server logs in bytes for a server. Valid values for nlogs are 2 through 100. The value of logsize is in bytes, and the optional K and M suffixes scale the specified value by 1000 or 1,000,000, respectively. Valid values for logsize are 10000 through 500000000 (or 10K through 500M) bytes. The following example sets the
DNS server to generate up to seven log files of five million bytes each. Restart the AIC Server Agent for the changes to take effect.
nrcmd> server dns serverLogs nlogs=7 logsize=5Mnrcmd> exit(UNIX)> /etc/init.d/aicservagt start(Windows)> net start "AIC Server Agent 2.0"[server] {dns | dhcp | tftp} serverLogs [show]
Displays the number and size of log files.
Usage Guidelines
Getting Related Servers
The getRelatedServers command allows you to create a report on the connection status of the other servers associated with this DHCP server. Network Registrar displays information for DNS, LDAP, and failover-associated DHCP servers sorted by type, name, and IP address. Table 2-25 describes the report output.
Setting Partner Down
The setPartnerDown command allows you to notify a DHCP server that a failover server associated with the DHCP server is down. When you run the setPartnerDown command, all of the scopes in this server that run failover with the partner server move into PARTNER-DOWN state.
Caution
You can specify a value on this command to shorten the waiting period associated with entering PARTNER-DOWN state. Network Registrar cannot allocate IP addresses that were available in the partner server to different DHCP clients until a waiting period equal to the maximum client lead time (MCLT) passed. See the failover-maximum-client-lead-time attribute in Table 2-5.
When you use the setPartnerDown command, you can specify a date and time that are equal to or later than the last known date and time the partner server could have been operational. If you do not specify a value, Network Registrar uses the current date and time. The following example notifies the backup server that its main server is down.
nrcmd> server dhcp setPartnerDown main.mycompany.comThere are two conventions for specifying the date:
•
•
nrcmd> server dhcp setPartnerDown main.mycompany.com Oct 31 00:00:00 2002
Note
Updating the System Management Server
When using the updateSms keyword, you must first set dhcp set sms-network-discovery=0 and set the sms-library-path and sms-site-code attributes. If you reload the DHCP server when updateSms is processing, it stops processing, and does not resume after the DHCP server comes back up again.
To use the updateSms command on Windows (NT and 2000), turn on "This Account" in the Startup tab of AIC Server Agent 2.0. Then, provide the name of the administrator account of the domain and the corresponding password, and start the services.
Related Commands
session
The session command sets session control parameters on your CLI command session.
The session assert functionality allows a nrcmd batch script to assert that a given condition is true. If the condition is true, the command has no effect, but if it is not true, the nrcmd exits at that point. Some uses for the session assert functionality are to ensure that the nrcmd session has an exclusive lock on the Network Registrar database, or to ensure that server configuration data has or has not changed since a previous point.
session set default-format=user | script
session set current-namespace=name
session unset current-namespace
session set visibility={5 | 3 | 1}
session get {cluster | default-format | user-name | visibility}
session [show]
session assert server.dbsn == server-version-minor-serial-number
session assert server.dbsn != server-version-minor-serial-number
session assert locked
Syntax Description
session set default-format=user | script
Sets the default format for the CLI session, either user or script:
•
•
The default is user format. The following example sets the output for script processing.
nrcmd> session set default-format=scriptsession set current-namespace=name
Sets the namespace for the session. Use this command to set the default namespace when there is a namespace expected for a CLI command, but that command does not have an explicit entry for the namespace, you cannot explicitly enter it for the command. If you do not use this command, Network Registrar uses the global namespace.The namespace value can either be a namespace name or its ID. Network Registrar reserves the namespace values all (refers to all namespaces, including global) and global (there is no namespace associated with the DHCP server objects). If the string matches an already defined namespace name, Network Registrar considers it a namespace name. Otherwise, Network Registrar considers it a namespace ID and the CLI tries to convert it into a namespace ID number. See the "namespace" section.
session unset current-namespace
Equivalent of the session set current-namespace="" command.
session set visibility={5 | 3 | 1}
Sets the session visibility, or what verbosity of attributes you can set or display for the session. A value of 1 gives the highest visibility. The default session visibility is 5. You cannot unset the visibility attribute.
