Feedback
Table Of Contents
Cisco Nexus 1000V Series Switch Commands
copy running-config startup-config
Cisco Nexus 1000V Series Switch Commands
This chapter provides information about the Cisco Virtual Security Gateway (VSG) related commands on the Cisco Nexus 1000V Series switch and the Cisco Nexus 1010 networking appliance.
capability l3-vn-service
To configure a port profile to be used with l3-vn-service, use the capability l3-vn-service command. To remove the capability from a port profile, use the no form of this command.
capability l3-vn-service
no capability l3-vn service
Syntax Description
Defaults
None
Command Modes
Port-profile configuration (config-port-prof)
network-admin
Command History
Usage Guidelines
If you are configuring a port profile for l3-vn-service, you must first configure the port profile in switchport mode.
The capability iscsi-multipath feature cannot be configured with the capability l3-vn-service feature.
Examples
This example shows how to configure a port profile to be used with l3-vn-service:
n1000v# config tn1000v(config)# port-profile testprofilen1000v(config-port-prof)# switchport mode accessn1000v(config-port-prof)# capability l3-vn-servicen1000v(config-port-prof)#This example shows how to remove the l3-vn-service configuration from the port profile:
n1000v# config tn1000v(config)# port-profile testprofilen1000v(config-port-prof)# no capability l3-vn-servicen1000v(config-port-prof)#Related Commands
clear vsn connection
To clear Cisco VSG connections, use the clear vsn connection command.
clear vsn connection [module module-number]
Syntax Description
Defaults
None
Command Modes
EXEC
Global configuration (config)
Supported User Rolesnetwork-admin
network-operator
Command History
Examples
This example shows how to clear Cisco VSG connections:
vsm# clear vsn connectionRelated Commands
clear vsn statistics
To clear Cisco VSG statistics, use the clear vsn statistics command.
clear vsn statistics [module module-number | vlan vlan-number ip ip-address [module module-number]]
Syntax Description
Defaults
None
Command Modes
EXEC
Global configuration (config)
Supported User Rolesnetwork-admin
network-operator
Command History
Examples
This example shows how to clear Cisco VSG statistics:
vsm# clear vsn statisticsRelated Commands
copy running-config startup-config
To copy the running configuration to the startup configuration, use the copy running-config startup-config command.
copy running-config startup-config
Syntax Description
This command has no arguments or keywords.
Defaults
None
Command Modes
Any command mode
Supported User Rolesnetwork-admin
network-operatorCommand History
Usage Guidelines
Use this command to save configuration changes in the running configuration to the startup configuration in persistent memory. When a device reload or switchover occurs, the saved configuration is applied.
Examples
This example shows how to save the running configuration to the startup configuration:
vsm# copy running-config startup-config[########################################] 100%Related Commands
log-level
To set logging severity levels for the Cisco Virtual Network Management Center (VNMC) policy agent, use the log-level command. To reset logging levels, use the no form of this command.
log-level {critical | debug0 | debug1 | debug2 | debug3 | debug4 | info | major | minor | warn}
no {critical | debug0 | debug1 | debug2 | debug3 | debug4 | info | major | minor | warn}
Syntax Description
Command Default
None
Command Modes
Cisco VNMC policy agent configuration (config-vnm-policy-agent)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to set the logging level to critical:
vsm# configurevsm(config)# vnm-policy-agentvsm(config-vnm-policy-agent)# log-level criticalRelated Commands
org
To create a Cisco VNMC organization (domain), use the org command. To delete a Cisco VNMC organization, use the no form of the command.
org organization-name
no org [organization-name]
Syntax Description
Command Default
None
Command Modes
Port profile configuration (config-port-prof)
Supported User Rolesnetwork-admin
Command History
Usage Guidelines
Cisco VNMC organizations are Cisco VNMC domains.
You can hierarchically manage Cisco VNMC organizations. A user that is assigned at a top level organization has automatic access to all organizations under it. For example, an engineering organization can contain a software engineering organization and a hardware engineering organization. A locale containing only the software engineering organization has access to system resources only within that organization. However, a locale that contains the engineering organization has access to the resources for both the software engineering and hardware engineering organizations.
Examples
This example shows how to create an organization:
vsm# configureEnter configuration commands, one per line. End with CNTL/Z.vsm(config)# port-profile pP1vsm(config-port-prof)# org orgpP1vsm(config-port-prof)#Related Commands
ping vsn
To ping the virtual service nodes (VSN) (including the Cisco VSG) from the vPath, use the ping vsn command. There is no no form of this command.
ping vsn {ip vsn-ip-addr [vlan vsn-vlan-num] | all} {src-module {module-num | all | vpath-all} [timeout secs] [count count]
Syntax Description
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
Command History
4.2(1)VSG(3.1)
The output of the ping-vsn command was changed to include the examples that show all of the source module traffic.
