-
Catalyst 6500 Series Software Configuration Guide, 8.7
-
Index
-
Preface
-
Product Overview
-
Command-Line Interfaces
-
Configuring the Switch IP Address and Default Gateway
-
Configuring Ethernet, Fast Ethernet, Gigabit Ethernet, and 10-Gigabit Ethernet Switching
-
Configuring Ethernet VLAN Trunks
-
Configuring EtherChannel
-
Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling
-
Configuring Spanning Tree
-
Configuring Spanning Tree PortFast, UplinkFast, BackboneFast, and Loop Guard
-
Configuring VTP
-
Configuring VLANs
-
Configuring InterVLAN Routing
-
Configuring CEF for PFC2/PFC3
-
Configuring MLS
-
Configuring Access Control
-
Configuring NDE
-
Configuring GVRP
-
Configuring MVRP
-
Configuring Dynamic Port VLAN Membership with VMPS
-
Checking Status and Connectivity
-
Configuring Online Diagnostics
-
Administering the Switch
-
Configuring Redundancy
-
Configuring NSF with SSO MSFC Redundancy
-
Modifying the Switch Boot Configuration
-
Working with the Flash File System
-
Working with System Software Images
-
Working with Configuration Files
-
Configuring System Message Logging
-
Configuring DNS
-
Configuring CDP
-
Configuring UDLD
-
Configuring DHCP Snooping and IP Source Guard
-
Configuring NTP
-
Configuring Broadcast Suppression
-
Configuring Layer 3 Protocol Filtering
-
Configuring the IP Permit List
-
Configuring Port Security
-
Configuring Switch Access Using AAA
-
Configuring 802.1x Authentication
-
Configuring MAC Authentication Bypass
-
Configuring Web-Based Proxy Authentication
-
Tracking Host Aging
-
Configuring Network Admission Control
-
Configuring Unicast Flood Blocking
-
Configuring SNMP
-
Configuring RMON
-
Configuring SPAN, RSPAN and the Mini Protocol Analyzer
-
Using Switch TopN Reports
-
Configuring Multicast Services
-
Configuring QoS
-
Configuring Automatic QoS
-
Configuring ASLB
-
Configuring the Switch Fabric Module
-
Configuring a VoIP Network
-
Configuring MSFC IOS Features
-
Acronyms
-
Table Of Contents
Configuring CEF for PFC2 and PFC3A
Understanding How Layer 3 Switching Works
Understanding Layer 3-Switched Packet Rewrite
Understanding IP Unicast Rewrite
Understanding IPX Unicast Rewrite
Understanding IP Multicast Rewrite
Understanding CEF for PFC2/PFC3A
Understanding the Forwarding Decisions
Understanding the Adjacency Table
Partially and Completely Switched Multicast Flows
Understanding the NetFlow Statistics
Default CEF for PFC2/PFC3A Configuration
CEF for PFC2/PFC3A Configuration Guidelines and Restrictions
Configuring CEF for PFC2/PFC3A on the Switch
Displaying the Layer 3-Switching Entries on the Supervisor Engine
Configuring CEF on MSFC2/MSFC3
Configuring IP Multicast on MSFC2/MSFC3
Enabling IP Multicast Routing Globally
Enabling IP PIM on an MSFC2/MSFC3 Interface
Configuring the IP MMLS Global Threshold
Enabling IP MMLS on MSFC2/MSFC3 Interfaces
Displaying IP Multicast Information
Displaying IP Multicast Information on MSFC2/MSFC3
Displaying the IP Multicast Information on the Supervisor Engine
Configuring the NetFlow Statistics on the Switch
Specifying NetFlow Table Entry Creation on a Per-Interface Basis
Specifying the NetFlow Table Entry Aging-Time Value
Specifying the NetFlow Table IP Entry Fast Aging Time and Packet Threshold Values
Setting the Minimum Statistics Flow Mask
Excluding the IP Protocol Entries from the NetFlow Table
Displaying the NetFlow Statistics
Clearing the NetFlow IP and IPX Statistics
Clearing All the NetFlow Statistics
Clearing the NetFlow IP Statistics
Clearing the NetFlow IPX Statistics
Clearing the NetFlow Statistics Totals
Displaying the NetFlow Statistics Debug Information
Configuring the MLS IP-Directed Broadcasts on the Switch
Configuring CEF for PFC2 and PFC3A
This chapter describes how to configure Cisco Express Forwarding (CEF) for Policy Feature Card 2 (PFC2) and PFC3A on the Catalyst 6500 series switches.
CEF for PFC2 provides IP and Internetwork Packet Exchange (IPX) unicast Layer 3 switching and IP multicast Layer 3 switching for Supervisor Engine 2, PFC2, and Multilayer Switch Feature Card 2 (MSFC2).
CEF for PFC3A provides IP unicast Layer 3 switching and IP multicast Layer 3 switching for Supervisor Engine 720, PFC3A, and Multilayer Switch Feature Card 3 (MSFC3).
Note
With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.