Caution
session get {cluster | default-format | user-name | visibility}
Displays the cluster, default format, username, or visibility for the session.
session [show]
Shows the values of all attributes assigned to the CLI session.
session assert server.dbsn == server-version-minor-serial-number
Asserts that a specific server's configuration data has not changed. This is usually used by an external process that is maintaining a cache of the Network Registrar server configuration data and wants to discover if the cache is no longer valid. See the "Session Asserts" section.
nrcmd>session assert dhcp.dbsn == 42session assert server.dbsn != server-version-minor-serial-number
Asserts that a specific server's configuration data has changed. Scripts use this command to get updates on changes to the Network Registrar server configuration data.
nrcmd>session assert dhcp.dbsn != 42The following script emits the list of scopes, and the new DHCP server dbsn value only if the dbsn value changes from 110. It assumes that the output from this script will be parsed by an external process that is trying to keep the list of scopes up to date with Network Registrar. See the "Session Asserts" section.
session assert dhcp.dbsn != 110session assert locked
Use this command before any CLI commands that require a lock on the session. If any of the commands that follow require a lock, the CLI session exits. See the "Session Asserts" section.
Usage Guidelines
Session Asserts
The session assert commands can simplify interactions with external data management processes, and help in writing multi command batch scripts that stop processing if an asserted precondition fails. You generally use these commands with the script default-format, and possibly at a lower session visibility level. If the assertion passes, a "100 Ok" message appears. If it fails, a "107 Assertion Failed dhcp.dbsn (minor-serial-number) = value" message appears and the CLI exits.
The session assert locked command exits the CLI if it cannot lock the session. The following is a sample script for performing batch operations that require a lock.
nrcmd> session set default-format=scriptnrcmd> session assert lockednrcmd> commands-that-require-a-lockThe session assert dhcp.dbsn commands exit the CLI session if the minor serial number for the DHCP server does not match (==) or does not exceed (!=) the value given. The minor serial number is incremented with each configuration change. Get its value using the dhcp get dbsn command. See the "dhcp" section. The following is a sample script for modifying a DHCP server based on configuration version 1234.
nrcmd> session set default-format=scriptnrcmd> dhcp get dbsnnrcmd> session assert dhcp.dbsn == 1234nrcmd> scope scope-name create ipaddr mask policy=policy-namenrcmd> scope scope-name addRange start-ipaddr end-ipaddrThe following is a sample script for displaying DHCP configuration changes since version 1234.
nrcmd> session set default-format=scriptnrcmd> session assert dhcp.dbsn != 1234nrcmd> scope listnrcmd> policy listnrcmd> client-class listsubnet
Use the subnet command to view and manipulate the current DHCP subnets the server creates with the address-block command. All subnet command actions take effect immediately. The ipaddress value can be a simple IP address or can include the namespace in the syntax namespacename/ipaddress. See the "namespace" section. You do not need to reload the server.
subnet ipaddress/mask activate
subnet ipaddress/mask deactivate
subnet ipaddress/mask force-available
subnet ipaddress/mask get attribute
subnet ipaddress/mask [show]
subnet list
Syntax Description
See Table 2-26 for the subnet command attributes and their descriptions.
subnet ipaddress/mask activate
Activates a subnet, but does not change the status of a subnet marked as unavailable. The ipaddress/mask value can include the namespace, in the following slash-separated format:
namespacename/ipaddress/mask
If there is no namespace prefix for the address, the value set by the session set current-namespace applies. See the "session" section.
nrcmd> subnet 192.168.1.9 activatesubnet ipaddress/mask deactivate
De-activates a subnet from being given out or renewed, but does not change the state of the subnet.
subnet ipaddress/mask force-available
Makes a currently held subnet available, even a subnet marked as unavailable. Because using the force-available action may compromise the integrity of your IP address allocations, ensure that before you use this command, the client assigned the subnet is no longer using it.
subnet ipaddress/mask get attribute
Gets the value of an attribute for a subnet. See Table 2-15.
subnet ipaddress/mask [show]
Shows the subnet attributes for a specific address.
subnet list
Lists all the subnets.