4.2(1)VSG1(2)
This command was introduced.
Usage Guidelines
There is no no form of this command.
Examples
This example shows how to ping a Cisco VSG:
vsm# ping ?<CR>A.B.C.D or Hostname IP address of remote systemWORD Enter Hostnamempls Ping an MPLS networkmulticast Multicast pingvsn VSNs to be pingedvsm# ping vsnInput parameters:· vsn : VSNs to be pinged.o all : All VSNs that are currently associated to at least one VM. In other words, all VSNs specified in port-profiles that are bound to at least one VM.o ip-addr <ip-addr> : All VSNs configured with this IP address.o vlan <vlan-num> : All VSNs configured on this VLAN.· src-module : Source modules to orginate ping request from.o all : All online modules.o vpath-all : All modules having VMs associated to port-profiles that has vn-service defined.o <module-num> : A online module number.· timeout <secs> : Time to wait for response from VSNs, in seconds. Default is 1 sec.· count : Number of ping packets to be sent.o <count> : Sepcifies number of ping packets to be sent. Default is 5. Min 1, Max 2147483647.o unlimited : Send ping packets until command is stopped.Specify both the IP address and VLAN if the VSN to be pinged is not associated to any VMs yet.
In the output, the status of the ping request for each VSN for each module is shown. On a successful ping, the round-trip-time of ping request/response for a VSN is shown in microseconds next to the module number. On a failure, the failure message is shown next to the module number.
Various forms:ping vsn all src-module all (Ping all VSNs from all modules)ping vsn all src-module vpath-all (Ping all VSNs from all modules havingVMs associated to VSNs)ping vsn all src-module 3 (Ping all VSNs from the specified module)ping vsn ip 106.1.1.1 src-module all (Ping specified VSN from all modules)ping vsn ip 106.1.1.1 vlan 54 src-module all (Ping specified VSN from all modules)ping vsn ip 106.1.1.1 src-module vpath-all (Ping specified VSN from all moduleshaving VMs associated to VSNs)ping vsn ip 106.1.1.1 vlan 54 src-module 3 (Ping specified VSN from specifiedmodule)The options timeout and count apply to all of the above commands:
ping vsn all src-vpath all timeout 2 count 10ping vsn all ip 106.1.1.1 count unlimitedping vsn ip 106.1.1.1 vlan 54 src-vpath 3 count 10Errors:VSN response timeout - VSN is down, not reachable or not responding.VSN ARP not resolved - VEM couldn't resolve MAC address of VSN.no response from VEM - VEM is not sending ping response to VSM. Can happen when VEMis down and VSM not detected it yet.These examples show how to display all of the source module traffic:
vsm# ping vsn all src-module allping vsn 10.1.1.44 vlan 501 from module 9 10 11 12, seq=0 timeout=1-secmodule(usec) : 9(508)module(failed) : 10(VSN ARP not resolved) 11(VSN ARP not resolved)12(VSN ARP not resolved)ping vsn 10.1.1.40 vlan 0 from module 9 10 11 12, seq=0 timeout=1-secmodule(usec) : 9(974) 11(987) 12(1007)module(failed) : 10(VSN ARP not resolved)ping vsn 10.1.1.44 vlan 501 from module 9 10 11 12, seq=1 timeout=1-secmodule(usec) : 9(277) 10(436) 11(270) 12(399)ping vsn 10.1.1.40 vlan 0 from module 9 10 11 12, seq=1 timeout=1-secmodule(usec) : 9(376) 10(606) 11(468) 12(622)ping vsn 10.1.1.44 vlan 501 from module 9 10 11 12, seq=2 timeout=1-secmodule(usec) : 9(272) 10(389) 11(318) 12(357)ping vsn 10.1.1.40 vlan 0 from module 9 10 11 12, seq=2 timeout=1-secmodule(usec) : 9(428) 10(632) 11(586) 12(594)ping vsn 10.1.1.44 vlan 501 from module 9 10 11 12, seq=3 timeout=1-secmodule(usec) : 9(284) 10(426) 11(331) 12(387)ping vsn 10.1.1.40 vlan 0 from module 9 10 11 12, seq=3 timeout=1-secmodule(usec) : 9(414) 10(663) 11(644) 12(698)ping vsn 10.1.1.44 vlan 501 from module 9 10 11 12, seq=4 timeout=1-secmodule(usec) : 9(278) 10(479) 11(334) 12(469)ping vsn 10.1.1.40 vlan 0 from module 9 10 11 12, seq=4 timeout=1-secmodule(usec) : 9(397) 10(613) 11(560) 12(593)vsm# ping vsn ip 10.1.1.40 src-module vpath-all
ping vsn 10.1.1.40 vlan 0 from module 9 11 12, seq=0 timeout=1-sec
module(usec) : 9(698) 11(701) 12(826)
ping vsn 10.1.1.40 vlan 0 from module 9 11 12, seq=1 timeout=1-sec
module(usec) : 9(461) 11(573) 12(714)
ping vsn 10.1.1.40 vlan 0 from module 9 11 12, seq=2 timeout=1-sec
module(usec) : 9(447) 11(569) 12(598)
ping vsn 10.1.1.40 vlan 0 from module 9 11 12, seq=3 timeout=1-sec
module(usec) : 9(334) 11(702) 12(559)
ping vsn 10.1.1.40 vlan 0 from module 9 11 12, seq=4 timeout=1-sec
module(usec) : 9(387) 11(558) 12(597)
vsm#Related Commands
policy-agent-image
To designate the policy agent image local URL as bootflash, use the policy-agent-image command. To remove the designation, use the no form of the command.