Note
This chapter consists of these sections:
•
•
•
•
•
•
Note
Note
http://www.cisco.com/en/US/products/hw/switches/ps5304/products_configuration_guide_book09186a00800d67ec.html.
Understanding How Layer 3 Switching Works
These sections describe Layer 3 switching with PFC2:
•
•
•
Layer 3 Switching Overview
Note
Layer 3 switching allows a switch, instead of a router, to forward the IP and IPX unicast traffic and the IP multicast traffic between the VLANs. Layer 3 switching is implemented in the hardware and provides wire-speed interVLAN forwarding on the switch, rather than on MSFC2/MSFC3. Layer 3 switching requires minimal support from MSFC2/MSFC3. MSFC2/MSFC3 routes any traffic that cannot be Layer 3 switched.
Note
Layer 3 switching on Catalyst 6500 series switches provides flow statistics that you can use to identify the traffic characteristics for administration, planning, and troubleshooting. Layer 3 switching uses NetFlow Data Export (NDE) to export the flow statistics. See Chapter 16, "Configuring NDE" for more information about NDE.
Note
Understanding Layer 3-Switched Packet Rewrite
Note
When a packet is Layer 3 switched from a source in one VLAN to a destination in another VLAN, the switch performs a packet rewrite at the egress port that is based on information learned from MSFC2/MSFC3 so that the packets appear to have been routed by MSFC2/MSFC3.
Note
The packet rewrite alters these five fields:
•
•
•
•
•
Note
If Source A and Destination B are on different VLANs and Source A sends a packet to MSFC2/MSFC3 to be routed to Destination B, the switch recognizes that the packet was sent to the Layer 2 (MAC) address of MSFC2/MSFC3.
To perform Layer 3 switching, the switch rewrites the Layer 2 frame header, changing the Layer 2 destination address to the Layer 2 address of Destination B and the Layer 2 source address to the Layer 2 address of MSFC2/MSFC3. The Layer 3 addresses remain the same.
In IP unicast and IP multicast traffic, the switch decrements the Layer 3 TTL value by 1 and recomputes the Layer 3 packet checksum. In IPX traffic, the switch increments the Layer 3 Transport Control value by 1 and recomputes the Layer 3 packet checksum. The switch recomputes the Layer 2 frame checksum and forwards (or for multicast packets, replicates as necessary) the rewritten packet to Destination B's VLAN.
These sections describe how the packets are rewritten:
•
•
•
Understanding IP Unicast Rewrite
Received IP unicast packets are (conceptually) formatted as follows:
Destination
Source
Destination
Source
TTL
Checksum
MSFC2/MSFC3 MAC
Source A MAC
Destination B IP
Source A IP
n
calculation1
After the switch rewrites an IP unicast packet, it is (conceptually) formatted as follows:
Destination
Source
Destination
Source
TTL
Checksum
Destination B MAC
MSFC2/MSFC3 MAC
Destination B IP
Source A IP
n-1
calculation2
Understanding IPX Unicast Rewrite
Received IPX packets are (conceptually) formatted as follows:
After the switch rewrites an IPX packet, it is (conceptually) formatted as follows:
Understanding IP Multicast Rewrite
Received IP multicast packets are (conceptually) formatted as follows:
Destination
Source
Destination
Source
TTL
Checksum
Group G1 MAC1
Source A MAC
Group G1 IP
Source A IP
n
calculation1
1 In this example, Destination B is a member of Group G1.
After the switch rewrites an IP multicast packet, it is (conceptually) formatted as follows:
Destination
Source
Destination
Source
TTL
Checksum
Group G1 MAC
MSFC2/MSFC3 MAC
Group G1 IP
Source A IP
n-1
calculation2
Understanding CEF for PFC2/PFC3A
Note
These sections describe CEF for PFC2:
•
•
•
CEF for PFC2/PFC3A Overview
Supervisor Engine 2, PFC2, and MSFC2 provide Layer 3 switching with CEF for PFC2. CEF for PFC2 is permanently enabled on Supervisor Engine 2. Cisco IOS CEF is permanently enabled on MSFC2 in support of CEF for PFC2.
Supervisor Engine 720, PFC3A, and MSFC3 provide Layer 3 switching with CEF for PFC3A. CEF for PFC3A is permanently enabled on Supervisor Engine 720. Cisco IOS CEF is permanently enabled on MSFC3 in support of CEF for PFC3A.
CEF for PFC2/PFC3A works with CEF (for unicast traffic) and PIM (for multicast traffic) on MSFC2/MSFC3 to support IP, IP multicast, and IPX traffic. CEF and PIM on MSFC2/MSFC3 are enhanced to support CEF for PFC2/PFC3A. CEF for PFC2/PFC3A generates flow statistics for Layer 3-switched traffic that can be displayed at the CLI or used for NDE.