Attributes
Table 2-26 describes the subnet command attributes and their values. They are all read-only attributes.
Related Commands
tftp
The tftp command enables or disables TFTP server attributes. Because there is only one TFTP server per cluster within Network Registrar, you do not need to refer to the server by name.
tftp enable attribute
tftp disable attribute
tftp set attribute=value [attribute=value...]
tftp unset attribute
tftp get attribute
tftp [show]
tftp setTraceLevel value
tftp getTraceLevel
tftp reload
Note
Syntax Description
See Table 2-27 for the tftp command attributes and their descriptions.
tftp enable attribute
Enables a TFTP server attribute. See Table 2-27 for the attributes with a usage of enable or disable.
nrcmd> tftp enable file-cachingtftp disable attribute
Disables a TFTP server attribute.
tftp set attribute=value [attribute=value...]
Sets one or more attributes of the TFTP server. See Table 2-27 for the attributes with a usage of set. The following command example enables caching:
nrcmd> tftp set file-cache-directory="CacheDir"Note that if you use this command, you must set the cache directory and reload the server:
nrcmd> tftp set file-cache-directory="CacheDir"nrcmd> tftp reloadIf file-caching is enabled, but file-cache-directory is not set, no files are cached. Also, if file-cache-directory is set, but file-caching is disabled, the files in the file-cache-directory are still accessible to clients, through normal methods, but are not cached.
tftp unset attribute
Unsets the value of an attribute of the TFTP server. You cannot unset required attributes.
tftp get attribute
Gets the value of an attribute for the TFTP server.
tftp [show]
Shows the TFTP server attributes.
tftp setTraceLevel value
Specifies the level of tracing that the TFTP server uses. Trace output is written to the file_tftp_1_log file in the server logs directory. Trace statements go to the file_tftp_1_log on Windows NT and to the file_tftp_1_trace file on Solaris. Each integer value from 0 through 4 enables another cumulative trace level:
•
•
•
•
•
Note
tftp getTraceLevel
Reports the trace level that the TFTP server is currently using. Use this command only when investigating server problems.
tftp reload
Reloads the TFTP server and updates the files in cache.
nrcmd> tftp reloadAttributes
Table 2-27 describes the tftp command attributes and their values and defaults, if any.
Related Commands
trap
The trap command enables or disables Simple Network Management Protocol (SNMP) traps. You can use traps to warn of error conditions and possible problems with the Network Registrar DNS, DHCP, or TFTP servers. These conditions include depleting the DHCP server scope address pools and communication loss with other servers.
trap enable trap
trap disable trap
trap set {free-address-low-threshold=value | free-address-high-threshold=value}
trap unset {free-address-low-threshold | free-address-high-threshold}
trap get {free-address-low-threshold | free-address-high-threshold}
trap [show]
trap addRecipient recipient host [community] [port]
trap removeRecipient recipient
trap listRecipients
Syntax Description
trap enable trap
Activates a trap. See Table 2-28 for the traps and their corresponding SNMP notification names. The default trap name is trap.
trap disable trap
De-activates a trap.
trap set {free-address-low-threshold=value | free-address-high-threshold=value}
Sets either or both of the two free address threshold attributes. In both cases, the valid values are digits and optionally a single trailing percent (%) character; the integer range is 0 through 2147483647 and percentages must be 0 through 100:
•
•
See the "Free Address Traps" section for restrictions. The following example sets the free-address-low-threshold to 12 percent and the free-address-high-threshold to 22 percent.
nrcmd> trap set free-address-low-threshold=12%nrcmd> trap set free-address-high-threshold=22%trap unset {free-address-low-threshold | free-address-high-threshold}
Unsets the values of one of the free address threshold attributes.
trap get {free-address-low-threshold | free-address-high-threshold}
Gets the value of the free address threshold.
trap [show]
Shows the values of the free address thresholds. See the "Free Address Traps" section.
trap addRecipient recipient host [community] [port]
Adds the trap recipient to the cluster's trap recipient list. The Network Registrar servers reference the trap recipients through aliases to allow multiple recipients at the same address, but at different ports. The attributes are as follows:
•
•
•
•
trap removeRecipient recipient
Removes a trap recipient from the cluster's trap recipient list. You can delete a trap recipient from the list, but you cannot modify the recipients.
trap listRecipients
Lists all the trap recipients in the cluster's trap recipient list and their attributes.