policy-agent-image bootflash:
no policy-agent-image bootflash:
Syntax Description
Command Default
None
Command Modes
VNMC policy agent configuration (config-vnm-policy-agent)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to designate the local URL that contains the policy agent image:
vsm# configurevsm(config)# vnm-policy-agentvsm(config-vnm-policy-agent)# policy-agent-image bootflash:Related Commands
pop
To pop a mode off the stack or to restore a mode, use the pop command.
pop file-name
Syntax Description
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to restore from a file called file1:
vsm# pop file1Related Commands
port-profile
To create a port profile and enter port profile configuration mode, use the port-profile command. To remove the port profile configuration, use the no form of this command.
port-profile profile-name
no port-profile profile-name
Syntax Description
Defaults
None
Command Modes
Global configuration (config)
Supported User Rolesnetwork-admin
Command History
Usage Guidelines
The port profile name must be unique for each port profile.
Examples
This example shows how to create a port profile called AccessProf:
vsm# configurevsm(config)# port-profile AccessProfvsm(config-port-prof)#This example shows how to remove the port profile called AccessProf:
vsm# configurevsm(config)# no port-profile AccessProfvsm(config)#Related Commands
push
To push the current mode onto stack or to save it, use the push command.
push file-name
Syntax Description
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to push file1 onto the stack:
vsm# push file1Related Commands
registration-ip
To set the service registry IP address, use the registration-ip command. To discard the service registry IP address, use the no form of this command.
registration-ip ip-address
no registration-ip ip-address
Syntax Description
Command Default
None
Command Modes
Cisco VNMC policy agent configuration mode (config-vnm-policy-agent)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to set the service registry IP address:
vsm# configurevsm(config)# vnm-policy-agentvsm(config-vnm-policy-agent)# registration-ip 209.165.200.233vsm(config-vnm-policy-agent)#Related Commands
shared-secret
To set the shared secret password for communication between the Cisco Virtual Security Gateway (VSG), the Virtual Supervisor Module (VSM), and the Cisco Virtual Network Management Center (VNMC), use the shared-secret command. To discard the shared secret password, use the no form of this command.
shared-secret shared-secret-password
no shared-secret shared-secret-password
Syntax Description
shared-secret-password
Shared secret password. The range of valid values is from 1 to 64. You must use at least one uppercase character.
Command Default
None
Command Modes
Cisco VNMC policy agent configuration mode (config-vnm-policy-agent)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to set the shared secret password:
vsm# configurevsm(config)# vnm-policy-agentvsm(config-vnm-policy-agent)# shared-secret Password123vsm(config-vnm-policy-agent)#Related Commands
show running-config
To display the running configuration, use the show running-config command.
show running-config [aaa | aclmgr | all | am | arp | cdp | diff | exclude | expand-port-profile | icmpv6 | igmp | interface | ip | ipqos | ipv6 | l3vm | license | monitor | ntp | port-profile | port-security | radius | rpm | security | snmp | vdc-all | vlan | vshd]
Syntax Description
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
network-operator
Command History
Usage Guidelines
You can use the following operators with the show running-config command:
•
>—Redirects the output to a file.