CEF for PFC2/PFC3A provides Layer 3 switching for all packets that match a complete forwarding information base (FIB) entry (see the "Understanding the FIB" section). CEF for PFC2/PFC3A sends all packets that match an incomplete FIB entry (one where the MAC address has not been resolved) to MSFC2/MSFC3 to be routed until MSFC2/MSFC3 resolves the MAC address.
Note
Note
Understanding the Forwarding Decisions
CEF for PFC2/PFC3A provides Layer 3 switching that is based on the following:
•
•
•
Enter the show mls entry command to display information about the entries that are used to make forwarding decisions. CEF for PFC2/PFC3A makes a forwarding decision for each packet and sends the rewrite information for each packet to the egress port, where the rewrite occurs when the packet is transmitted from the switch.
Understanding the FIB
The FIB resides in a separate TCAM. The adjacency table is stored separately in DRAM. The NetFlow table is stored separately in DRAM. The FIB, the adjacency table, and the NetFlow table do not compete with any other features for storage space.
The FIB is conceptually similar to a routing table. It maintains a mirror image of the forwarding information that is contained in the unicast and multicast routing tables on MSFC2/MSFC3. When routing or topology changes occur in the network, the unicast and multicast routing tables on MSFC2/MSFC3 are updated and those changes are reflected in the FIB. The FIB maintains next-hop address information that is based on the information in the routing tables on MSFC2/MSFC3. The FIB supports 256,000 entries, which includes 16,000 IP multicast entries (128,000 IP multicast entries on MSFC3). With reverse path forwarding (RPF) check enabled, the number of IP entries doubles (with Supervisor Engine 720, the number of IP entries remain the same).
FIB lookup uses the following criteria:
•
•
•
•
Note
In switches with redundant supervisor engines and MSFC2s/MSFC3s, the designated MSFC2/MSFC3 supports the FIB on the active Supervisor Engine 2 or Supervisor Engine 720. The routing protocols on the nondesignated MSFC2/MSFC3 send information to the routing protocols on the designated MSFC2/MSFC3.
Enter the show mls entry cef command to display the following:
•
•
•
•
•
•
•
Console> (enable) show mls entry cefMod FIB-Type Destination-IP Destination-Mask NextHop-IP Weight--- --------- --------------- ---------------- --------------- ------15 receive 0.0.0.0 255.255.255.25515 receive 255.255.255.255 255.255.255.25515 receive 127.0.0.0 255.255.255.25515 receive 127.0.0.52 255.255.255.25515 receive 127.255.255.255 255.255.255.25515 receive 10.1.1.2 255.255.255.25515 receive 10.1.1.0 255.255.255.25515 receive 10.1.1.255 255.255.255.25515 receive 10.10.1.1 255.255.255.25515 receive 10.10.0.0 255.255.255.255...Console> (enable)Enter the show mls command to display a Layer 3 switching summary:
Console> (enable) show mlsTotal packets switched = 35254Total bytes switched = 2256256Total routes = 120569Total number of Netflow entries = 120000IP statistics flows aging time = 50 secondsLong-duration flows aging time = 320 secondsIP statistics flows fast aging time = 0 seconds, packet threshold = 0IP Current flow mask is Full-Vlan flowNetflow Data Export version: 7Netflow Data Export disabledNetflow Data Export port/host is not configured.Total packets exported = 0Destination Ifindex export is enabledSource Ifindex export is enabledRate limiting is turned off, packets are bridged to routerLoad balancing hash is based on source and destination IP addresses and universcPer-prefix Stats for ALL FIB entries is EnabledConsole> (enable)Understanding the Adjacency Table
For each FIB entry, CEF for PFC2/PFC3A stores Layer 2 information from the designated MSFC2/MSFC3 for adjacent nodes in the adjacency table. Adjacent nodes are nodes that are directly connected at Layer 2. To forward traffic, CEF for PFC2/PFC3A selects a route from a FIB entry, which points to an adjacency entry, and uses the Layer 2 header for the adjacent node in the adjacency table entry to rewrite the packet during Layer 3 switching. CEF for PFC2 supports 256,000 adjacency table entries. CEF for PFC3A supports 1,000,000 adjacency table entries. Only half of the adjacency table entries provide statistics.
Table 13-1 lists the adjacency types.