Traps
Table 2-28 describes the traps and their corresponding SNMP notification names. All the traps are initially enabled by default. See also the "Free Address Traps" section.
Usage Guidelines
Free Address Traps
The free-address traps catch when the number of free IP addresses on a server falls below a certain threshold, and when to notify that they again move out of this area. You arm the traps using the trap enable free-address-low and trap enable free-address-high commands. You set the thresholds for each using the trap set free-address-low-threshold and trap set free-address-high-threshold commands, respectively. You set the low and high threshold values either by an absolute number, or by a percentage (followed by the percent sign). You must use the same unit of measure for both thresholds; for example, if the low threshold value is a percentage, the high threshold value must be as well. The free-address-low trap catches when the free addresses fall below the low threshold. The free-address-high trap catches when they are no longer too low. The high value must be equal to or greater than the low one. Both values default to 20 percent. These traps, like all others, apply on a server and not a scope by scope basis.
You generally set the low and high thresholds at a certain offset. For example, you can set the low value to 20%, in which case the DHCP server catches when the number of free addresses fall below 20%. You can then set the high threshold to 25% so that you get a notification at a slightly higher point that the addresses have again become free. As soon as the DHCP server issues a trap for one threshold condition, it arms the trap for the opposite condition. Because of this, creating a safety zone between the two thresholds eliminates issuing traps each time the free addresses hover close to and keep crossing the low threshold point.
Even if you disable one trap through the trap disable command, Network Registrar still sends its opposite as needed.
vendor-option
The vendor-option command defines the option data format for vendor-specific options (DHCP option 43) as required to accommodate devices from a variety of vendors. You can:
•
•
vendor-option name create vendor-class-id
vendor-option name delete
vendor-option name enable read-only
vendor-option name disable read-only
vendor-option name defineSuboption suboption number datatype [flags]
vendor-option name undefineSuboption suboption
vendor-option name listSuboptions
vendor-option name [show]
vendor-option list
vendor-option listnames
Syntax Description
vendor-option name create vendor-class-id
Creates a vendor option and assigns the class-identifier string (DHCP Option 60) for the supported device. The option name is case-insensitive. Do not use a hyphen (-) as part of the name. The vendor-class-id should be unique to each vendor option name.
vendor-option name delete
Deletes a vendor option.
vendor-option name enable read-only
Prevents further changes to a vendor option. Enable the read-only attribute of the vendor-specific DHCP option before you use the option in a policy name setVendoroption command to set the data for the option.
vendor-option name disable read-only
Allows changes to a vendor option (the default).
vendor-option name defineSuboption suboption number datatype [flags]
Defines a suboption for a vendor option. The attributes are as follows:
•
•
•
•
The supported flags are as follows:
•
•
•
•
vendor-option name undefineSuboption suboption
Makes a suboption-name undefined for a vendor option.
vendor-option name listSuboptions
Lists any suboptions defined for a vendor option.
vendor-option name [show]
Lists the attributes for a vendor option.
vendor-option list
Lists all vendor options and any attributes assigned to them.
vendor-option listnames
Lists just the names of the vendor options.
Usage Guidelines
Defining Vendor-Specific DHCP Options
There are four main steps to configure Network Registrar to support a device that expects to receive vendor-specific DHCP options from the DHCP server:
Step 1
Step 2
Step 3
Step 4
The following example is based on the Intel Preboot Execution Environment (PXE) Specification, Version 2.0. For continuity and completeness, the example includes all three commands required to accomplish its task. See the "vendor-option" section and the "policy" section.