•
•
Examples
This example shows how to display the running configuration:
vsm# show running-config!Command: show running-config!Time: Tue Jan 4 17:20:05 2011version 4.2(1)SV1(4)no feature telnetusername admin password 5 $1$z3M0/3no$j77mpF9f/mqmd7/mEZ6RR1 role network-adminusername adminbackup password 5 $1$Oip/C5Ci$oOdx7oJSlBCFpNRmQK4na. role network-operatorbanner motd #Nexus 1000v Switch#ip domain-lookupip domain-lookupswitchname vsmvem 3host vmware id 765186a7-eb7c-11de-b059-8843e1389748vem 4host vmware id 90a97ac6-31d7-11df-ad65-68efbdf622cavem 5host vmware id 833fe152-3f8b-11df-bd70-68efbdf64970snmp-server user admin network-admin auth md5 0x5ed3cfea7c44550ac3d18475f28b118bpriv 0x5ed3cfea7c44550ac3d18475f28b118b localizedkeyvrf context managementip route 0.0.0.0/0 10.193.72.1vlan 1,61-65port-channel load-balance ethernet source-macport-profile default max-ports 32port-profile default port-binding staticport-profile type vethernet vm-clearvmware port-groupswitchport mode accessswitchport access vlan 63no shutdownstate enabledport-profile type vethernet vsn-servicevmware port-groupswitchport mode accessswitchport access vlan 64no shutdownmax-ports 1024state enabledport-profile type ethernet system-uplinkvmware port-groupswitchport trunk allowed vlan 61-70switchport mode trunkno shutdownsystem vlan 61-62state enabledport-profile type vethernet vsg129-2vmware port-groupswitchport mode accessswitchport access vlan 63org root/Canonvn-service ip-address 10.10.129.2 vlan 64 security-profile sp-vsg2-1no shutdownstate enabledport-profile type vethernet vsg134-1vmware port-groupswitchport mode accessswitchport access vlan 63vn-service ip-address 10.10.134.1 vlan 64 mgmt-ip-address 10.10.73.132 security-profile sp1no shutdownstate enabledport-profile type vethernet vsg136-1vmware port-groupswitchport mode accessswitchport access vlan 63vn-service ip-address 10.10.136.1 vlan 64 mgmt-ip-address 10.10.73.137 security-profile sp1no shutdownstate enabledport-profile type vethernet vsg129_2-svc-vlan65vmware port-groupswitchport mode accessswitchport access vlan 65vn-service ip-address 10.10.129.2 vlan 64 mgmt-ip-address 10.10.73.131 security-profile sp1no shutdownstate enabledport-profile type vethernet vm-clear-vlan65vmware port-groupswitchport mode accessswitchport access vlan 65no shutdownstate enabledport-profile type ethernet Unused_Or_Quarantine_Uplinkvmware port-groupshutdowndescription Port-group created for Nexus1000V internal usage. Do not use.state enabledport-profile type vethernet Unused_Or_Quarantine_Vethvmware port-groupshutdowndescription Port-group created for Nexus1000V internal usage. Do not use.state enabledport-profile type vethernet vm-clear-vlan63vmware port-groupswitchport mode accessswitchport access vlan 63no shutdownstate enabledvdc vsm id 1limit-resource vlan minimum 16 maximum 2049limit-resource monitor-session minimum 0 maximum 2limit-resource vrf minimum 16 maximum 8192limit-resource port-channel minimum 0 maximum 768limit-resource u4route-mem minimum 32 maximum 32limit-resource u6route-mem minimum 16 maximum 16limit-resource m4route-mem minimum 58 maximum 58limit-resource m6route-mem minimum 8 maximum 8interface mgmt0ip address 10.10.73.130/21interface Vethernet1inherit port-profile vm-clear-vlan63description UD134-1,Network Adapter 2vmware dvport 7489 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.0029interface Vethernet2inherit port-profile vsg136-1description UD136-1,Network Adapter 2vmware dvport 7458 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.0032interface Vethernet3inherit port-profile vm-clear-vlan63description US136-1,Network Adapter 2vmware dvport 7492 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.0030interface Vethernet4inherit port-profile vsg129-2description US129-1,Network Adapter 2vmware dvport 6563 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.003Einterface Vethernet5inherit port-profile vm-clear-vlan63description US129-2,Network Adapter 2vmware dvport 7491 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.0040interface Vethernet6inherit port-profile vsn-servicedescription VSG134-1,Network Adapter 1vmware dvport 3683 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.002Cinterface Vethernet7inherit port-profile vsn-servicedescription VSG129-2,Network Adapter 1vmware dvport 3686 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.0037interface Vethernet8inherit port-profile vsn-servicedescription VSG136-1,Network Adapter 1vmware dvport 3684 dvswitch uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c"vmware vm mac 0050.56BB.0034interface Ethernet3/2inherit port-profile system-uplinkinterface Ethernet4/6inherit port-profile system-uplinkinterface Ethernet5/6inherit port-profile system-uplinkinterface control0line consoleboot kickstart bootflash:/ks.bin sup-1boot system bootflash:/sys.bin sup-1boot kickstart bootflash:/ks.bin sup-2boot system bootflash:/sys.bin sup-2svs-domaindomain id 61control vlan 61packet vlan 62svs mode L2svs connection vcenterprotocol vmware-vimremote ip address 10.10.79.32 port 80vmware dvs uuid "90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2c" datacenter-name NAME/Sconnectvnm-policy-agentregistration-ip 10.193.73.144shared-secret **********policy-agent-image bootflash:/vnmc-vsmpa.1.0.0.512.binlog-levelvsm#Related Commands
show vnm-pa status
To display the installation status of a policy agent, use the show vnm-pa status command.