Enter the show mls entry cef adjacency command to display the following:
•
•
•
•
•
•
•
Console> (enable) show mls entry cef adjacencyMod: 15Destination-IP: 140.140.1.5 Destination-Mask: 255.255.255.255FIB-Type: resolvedAdjType NextHop-IP NextHop-Mac Vlan Encp Tx-Packets Tx-Octets-------- --------------- ----------------- ---- ---- ------------ -------------connect 140.140.1.5 00-00-d0-00-00-05 140 ARPA 0 0Mod: 15Destination-IP: 150.150.1.5 Destination-Mask: 255.255.255.255FIB-Type: resolvedAdjType NextHop-IP NextHop-Mac Vlan Encp Tx-Packets Tx-Octets-------- --------------- ----------------- ---- ---- ------------ -------------connect 150.150.1.5 00-00-e0-00-00-05 150 ARPA 0 0Mod: 15Destination-IP: 153.153.1.5 Destination-Mask: 255.255.255.255FIB-Type: resolvedAdjType NextHop-IP NextHop-Mac Vlan Encp Tx-Packets Tx-Octets-------- --------------- ----------------- ---- ---- ------------ -------------connect 153.153.1.5 00-00-e3-00-00-05 153 ARPA 0 0...Console> (enable)Enter the clear mls entry cef adjacency command to clear the CEF adjacency information:
Console> (enable) clear mls entry cef adjacencyAdjacency statistics has been cleared.Console> (enable)Partially and Completely Switched Multicast Flows
Some flows might be partially Layer 3 switched instead of completely Layer 3 switched in these situations:
•
•
•
•
•
•
Note
For partially switched flows, all multicast traffic belonging to the flow reaches MSFC2/MSFC3 and is software switched for any interface that is not Layer 3 switched.
Note
PFC2/PFC3A prevents multicast traffic in flows that are completely Layer 3 switched from reaching MSFC2/MSFC3, reducing the load on MSFC2/MSFC3. The show ip mroute and show mls ip multicast commands identify completely Layer 3-switched flows with the text string "RPF-MFD." Multicast Fast Drop (MFD) indicates that from the perspective of MSFC2/MSFC3, the multicast packet is dropped, because it is switched by the PFC2/PFC3A.
For all completely Layer 3-switched flows, PFC2/PFC3A periodically sends multicast packet and byte count statistics to MSFC2/MSFC3, because MSFC2/MSFC3 cannot record multicast statistics for completely switched flows, which it never sees. MSFC2/MSFC3 uses the statistics to update the corresponding multicast routing table entries and reset the appropriate expiration timers.
CEF for PFC2/PFC3A Examples
Figure 13-1 shows a simple IP CEF network topology. In this example, Host A is on the Sales VLAN (IP subnet 171.59.1.0), Host B is on the Marketing VLAN (IP subnet 171.59.3.0), and Host C is on the Engineering VLAN (IP subnet 171.59.2.0).
When Host A initiates an HTTP file transfer to Host C, PFC2/PFC3A uses the information in the FIB and adjacency table to forward packets from Host A to Host C.
Figure 13-1 IP CEF Example Topology
Figure 13-2 shows a simple IPX CEF network topology. In this example, Host A is on the Sales VLAN (IPX address 01.Aa), Host B is on the Marketing VLAN (IPX address 03.Bb), and Host C is on the Engineering VLAN (IPX address 02.Cc).
When Host A initiates a file transfer to Host C, PFC2 uses the information in the FIB and adjacency table to forward packets from Host A to Host C.
Figure 13-2 IPX CEF Example Topology
Understanding the NetFlow Statistics
Note
These sections describe NetFlow statistics:
NetFlow Statistics Overview
CEF for PFC2/PFC3A generates flow statistics for Layer 3-switched traffic, which are stored in the NetFlow table. NetFlow statistics can be displayed with show commands and are also available to NetFlow Data Export (NDE).
Note
NetFlow statistics support unicast and multicast flows as follows:
•
–
–
–
•
NetFlow Table Entry Aging
The state and identity of flows are maintained while packet traffic is active; when traffic for a flow ceases, the entry ages out. You can configure the aging time for the NetFlow table entries that are kept in the NetFlow table. If an entry is not used for the specified period of time, the entry ages out and statistics for that flow can be exported to a flow collector application.
Flow Masks
Flow masks determine how the NetFlow table entries are created. CEF for PFC2 supports only one flow mask (the most specific one) for all statistics. If NetFlow for PFC2 detects different flow masks from different MSFCs for which it is performing Layer 3 switching, it changes its flow mask to the most specific flow mask detected (this applies to the PFC2/MSFC2 only).
When the flow mask changes, the entire NetFlow table is purged. When CEF for PFC2/PFC3A exports cached entries, flow records are created based on the current flow mask. Depending on the current flow mask, some fields in the flow record might not have values. Unsupported fields are filled with a zero (0).
The statistics flow masks are as follows:
•
•
•
•
•
•
Enter the show mls statistics entry command to display the contents of the NetFlow table and the current flow mask. Use the keyword options to display information for specific traffic (refer to the Catalyst 6500 Series Switch Command Reference publication for more information).
Default CEF for PFC2/PFC3A Configuration
Table 13-2 shows the default CEF for PFC2/PFC3A configuration.
CEF for PFC2/PFC3A Configuration Guidelines and Restrictions
Note
This section describes the guidelines and restrictions for configuring CEF for PFC2/PFC3A:
•
Note
•
•
•
Note
–
Ethernet V2.0 (ARPA)
802.3 with 802.2 with 1 byte control (SAP1)
802.3 with 802.2 and SNAP–
Ethernet V2.0 (ARPA)
802.3 (raw)
802.2 with 1 byte control (SAP1)
SNAP
Note
–
CEF for PFC2/PFC3A does not provide Layer 3 switching for an IP multicast flow in the following cases:
•
Note
•
Note
•
•
•
•
Configuring CEF for PFC2/PFC3A on the Switch
These sections describe how to configure CEF for PFC2/PFC3A:
•
•
•
•
•
Note
Displaying the Layer 3-Switching Entries on the Supervisor Engine
CEF for PFC2/PFC3A is permanently enabled on Supervisor Engine 2 with PFC2 and MSFC2 and on Supervisor Engine 720 with PFC3A and MSFC3. No configuration is required.