1.
nrcmd> option-datatype IntelPXE_odt_suboption_8 createnrcmd> option-datatype IntelPXE_odt_suboption_8 defineField boot_server_type 1 WORDnrcmd> option-datatype IntelPXE_odt_suboption_8 defineField boot_server_IP_list 2IPADDR_ARRAYnrcmd> option-datatype IntelPXE_odt_suboption_8 enable read-only2.
nrcmd> vendor-option IntelPXE_vso create "PXEclient:Arch:xxxxxx:UNDI:yyyzzz"3.
nrcmd> vendor-option IntelPXE_vso defineSuboption suboption_8 8IntelPXE_odt_suboption_8 array4.
a.
nrcmd> policy network-1.2.3 setVendorOption IntelPXE_vso {suboption_8[0]}boot_server_type 2nrcmd> policy network-1.2.3 setVendorOption IntelPXE_vso {suboption_8[0]}boot_server_IP_list 192.168.25.4,192.168.25.5b.
nrcmd> policy network-1.2.3 setVendorOption IntelPXE_vso {suboption_8[1]}boot_server_type 8nrcmd> policy network-1.2.3 setVendorOption IntelPXE_vso {suboption_8[1]}boot_server_IP_list 192.168.25.6Related Commands
zone
The zone command creates and edits DNS zones, as well as forces zone transfers. For additional information on zone scavenging, see the Network Registrar User's Guide.
zone name create primary file=BINDfile
zone name create primary nameserver person [attribute=value...]
zone name create secondary address [attribute=value...]
zone name delete
zone name enable attribute
zone name disable attribute
zone name set attribute=value [attribute=value...]
zone name unset attribute
zone name get attribute
zone name [show]
zone list
zone listnames
zone name forceXfer secondary
zone name addHost hostname IPaddress [alias...]
zone name removeHost hostname
zone name listHosts
zone name addRR owner [ttl] [class] type data
zone name removeRR owner [type [data]]
zone name removeDynRR owner [type]
zone name cleanRR
zone name listRR {all | static | dynamic}
zone name getScavengeStartTime
zone name scavenge
zone name chkpt
zone name dumpchkpt
Syntax Description
See Table 2-29 for the zone command attributes and their descriptions.
The name is the fully qualified domain name (FQDN), including the trailing dot.
zone name create primary file=BINDfile
Creates a primary zone by importing data from the BIND (zone) format file.
nrcmd> zone example.com. create primary file=host.localzone name create primary nameserver person [attribute=value...]
Creates a primary zone, along with the DNS name server and the person in charge (and optionally any additional attributes). Note that re-creating an existing zone overwrites the old one.
The zone command automatically creates the SOA and NS resource records for you. Use the zone name addRR command to create an A record for the name server that you specified in the nameserver value. The following example creates an SOA record ns.test.org. andy.test.org. and an NS record ns.test.org.
nrcmd> zone test.org. create primary ns andyBoth of these records have the name of the zone ("test.org." or "@"). Because name server ns.test.org. is in the test.org. zone, you must also provide an A record for it.
nrcmd> zone test.org. addRR ns A 192.168.2.2nrcmd> server dns reloadzone name create secondary address [attribute=value...]
Creates a secondary zone, along with the IP address of the primary name server for zone transfers (and optionally any additional attributes).
zone name delete
Deletes a zone.
zone name enable attribute
Enables an attribute of a zone.
zone name disable attribute
Disables an attribute of a zone.
zone name set attribute=value [attribute=value...]
Sets one or more attributes for a zone.
zone name unset attribute
Unsets the value of an attribute of the zone.
zone name get attribute
Gets the value of an attribute of the zone.
zone name [show]
Shows the values of all attributes for a zone.
zone list
Lists all zones and their attributes.
zone listnames
Lists just the zone names.
zone name forceXfer secondary
Forces the secondary server to initiate a zone transfer to a zone.
nrcmd> zone test.org. forceXfer secondary
Note
zone name addHost hostname IPaddress [alias...]
Adds the hostname to a zone, along with its IP address and optional aliases.
nrcmd> zone example.com. addHost bethpc 192.168.1.10zone name removeHost hostname
Removes a host from a zone.
zone name listHosts
Lists the hosts for a zone.
zone name addRR owner [ttl] [class] type data
Adds a resource record of a certain type for a zone. The attributes of this command are as follows:
•
•
•
•
•
For the resource record addition to take effect, you must reload the server. The following example adds a Name Server (NS) resource record.
nrcmd> zone example.com addRR @ NS ns.green.example.com.nrcmd> server dns reloadzone name removeRR owner [type [data]]
Removes all specified static resource records from a zone. Specify resource records by owner; owner and type; or owner, type, and data (in BIND-style format). Note that for the removal to take effect, you need to reload the server. See the attributes in the addRR syntax description. See the "Removing Resource Records" section.