show vnm-pa status
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Global configuration (config)
Supported User Rolesnetwork-admin
network-operator
Command History
Usage Guidelines
You can use the following operators with the show vnm-pa status command:
•
•
•
Examples
This example shows how to display the installation status of the policy agent:
vsm# configurevsm(config)# show vnm-pa statusVNM Policy-Agent status is - Installed Successfully. Version 1.0(0.512)-vsmvsm(config)#Related Commands
show vsn brief
To display a brief amount of information about the Cisco Virtual Security Gateway (VSG), use the show vsn brief command.
show vsn brief
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
network-operator
Command History
4.1(2)SV1(5.1)
The output of the show vsn brief was changed to show the information about the Cisco VSG sin L2 and L3 mode.
4.0(4)SV1(1)
This command was introduced.
Usage Guidelines
You can use the following operators with the show vsn brief command:
•
•
•
Examples
This example shows how to display brief information about the Cisco VSGs:
vsm# show vsn briefVLAN IP-ADDR MAC-ADDR FAIL-MODE STATE MODULE501 10.1.1.44 00:50:56:8f:5a:85 Close Up 9- 10.1.1.40 - Close Up 11,12vsm#In this example, VSG 10.1.1.44 is in L2 mode and VSG 10.1.1.40 is in L3 mode.
Related Commands
show vsn connection
To display Cisco VSG connections, use the show vsn connection command.
show vsn connection [vlan vlan-num | ip ip-addr | module module-num]
Syntax Description
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
network-operator
Command History
Usage Guidelines
You can use the following operators with the show vsn connection command:
•
•
•
Examples
This example shows how to display Cisco VSG connections:
vsm# show vsn connectionLegend:A - seen ack for syn/fin from src a - seen ack for syn/fin from dstE - tcp conn established (SasA done)F - seen fin from src f - seen fin from dstO - conn offloaded to vPath at src o - conn offloaded to vPath at dstP - policy at src p - policy at dstR - seen rst from src r - seen rst from dstS - seen syn from src s - seen syn from dstT - tcp conn torn down (FafA done) v - vlan segment numberx - IP-fragment connectionVSG IP 200.20.201.183 VLAN 3756#Module 3Proto SrcIP[:Port] DstIP[:Port] V(X)LAN Action Flags Bytesicmp 172.31.2.117 172.31.2.113 v-3726 permit PpOo 65149126VSG IP 10.10.11.202 VLAN 3756#Module 3Proto SrcIP[:Port] DstIP[:Port] V(X)LAN Action Flags Bytesicmp 172.31.2.91 172.31.2.92 3070 permit po 980vsm#Related Commands
show vsn detail
To display detailed information about the Cisco Virtual Security Gateway (VSG), use the show vsn detail command.
show vsn detail
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
network-operator
Command History
4.2.1SV1(5.1)
The output of the show vsn detail command was changed to show the detailed information about Cisco VSGs.
4.0(4)SV1(1)
This command was introduced.