To display all the Layer 3-switching entries on the supervisor engine, perform this task:
Display Layer 3-switching information.
show mls entry [pbr-route] [cef] | [netflow-route] [qos]
This example shows how to display the Layer 3-switching entries:
Console> (enable) show mls entryMod FIB-Type Destination-IP Destination-Mask NextHop-IP Weight--- --------- --------------- ---------------- --------------- ------15 receive 0.0.0.0 255.255.255.25515 receive 255.255.255.255 255.255.255.25515 receive 127.0.0.12 255.255.255.25516 receive 127.0.0.0 255.255.255.25516 receive 127.255.255.255 255.255.255.25515 resolved 127.0.0.11 255.255.255.255 127.0.0.11 115 receive 21.2.0.4 255.255.255.25516 receive 21.0.0.0 255.255.255.25516 receive 21.255.255.255 255.255.255.25515 receive 44.0.0.1 255.255.255.25516 receive 44.0.0.0 255.255.255.25516 receive 44.255.255.255 255.255.255.25515 receive 42.0.0.1 255.255.255.25516 receive 42.0.0.0 255.255.255.25516 receive 42.255.255.255 255.255.255.25515 receive 43.0.0.99 255.255.255.25515 receive 43.0.0.0 255.255.255.25515 receive 43.255.255.255 255.255.255.25515 receive 192.20.20.20 255.255.255.25516 receive 21.2.0.5 255.255.255.25516 receive 42.0.0.20 255.255.255.25515 connected 43.0.0.0 255.0.0.015 drop 224.0.0.0 240.0.0.015 wildcard 0.0.0.0 0.0.0.0Mod FIB-Type Dest-IPX-net NextHop-IPX Weight--- --------- ------------ ------------------------- ------15 connected 2115 connected 4415 connected 4215 resolved 450 42.0050.3EA9.ABFD 115 resolved 480 42.0050.3EA9.ABFD 115 wildcard 0Destination-IP Source-IP Prot DstPrt SrcPrt Destination-Mac Vlan EDst Stat-Pkts Stat-Bytes Uptime Age TcpDltSeq TcpDltAck--------------- --------------- ----- ------ ------ ----------------- ---- ---- ---------- ----------- -------- -------- --------- ---------0.0.0.5 0.0.0.5 5 204 104 cc-cc-cc-cc-cc-cc 5 ARPA 0 0 01:03:18 01:00:51 cccccccc cccccccc0.0.0.2 0.0.0.2 2 201 101 cc-cc-cc-cc-cc-cc 2 ARPA 0 0 01:03:21 01:00:51 cccccccc cccccccc0.0.0.4 0.0.0.4 4 203 X cc-cc-cc-cc-cc-cc 4 ARPA 0 0 01:03:19 01:00:51 cccccccc cccccccc0.0.0.1 0.0.0.1 ICMP 200 100 cc-cc-cc-cc-cc-cc 1 ARPA 0 0 01:03:25 01:00:52 cccccccc cccccccc0.0.0.3 0.0.0.3 3 202 102 cc-cc-cc-cc-cc-cc 3 ARPA 0 0 01:03:20 01:00:52 cccccccc cccccccc0.0.0.6 0.0.0.6 TCP 205 105 cc-cc-cc-cc-cc-cc 6 ARPA 0 0 01:03:18 01:00:52 cccccccc ccccccccConsole> (enable)Enter the show mls entry cef command to display only the FIB entries. Enter the show mls entry netflow-route command to display only the entries from the TCP intercept feature and reflexive access control lists (ACLs). Enter the show mls entry pbr-route command to display only the PBR entries. Enter the show mls entry qos command to display only the QoS entries.
Configuring CEF on MSFC2/MSFC3
CEF is permanently enabled on MSFC2/MSFC3. No configuration is required to support CEF for PFC2/PFC3A.