zone name removeDynRR owner [type]
Removes all specified dynamic resource records. from a zone. Specify resource records by owner, or owner and type. The DNS server must be running. Changes take effect immediately; you do not need to reload the server. See the attributes in the addRR syntax description. See the "Removing Resource Records" section.
zone name cleanRR
Cleans out zone records that remain after you remove a zone. See the "Cleaning Resource Records" section. The following example deletes a zone's unused or obsolete resource records.
nrcmd> zone example.coms cleanRRzone name listRR {all | static | dynamic}
Displays the resource records for a zone. You can display all the resource records, or just the static or dynamic resource records.
zone name getScavengeStartTime
Gets the time for the next scheduled zone scavenging.
zone name scavenge
Causes scavenging on all zones that have enabled the scvg-enabled attribute.
zone name chkpt
Forces an update to the zone checkpoint database for the specified zone. Set the checkpoint interval using the zone name set checkpoint-interval command.
zone name dumpchkpt
Forces an update to the zone checkpoint database and creates a humanly readable file of the zone or checkpoint.
Attributes
Table 2-29 describes the zone command attributes.
Table 2-29 zone Command Attributes
auth-servers
set=
getFor a secondary zone only, the list of servers from which to transfer data. Required for a secondary zone, no default.
checkpoint-
intervalset=
get
unsetInterval (in seconds) at which to checkpoint the zone (take the latest snapshot in the zone checkpoint database). See the "Logging Checkpoint Files and Scavenging" section. Optional, default 3 hours, range 1-168 (7 days).
defttl
set=
get
unsetFor a primary zone only, default TTL for this zone. Network Registrar responds to authoritative queries with an explicit TTL value, if one exists. If none exists, it responds with the default TTL value. See the "Default TTL Responses" section. Required for a primary zone, default 86400 seconds (one day), range 0-2147483647 seconds.
dynamic
enable
disableFor a primary zone only, enables or disables RFC 2136 dynamic updates to the zone. The most typical source of these updates is a DHCP server. Required, default enable.
dynupdate-set
set=
get
For a primary zone only, with zone name enable dynamic, the set of IP addresses from which to accept dynamic updates. Network Registrar considers addresses with zeroes in the least significant octets as network numbers with implicit masks in octet multiples. Required, default no addresses.
expire
set=
get
For a primary zone only, expiration interval, in seconds, of the zone. The time a secondary can continue to serve zone data without confirming that it is still current. Optional, default 604800 seconds (seven days), range 0-2147483647 seconds.
ixfr
enable
disable
unsetFor a secondary zone only, enables or disables requesting incremental transfers. Overrides the ixfr-enable setting for the server. See the "Enabling Incremental Zone Transfers by Server or Zone" section. Optional, no default.
minttl
set=
get
For a primary zone only, minimum TTL for resource records for the zone. This is generally not used except under special configuration circumstances. See the "Default TTL Responses" section. Optional, range 0-2147483647, default, 86400.
notify
enable
disable
unsetEnables notifying other authoritative servers when this zone changes. The setting overrides the global notify value for this zone. Optional, no default.
notify-set
set=
get
List of additional servers to notify when the zone changes. All servers listed in NS records for the zone, except the server described by the ns zone attribute (mname field of the SOA record), receive notifications. Network Registrar also notifies servers listed in the notify-set value. Optional, defaults to empty.
ns
set=
getFor a primary zone only, fully-qualified domain name of the primary for this zone. This host is the original or primary source of data for this zone. Required, no default.
origin
get
Fully qualified name of the zone's root. Read-only.
person
set=
getFor a primary zone only, domain name that specifies the mailbox of the person responsible for this zone. The first label is a user or mail alias, the rest of the labels are a mail destination. A mailbox of hostmaster@test.com would become hostmaster.test.com. Required, no default.
refresh
set=
get
For a primary zone only, the refresh interval, in seconds, of the zone. Secondary servers use this as the period of polling for zone changes. Optional, default 10800 seconds (three hours), range 0-2147483647 seconds.