Usage Guidelines
You can use the following operators with the show vsn detail command:
•
•
•
Examples
This example shows how to display detailed information about Cisco VSGs:
vsm# show vsn detail#VSN VLAN: -, IP-ADDR: 10.1.1.40MODULE VSN-MAC-ADDR FAIL-MODE VSN-STATE9 - Close Up11 - Close Up12 - Close Up#VSN VLAN: -, IP-ADDR: 10.1.1.68MODULE VSN-MAC-ADDR FAIL-MODE VSN-STATE12 - Close Up#VSN VLAN: 502, IP-ADDR: 10.1.1.45MODULE VSN-MAC-ADDR FAIL-MODE VSN-STATE11 00:50:56:8f:5a:bb Close Up12 00:50:56:8f:5a:bb Close Up#VSN VLAN: 501, IP-ADDR: 10.1.1.44MODULE VSN-MAC-ADDR FAIL-MODE VSN-STATE9 00:50:56:8f:5a:85 Close Up11 00:50:56:8f:5a:85 Close Up#VSN VLAN: 501, IP-ADDR: 10.1.1.40MODULE VSN-MAC-ADDR FAIL-MODE VSN-STATE9 00:50:56:8e:35:bd Close Up11 00:50:56:8e:35:bd Close Up#VSN VLAN: 501, IP-ADDR: 10.1.1.41MODULE VSN-MAC-ADDR FAIL-MODE VSN-STATE11 00:50:56:8f:5a:7f Close Up#VSN Ports, Port-Profile, Org & Security-Profile Association:#VSN VLAN: -, IP-ADDR: 10.1.1.40Port-Profile: segment-5000-routed, Security-Profile: tenant1-sp1, Org: root/tenant1Module Vethernet9 411 36, 2512 69, 26, 67Port-Profile: segment-5001, Security-Profile: tenant1-sp1, Org: root/tenant1Module Vethernet9 45#VSN VLAN: -, IP-ADDR: 10.1.1.68Port-Profile: N1010-L3, Security-Profile: n1010-sp, Org: root/tenant1Module Vethernet12 41, 46#VSN VLAN: 502, IP-ADDR: 10.1.1.45Port-Profile: segment-5002, Security-Profile: tenant3-sp2, Org: root/tenant3Module Vethernet3 84, 854 86Port-Profile: tenant3-sp2, Security-Profile: tenant3-sp2, Org: root/tenant3Module Vethernet11 37, 40, 39, 3812 74#VSN VLAN: 501, IP-ADDR: 10.1.1.44Port-Profile: tenant1-vsg2, Security-Profile: tenant1-sp2, Org: root/tenant1Module Vethernet9 49, 55, 54, 53, 52, 51, 50, 56, 63, 62,61, 60, 59, 58, 57, 6, 7, 13, 14, 15,2, 111 16, 17, 22, 21, 20, 19, 18#VSN VLAN: 501, IP-ADDR: 10.1.1.40Port-Profile: data-53, Security-Profile: tenant1-sp1, Org: root/tenant1Module Vethernet9 2411 23#VSN VLAN: 501, IP-ADDR: 10.1.1.41Port-Profile: tenant2, Security-Profile: tenant2-sp1, Org: root/tenant2Module Vethernet11 68, 12, 72vsm#Related Commands
show vsn port vethernet
To display information about virtual Ethernet (vEth) ports, use the show vsn port vethernet command.
show vsn port vethernet port-number
Syntax Description
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
network-operatorCommand History
Usage Guidelines
You can use the following operators with the show vsn port vethernet command:
•
•
•
Examples
This example shows how to display information about vEth port 2:
vsm# show vsn port vethernet 2Veth : Veth2VM Name : UD136-1VM uuid : 42 3b e1 60 17 e6 92 c4-3b 47 f4 b7 4c a0 be 1bDV Port : 7458DVS uuid : 90 33 3b 50 c2 11 2a 50-ae c5 0f 07 b2 b3 23 2cFlags : 0x148VSN Data IP : 192.168.136.1Security Profile : sp1Org : Not setVNSP id : 1IP addresses:vsm#Related Commands
show vsn statistics
To display Cisco VSG statistics, use the show vsn statistics command.
show vsn statistics [ip | module | vlan]
Syntax Description
ip
(Optional) Displays IP statistics.
mode
(Optional) Displays module statistics.
vlan
(Optional) Displays VLAN statistics.