Note
Specifying CEF Maximum Routes
Note
To specify the maximum number of routes that can be programmed in the FIB TCAM for a protocol, use the set mls cef maximum-routes {ip | ip-multicast} routes command. The syntax is as follows:
•
•
•
Follow these guidelines when specifying the maximum number of routes that can be programmed in the FIB TCAM:
•
•
This command has the following characteristics:
•
•
•
•
Note
Note
Note
To specify the maximum number of routes that can be programmed in the FIB TCAM for a protocol, perform these tasks in privileged mode:
This example shows how to specify the maximum number of routes for IP unicast:
Console> (enable) set mls cef maximum-routes ip 220Configuration change will take effect after next reboot.Console> (enable) show mls cef maximum-routesCurrent:IPv4 :192k (default)IPv4 multicast : 32k (default)User configured:(effective after reboot)IPv4 :220kIPv4 multicast : 16k (adjusted default)Console> (enable)Configuring IP Multicast on MSFC2/MSFC3
These sections describe how to configure MSFC2/MSFC3 for IP multicast:
•
•
•
•
Note
http://www.cisco.com/en/US/docs/ios/12_1/iproute/configuration/guide/ip_c.html
Enabling IP Multicast Routing Globally
You must enable IP multicast routing globally on MSFC2/MSFC3 before you can enable PIM on MSFC2/MSFC3 interfaces.
To enable IP multicast routing globally on MSFC2/MSFC3, perform this task in global configuration mode:
This example shows how to enable IP multicast routing globally:
Router(config)# ip multicast-routingRouter(config)#Enabling IP PIM on an MSFC2/MSFC3 Interface
You must enable PIM on MSFC2/MSFC3 interfaces before IP multicast will function on those interfaces.
To enable IP PIM on an MSFC2/MSFC3 interface, perform this task in interface configuration mode:
Enable IP PIM on an MSFC2/MSFC3 interface.
Router(config-if)# ip pim {dense-mode | sparse-mode | sparse-dense-mode}
This example shows how to enable PIM on an MSFC2/MSFC3 interface using the default mode (sparse-dense-mode):
Router(config-if)# ip pimRouter(config-if)#This example shows how to enable PIM sparse mode on an MSFC2/MSFC3 interface:
Router(config-if)# ip pim sparse-modeRouter(config-if)#Configuring the IP MMLS Global Threshold
You can configure a global multicast rate threshold, specified in packets per second, below which all multicast traffic is routed by MSFC2/MSFC3. This prevents creation of MLS entries for short-lived multicast flows, such as join requests.
Note
To configure the IP MMLS threshold, perform this task:
This example shows how to configure the IP MMLS threshold to 10 packets per second:
Router(config)# mls ip multicast threshold 10Router(config)#Use the no keyword to deconfigure the threshold.
Enabling IP MMLS on MSFC2/MSFC3 Interfaces
IP MMLS is enabled by default on the MSFC2/MSFC3 interface when you enable IP PIM on the interface. Perform this task only if you disabled IP MMLS on the interface and you want to reenable it.
Note
To enable IP MMLS on an MSFC2/MSFC3 interface, perform this task:
This example shows how to enable IP MMLS on an MSFC2/MSFC3 interface:
Router(config-if)# mls ip multicastRouter(config-if)#Use the no keyword to disable IP MMLS on an MSFC2/MSFC3 interface.
Displaying IP Multicast Information
These sections describe how to display IP multicast information:
•
•
Displaying IP Multicast Information on MSFC2/MSFC3
These sections describe displaying IP multicast information on MSFC2/MSFC3:
•
•
•
•
Displaying IP MMLS Interface Information
The show ip pim interface count command displays the IP MMLS enable state on MSFC2/MSFC3 IP PIM interfaces and the number of packets that are received and sent on the interface. The output lists the PIM interfaces that are fast switched and process switched, and the packet counts for these interfaces. An "H" is displayed on interfaces where IP MMLS is enabled.
The show ip interface command displays the IP MMLS enable state on an MSFC2/MSFC3 interface.
To display IP MMLS information for an IP PIM MSFC2/MSFC3 interface, perform one of these tasks:
Display IP MMLS interface information.
Router# show ip pim interface [type number] count
Display the IP MMLS interface enable state.
Router# show ip interface
This example shows how to display information about the IP MMLS interfaces:
Router# show ip pim interface countStates: FS - Fast Switched, H - Hardware SwitchedAddress Interface FS Mpackets In/Out192.168.10.2 Vlan10 * H 40886/0192.168.11.2 Vlan11 * H 0/40554192.168.12.2 Vlan12 * H 0/40554192.168.23.2 Vlan23 * 0/0192.168.24.2 Vlan24 * 0/0Router#Displaying the IP Multicast Routing Table
The show ip mroute command displays the IP multicast routing table on MSFC2/MSFC3.
To display the IP multicast routing table, perform this task:
Display the IP multicast routing table.
Router# show ip mroute [group[source]] | [summary] | [count] | [active kbps]
This example shows how to display the IP multicast routing table:
Router# show ip mroute 239.252.1.1IP Multicast Routing TableFlags:D - Dense, S - Sparse, C - Connected, L - Local, P - PrunedR - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPTM - MSDP created entry, X - Proxy Join Timer RunningA - Advertised via MSDPOutgoing interface flags:H - Hardware switchedTimers:Uptime/ExpiresInterface state:Interface, Next-Hop or VCD, State/Mode(*, 239.252.1.1), 04:04:59/00:02:59, RP 80.0.0.2, flags:SJIncoming interface:Vlan800, RPF nbr 80.0.0.2Outgoing interface list:Vlan10, Forward/Dense, 01:29:57/00:00:00, H(22.0.0.10, 239.252.1.1), 00:00:19/00:02:41, flags:JTIncoming interface:Vlan800, RPF nbr 80.0.0.2, RPF-MFDOutgoing interface list:Vlan10, Forward/Dense, 00:00:19/00:00:00, HDisplaying IP Multicast Details
The show mls ip multicast command displays detailed information about IP MMLS.