restricted-set
set=
getWith zone name enable restrict-xfer, the set of IP addresses that can request zone transfers. Network Registrar treats addresses with zeros in the least significant octets as network numbers, with implicit masks in octet multiples. Required, default zero entries, no value.
restrict-xfer
enable
disableIf enabled, restricts zone transfers to a specific set of hosts. If you restrict zone transfers, you need to use the restricted-set attribute to list the servers allowed to perform zone transfers. Required, default disable.
retry
set=
get
For a primary zone only, retry interval, in seconds, of the zone. Used by secondaries as the period of retrying when polling for changes, or attempting zone transfer after encountering errors. Optional, default 3600 seconds (one hour), range 0-2147483647 seconds.
scvg-enabled
enable
disableFor a primary zone only, enables or disables dynamic resource record scavenging (stale record cleanup) of the zone. Use this for Microsoft clients, with other scavenging attribute settings. See the Network Registrar User's Guide. This setting overrides that on the server level. Required, default disable.
scvg-ignore
restarts-
intervalset=
get
unsetFor a primary zone only, the interval, in seconds, for which a server restart does not recalculate a start scavenging time. This setting overrides that on the server level. Optional, no default.
scvg-interval
set=
get
unsetFor a primary zone only, with zone name enable scvg-enabled, the interval, in seconds, at which the zone is scheduled for scavenging. This setting overrides that on the server level. See the "Logging Checkpoint Files and Scavenging" section. Optional, range 3600 (one hour) through 31536000 seconds. If no values are set, Network Registrar uses the server default values.
scvg-no-
refresh-
intervalset=
get
unsetFor a primary zone only, with zone name enable scvg-enabled, the interval, in seconds, during which actions such as dynamic or prerequisite-only updates do not advance the timestamp for scavenging. This setting overrides that on the server level. Optional, range 3600 (one hour) through 31536000 seconds. If no values are set, Network Registrar uses the server default values.
scvg-refresh-
intervalset=
get
unsetFor a primary zone only, with zone name enable scvg-enabled, the interval, in seconds, during which the zone can have a timestamp updated to prepare for scavenging. This setting overrides that on the server level. Optional, range 3600 (one hour) through31536000 seconds. If no values are set, Network Registrar uses the server default values.
serial
set=
getFor a primary zone only, the current serial number of the zone, as found in its SOA record and maintained automatically by the DNS server. Required, no default, range 0-4294967295 seconds.
type
get
Type of role that the server should take for the zone, primary or secondary. Usually you only configure one server as primary for a zone, and configure several secondary servers to retrieve zone data through zone transfers. Read-only.
Usage Guidelines
Owner Names
You can specify the resource record's owner name as one of the following:
•
•
•
Default TTL Responses
Network Register responds to authoritative queries with an explicit TTL value. If there is no explicit TTL value, it uses the default TTL for the zone, as set by the value of the defttl zone attribute. Databases originating from versions of Network Registrar earlier than 3.5 do not have the defttl zone attribute, and use the minimum TTL in the zone's SOA record for the default TTL.
If you have an earlier version of Network Registrar and want to enforce the minimum SOA record TTL, contact the Cisco TAC. Enforcing the minimum SOA TTL causes Network Registrar not only to use the minttl zone attribute value as the default TTL, but also as a floor value—resource records with explicit TTL values smaller than minttl assume the minttl value.
Normally, Network Registrar assumes the default TTL when responding with a zone transfer with resource records that do not have explicit TTL values. If the default TTL value for the zone is administratively altered, Network Registrar automatically forces a full zone transfer to any secondary DNS server requesting a zone transfer.
Server Records
Windows 2000 domain controllers use the server (SRV) resource record to advertise services to the network. This resource record is defined in the RFC 2782, "A DNS RR for specifying the location of services (DNS SRV)." The RFC defines the format of the SRV record (DNS type code 33) as:
_service._protocol.name ttl class SRV priority weight port targetThere should always be an A record associated with the SRV record's target so that the client can resolve the service back to a host. In the Microsoft Windows 2000 implementation of SRV records, the records might look like this:
myserver.example.com A 10.100.200.11_ldap._tcp.example.com SRV 0 0 389 myserver.example.com_kdc._tcp.example.com SRV 0 0 88 myserver.example.com_ldap._tcp.dc._msdcs.example.com SRV 0 0 88 myserver.example.comAn underscore always precedes the service and protocol names. In the example, _kdc is the Kerberos Data Center. The priority and weight help you choose between target servers providing the same service (the weight differentiating those with equal priorities). If the priority and weight are all set to zero, the DNS server orders the clients randomly.