Command Default
None
Command Modes
EXEC
Supported User Rolesnetwork-admin
network-operatorCommand History
Usage Guidelines
You can use the following operators with the show vsn statistics command:
•
•
•
Examples
This example shows how to display statistics for a module:
vsm# show vsn statistics module 3#VSN VLAN: 64, IP-ADDR: 192.168.129.2Module: 3#VPath Packet Statistics Ingress Egress TotalTotal Seen 8249 24572 32821Policy Redirects 7796 23260 31056No-Policy Passthru 441 1267 1708Policy-Permits Rcvd 7796 23260 31056Policy-Denies Rcvd 0 0 0Permit Hits 10 45 55Deny Hits 0 0 0Decapsulated 7796 23260 31056Fail-Open 0 0 0Badport Err 0 0 0VSN Config Err 0 0 0ARP Resolve Err 2 0 2Encap Err 0 0 0All-Drops 2 0 2Total Rcvd From VSN 31056Non-Cisco Encap Rcvd 0VNS-Port Drops 0Policy-Action Err 0Decap Err 0L2-Frag Sent 0L2-Frag Rcvd 0L2-Frag Coalesced 0#VPath Flow StatisticsActive Flows 0 Active Connections 0Forward Flow Create 7799 Forward Flow Destroy 7799Reverse Flow Create 7799 Reverse Flow Destroy 7799Flow ID Alloc 15598 Flow ID Free 15598Connection ID Alloc 7799 Connection ID Free 7799L2 Flow Create 0 L2 Flow Destroy 0L3 Flow Create 4 L3 Flow Destroy 4L4 TCP Flow Create 0 L4 TCP Flow Destroy 0L4 UDP Flow Create 15594 L4 UDP Flow Destroy 15594L4 Oth Flow Create 0 L4 Oth Flow Destroy 0Embryonic Flow Create 0 Embryonic Flow Bloom 0L2 Flow Timeout 0 L2 Flow Offload 0L3 Flow Timeout 5 L3 Flow Offload 2L4 TCP Flow Timeout 0 L4 TCP Flow Offload 0L4 UDP Flow Timeout 23393 L4 UDP Flow Offload 31054L4 Oth Flow Timeout 0 L4 Oth Flow Offload 0Flow Lookup Hit 23314 Flow Lookup Miss 15598Flow Dual Lookup 38912 L4 TCP Tuple-reuse 0Flow Classify Err 0 Flow ID Alloc Err 0Conn ID Alloc Err 0 Hash Alloc Err 0Flow Exist 0 Flow Entry Exhaust 0Flow Removal Err 0 Bad Flow ID Receive 0Flow Entry Miss 0 Flow Full Match Err 0Bad Action Receive 0 Invalid Flow Pair 0Invalid Connection 0Hash Alloc 0 Hash Free 0InvalFID Lookup 0 InvalFID Lookup Err 0Deferred Delete 0vsm#Related Commands
state (port profile)
To enable the operational state of a port profile, use the state command. To disable the operational state of a port profile, use the no form of the command.
state enabled
no state enabled
Syntax Description
Defaults
Disabled
Command Modes
Port profile configuration (config-port-prof)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to enable the operational state of a port profile:
vsm# configurevsm(config)# port-profile testprofilevsm(config-port-prof)# state enabledvsm(config-port-prof)#Related Commands
switchport mode
To set the port mode of an interface, use the switchport mode command. To remove the port mode configuration, use the no form of this command.
switchport mode {access | private-vlan {host | promiscuous} | trunk}
no switchport mode {access | private-vlan {host | promiscuous} | trunk}
Syntax Description
Defaults
Switchport mode is not set.
Command Modes
Interface configuration (config-if)
Port profile configuration (config-port-prof)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to set the port mode of an interface:
vsm# configurevsm(config)# interface vethernet 1vsm(config-if)# switchport mode private-vlan hostvsm(config-if)#This example shows how to remove the mode configuration:
vsm# configurevsm(config)# interface vethernet 1vsm(config-if)# no switchport mode private-vlan hostvsm(config-if)#Related Commands
switchport access vlan
To set the access mode of an interface, use the switchport access vlan command. To remove the access mode configuration, use the no form of this command.
switchport access vlan vlan-id
no switchport access vlan vlan-id
Syntax Description
Defaults
Access mode is not set.
Command Modes
Interface configuration (config-if)
Port profile configuration (config-port-prof)
Supported User Rolesnetwork-admin
Command History
Examples
This example shows how to set the access mode of an interface:
vsm# configurevsm(config)# interface vethernet 1vsm(config-if)# switchport access vlan 100vsm(config-if)#This example shows how to remove the access mode configuration:
vsm# configurevsm(config)# interface vethernet 1vsm(config-if)# no switchport access vlanvsm(config-if)#Related Commands
tcp state-checks
To configure the switch to perform TCP state checks, use the tcp state-checks command. To disable TCP state checks, use the no form of this command.
tcp state-checks
no tcp state-checks
Syntax Description
This command has no arguments or keywords.
Defaults
TCP state checks are enabled.
Command Modes
Global configuration (config)
Supported User Rolesnetwork-admin
system-admin
Command History
Usage Guidelines`
Because TCP state checks in vPath are enabled by default, use the no form of the tcp state-checks command to disable the state checks.