To display detailed MMLS information on MSFC2/MSFC3, perform one of these tasks:
This example shows how to display IP MMLS statistics on MSFC2/MSFC3:
Router# show mls ip multicast statisticsMLS Multicast configuration and state:Router Mac:0050.0f2d.9bfd, Router IP:1.12.123.234MLS multicast operating state:ACTIVEMaximum number of allowed outstanding messages:1Maximum size reached from feQ:1Feature Notification sent:5Feature Notification Ack received:4Unsolicited Feature Notification received:0MSM sent:33MSM ACK received:33Delete notifications received:1Flow Statistics messages received:248MLS Multicast statistics:Flow install Ack:9Flow install Nack:0Flow update Ack:2Flow update Nack:0Flow delete Ack:0Complete flow install Ack:10Complete flow install Nack:0Complete flow delete Ack:1Input VLAN delete Ack:4Output VLAN delete Ack:0Group delete sent:0Group delete Ack:0Global delete sent:7Global delete Ack:7L2 entry not found error:0Generic error :3LTL entry not found error:0MET entry not found error:0L3 entry exists error :0Hash collision error :0L3 entry not found error:0Complete flow exists error :0This example shows how to display information on a specific IP MMLS entry on MSFC2/MSFC3:
Router# show mls ip multicast 224.1.1.1Multicast hardware switched flows:(1.1.13.1, 224.1.1.1) Incoming interface: Vlan13, Packets switched: 61590Hardware switched outgoing interfaces: Vlan20 Vlan9RFD-MFD installed: Vlan13(1.1.9.3, 224.1.1.1) Incoming interface: Vlan9, Packets switched: 0Hardware switched outgoing interfaces: Vlan20RFD-MFD installed: Vlan9(1.1.12.1, 224.1.1.1) Incoming interface: Vlan12, Packets switched: 62010Hardware switched outgoing interfaces: Vlan20 Vlan9RFD-MFD installed: Vlan12(1.1.12.3, 224.1.1.1) Incoming interface: Vlan12, Packets switched: 61980Hardware switched outgoing interfaces: Vlan20 Vlan9RFD-MFD installed: Vlan12(1.1.11.1, 224.1.1.1) Incoming interface: Vlan11, Packets switched: 62430Hardware switched outgoing interfaces: Vlan20 Vlan9RFD-MFD installed: Vlan11(1.1.11.3, 224.1.1.1) Incoming interface: Vlan11, Packets switched: 62430Hardware switched outgoing interfaces: Vlan20 Vlan9RFD-MFD installed: Vlan11Total hardware switched installed: 6Router#This example shows how to display a summary of IP MMLS information on MSFC2/MSFC3:
Router# show mls ip multicast summary7 MMLS entries using 560 bytes of memoryNumber of partial hardware-switched flows:2Number of complete hardware-switched flows:5Router#Using the Debug Commands
Table 13-3 describes the IP MMLS-related debug troubleshooting commands.
Using the Debug Commands on the SCP
Table 13-4 describes the Serial Control Protocol (SCP)-related debug commands to troubleshoot the SCP that runs over the Ethernet out-of-band channel (EOBC).
Displaying the IP Multicast Information on the Supervisor Engine
These sections describe how to display the IP multicast information:
•
•
•
Displaying the IP Multicast Statistics
The show mls multicast statistics command displays the IP multicast statistics.
To display the IP multicast statistics, perform this task:
This example shows how to display the IP multicast statistics for MSFC2/MSFC3:
Console (enable) show mls multicast statisticsRouter IP Router Name Router MAC-------------------------------------------------------1.1.9.254 ? 00-50-0f-06-3c-a0Transmit:Delete Notifications: 23Acknowledgements: 92Flow Statistics: 56Receive:Open Connection Requests: 1Keep Alive Messages: 72Shortcut Messages: 19Shortcut Install TLV: 8Selective Delete TLV: 4Group Delete TLV: 0Update TLV: 3Input VLAN Delete TLV: 0Output VLAN Delete TLV: 0Global Delete TLV: 0MFD Install TLV: 7MFD Delete TLV: 0Router IP Router Name Router MAC-------------------------------------------------------1.1.5.252 ? 00-10-29-8d-88-01Transmit:Delete Notifications: 22Acknowledgements: 75Flow Statistics: 22Receive:Open Connection Requests: 1Keep Alive Messages: 68Shortcut Messages: 6Shortcut Install TLV: 4Selective Delete TLV: 2Group Delete TLV: 0Update TLV: 0Input VLAN Delete TLV: 0Output VLAN Delete TLV: 0Global Delete TLV: 0MFD Install TLV: 4MFD Delete TLV: 0Console (enable)Clearing the IP Multicast Statistics
The clear mls multicast statistics command clears the IP multicast statistics.