For more information on SRV records, see the Resource Records appendix of the Network Registrar User's Guide.
Enabling Incremental Zone Transfers by Server or Zone
Using the server incremental zone transfer setting (dns enable ixfr-enable) gives you an easy way of globally turning incremental zone transfer (IXFR) on or off, or setting a general policy for your zones and specific exceptions to the server global value. With the zone ixfr setting (zone name enable|disable ixfr), if you:
•
•
Removing Resource Records
When there are multiple SRV records of the same owner, the zone name removeRR command removes all resource records having that owner. To remove only the resource records of a specific type, or to remove only a specific one, include the type, or type and data options. The following example removes all static resource records for the zone that have owner name green.
nrcmd> zone example.com. removeRR greenThe following example removes only Address resource records that have owner name green.
nrcmd> zone example.com. removeRR green AThe following example removes only a specific static resource record with owner name green.
nrcmd> zone example.com. removeRR green A 192.168.1.52Cleaning Resource Records
The zone name cleanRR command cleans the leftover zone records after you delete a zone. It uses the DNS server's historical zone data to determine what part of this data to remove. Use the cleanRR keyword if you periodically delete and re-import zones, which can cause your database to grow.
The behavior of the cleanRR keyword depends on the presence or absence of a new zone:
•
•
The cleanRR keyword does not print out a list of records to delete or prompt you for confirmation. You can safely run it at any time.
Logging Checkpoint Files and Scavenging
Use the dns set log-settings=chkpt command to log when checkpointing occurs for the DNS server for dynamic resource records. Use the dns set log-settings=scavenge command to log the resource records purged by scavenging. See Table 2-9.
TTL in Zone File Exports and Imports
When Network Registrar receives a export zone CLI command, it records the default TTL for the zone in a BIND directive ($TTL). The value of the directive is determined by the rules that the "Default TTL Responses" section describes.
Network Registrar also recognizes $TTL directives for zone file imports. The first $TTL directive it encounters serves as the default TTL for the zone. This value is assigned to defttl for future use. Subsequent $TTL directives do not override the first directive; that is, they do not change the default TTL for the zone. Instead, they provide the TTL for subsequent resource records that have no explicit TTL values. Consider the following BIND zone file:
$ORIGIN c.@ IN SOA ns joe 10 10800 3600 604800 7200$TTL 3600z IN A 1.2.3.4$TTL 7200y IN A 1.2.3.5x 1800 IN A 1.2.3.6$TTL 9800w IN A 1.2.3.7t 13400 IN A 1.2.3.8This file is imported as:
default TTL: 3600c. IN SOA ns joe 10 10800 3600 604800 7200z IN A 1.2.3.4y 7200 IN 1.2.3.5x 1800 IN A 1.2.3.6w 9800 IN 1.2.3.7t 13400 IN A 1.2.3.8Notice that z does not have an explicit TTL value. Instead, it assumes the default TTL (3600). Also, notice that Network Registrar assigns both y and w explicit TTL values based on the last encountered $TTL directives.
If the BIND zone file contains no $TTL directives, Network Registrar assumes the SOA minimum TTL value (the last value in the SOA record data) as the default TTL. For example, the zone file that follows is missing a $TTL directive:
$ORIGIN c.@ IN SOA ns joe 10 10800 3600 604800 7200z IN A 1.2.3.4y IN A 1.2.3.5x 1800 IN A 1.2.3.6w IN A 1.2.3.7t 13400 IN A 1.2.3.8Network Registrar imports this file as:
default TTL: 7200c. IN SOA ns joe 10 10800 3600 604800 7200z IN A 1.2.3.4y IN 1.2.3.5x 1800 IN A 1.2.3.6w IN 1.2.3.7t 13400 IN A 1.2.3.8Related Commands