Examples
This example shows how to enter the TCP state checks submode:
vsm# configvsm(config)# tcp state-checksvsm(config-vsn)#vlan
To create a VLAN and enter the VLAN configuration mode, use the vlan command. To remove a VLAN, use the no form of this command.
vlan {id | dot1Q tag native}
no vlan {id | dot1Q tag native}
Syntax Description
id
VLAN identification number. The range is from 1 to 4094.
dot1Q tag native
Specifies an IEEE 802.1Q virtual LAN.
Defaults
VLAN 1
Command Modes
Global configuration (config)
Supported User Rolesnetwork-admin
Command History
Usage Guidelines
Specify a VLAN range by using a dash. For example, 1-9 or 20-30.
Examples
This example shows how to create a VLAN and enter the VLAN configuration mode:
vsm# configurevsm (config)# vlan 100vsm (config-vlan)#This example shows how to remove a VLAN:
switch# configureswitch(config)# no vlan 100switch(config)#Related Commands
vmware port-group
To create a VMware port group, use the vmware port-group command. To remove the VMware port group, use the no form of this command.
vmware port-group name
no vmware port-group name
Syntax Description
Defaults
None
Command Modes
Port profile configuration (config-port-prof)
Supported User Rolesnetwork-admin
Command History
Usage Guidelines
To create the VMware port group, you must be in port profile configuration mode.
Examples
This example shows how to create a VMware port group:
vsm# configurevsm(config)# port-profile testprofilevsm(config-port-prof)# vmware port-group testgroupvsm(config-port-prof)#The following example shows how to remove the VMware port group:
vsm# configurevsm(config)# port-profile testprofilevsm(config-port-prof)# no vmware port-group testgoupvsm(config-port-prof)#Related Commands
show port-profile name
Displays configuration information about a particular port profile.
vn-service ip-address
To assign a data IP address, a VLAN number, and a profile to a Cisco VSG L2 mode, use the vn-service ip-address command. To disable the data IP address, use the no form of the command.
vn-service ip-address ip-address vlan vlan-number [fail {close | open} | security-profile profile-name]
no vn-service ip-address ip-address vlan vlan-number [fail {close | open} | security-profile profile-name]
To assign a data IP address and a profile to a Cisco VSG L3 mode, use the vn-service ip-address command. To disable the data IP address, use the no form of the command.
vn-service ip-address ip-address l3-mode [fail {close | open} | security-profile profile-name]
no vn-service ip-address ip-address l3-mode [fail {close | open} | security-profile profile-name]
Syntax Description
Command Default
Fail close
Command Modes
Port profile configuration (config-port-prof)
Supported User Rolesnetwork-admin
Command History
4.2(1)SV1(5.1)
This command was changed to include the command syntax and description for the L3 mode.
4.0(4)SV1(1)
This command was introduced.
Usage Guidelines
Use the vn-service ip-address command to configure the IP address, VLAN, and security profile for the Cisco VSG, and optionally to allow for a fail-safe configuration.
The fail mode specifies what the behavior is when the Virtual Ethernet Module (VEM) does not have connectivity to the Cisco VSG. The default fail mode is close, which means that the packets are dropped. The open fail mode means that packets are passed.
The security profile name must match one of the security profiles created on the Cisco VSG.
The IP address must match the data interface IP address on the Cisco VSG.
Examples
This example shows how to assign the IP address and VLAN number and how to specify that packets are to be passed when the Cisco VSG fails:
vsm# configureEnter configuration commands, one per line. End with CNTL/Z.vsm(config)# port-profile pP1vsm(config-port-prof)# vn-service ip-address 209.165.200.236 vlan 2 fail openvsm(config-port-prof)#Related Commands
vnm-policy-agent
To enter Cisco Virtual Network Management Center (VNMC) policy agent mode, use the vnm-policy-agent command.
vnm-policy-agent
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Global configuration (config)
Supported User Rolesnetwork-admin
Command History
Usage Guidelines
Use the Cisco VNMC policy agent configuration mode to configure policy agents.
Examples
This example shows how enter policy agent mode:
vsm# configurevsm(config)# vnm-policy-agentvsm(config-vnm-policy-agent)#Related Commands
vsn type vsg global
To enter the tcp state-checks configuration submode, use the vsn type vsg global command.
vsn type vsg global
Syntax Description
This command has no arguments or keywords.
Defaults
TCP state checks are enabled.
Command Modes
Global configuration (config)
Supported User Rolesnetwork-admin
system-admin
Command History
Usage Guidelines`
Because TCP state checks in vPath are enabled by default, use the no form of the tcp state-checks command to disable the state checks.
Examples
This example shows how to enter the VSN configuration submode:
vsm# configvsm(config)# vsn type vsg globalvsm(config-vsn)#Related Commands