To clear the IP multicast statistics, perform this task in privileged mode:
This example shows how to clear the IP multicast statistics:
Console> (enable) clear mls multicast statisticsAll statistics for the MLS routers in include list are cleared.Console> (enable)Displaying the IP Multicast Entries
The show mls multicast entry command displays a variety of information about the multicast flows that are being handled by PFC2/PFC3A. You can display entries that are based on any combination of the participating MSFC2/MSFC3, the VLAN, the multicast group address, or the multicast traffic source.
To display information about the IP multicast entries, perform this task in privileged mode:
Display information about the IP multicast entries.
show mls multicast entry [[[mod] [vlan vlan_id] [group ip_addr] [source ip_addr]] | [all]]
This example shows how to display all the IP multicast entries:
Console> (enable) show mls multicast entry allRouter IP Dest IP Source IP Pkts Bytes InVlan OutVlans--------------- --------------- --------------- ---------- ----------- ------- --------1.1.5.252 224.1.1.1 1.1.11.1 15870 2761380 201.1.9.254 224.1.1.1 1.1.12.3 473220 82340280 121.1.5.252 224.1.1.1 1.1.12.3 15759 2742066 201.1.9.254 224.1.1.1 1.1.11.1 473670 82418580 111.1.5.252 224.1.1.1 1.1.11.3 15810 2750940 201.1.9.254 224.1.1.1 1.1.12.1 473220 82340280 121.1.5.252 224.1.1.1 1.1.13.1 15840 2756160 201.1.9.254 224.1.1.1 1.1.13.1 472770 82261980 131.1.5.252 224.1.1.1 1.1.12.1 15840 2756160 201.1.9.254 224.1.1.1 1.1.11.3 473667 82418058 11Total Entries: 10Console> (enable)This example shows how to display the IP multicast entries for a specific MSFC2/MSFC3:
Console> (enable) show mls multicast entry 15Router IP Dest IP Source IP Pkts Bytes InVlan OutVlans--------------- --------------- --------------- ---------- ----------- ------- --------1.1.5.252 224.1.1.1 1.1.11.1 15870 2761380 201.1.5.252 224.1.1.1 1.1.12.3 15759 2742066 201.1.5.252 224.1.1.1 1.1.11.3 15810 2750940 201.1.5.252 224.1.1.1 1.1.13.1 15840 2756160 201.1.5.252 224.1.1.1 1.1.12.1 15840 2756160 20Total Entries: 5Console> (enable)This example shows how to display the IP multicast entries for a specific multicast group address:
Console> (enable) show mls multicast entry group 226.0.1.3 shortRouter IP Dest IP Source IP InVlan Pkts Bytes OutVlans-------------- ----------- ------------ ------ ------ --------- ---------171.69.2.1 226.0.1.3 172.2.3.8 20 171 23512 10,201,22,45171.69.2.1 226.0.1.3 172.3.4.9 12 25 3120 8,20Total Entries: 2Console> (enable)This example shows how to display the IP multicast entries for a specific MSFC2/MSFC3 and a specific multicast source address:
Console> (enable) show mls multicast entry 15 source 1.1.11.1 shortRouter IP Dest IP Source IP Pkts BytesInVlan OutVlans--------------- --------------- --------------- ---------- -------------------------- ----------172.20.49.159 224.1.1.6 1.1.40.4 368 5777640 23,25172.20.49.159 224.1.1.71 1.1.22.2 99 6514222 30,37172.20.49.159 224.1.1.8 1.1.22.2 396 23562022 13,19Console> (enable)Configuring the NetFlow Statistics on the Switch
Note
These sections describe how to configure the NetFlow statistics:
•
•
•
•
•
•
•
•
Specifying NetFlow Table Entry Creation on a Per-Interface Basis
Note
With software release 8.4(1) and later releases, you can create the NetFlow table entries on a per-interface basis. This feature uses the same mechanism as the bridged-flow statistics to create flows. The NetFlow entries are created for both VLANs on which the bridged-flow statistics are enabled and on the VLANs on which NetFlow entry creation is enabled (see the "Enabling and Disabling Bridged-Flow Statistics on VLANs" section on page 16-12).
For example, if you enable the Layer 3 per-interface entry creation on VLAN 100 and 200 and at the same time you want to enable the bridged-flow statistics on VLAN 150 and 250, the NetFlow entry and the bridged-flow statistics are enabled on all four VLANs. To specify only the bridged-flow statistics for VLAN 150 and 250, you must disable the per-interface entry feature.
In addition, the bridged-flow statistics are automatically enabled when you enable the NetFlow entry creation on a per-interface basis for VLANs. The CLI allows you to disable NetFlow per interface if you do not want this overlap in the Netflow table entry creation.
The status of this feature is displayed as part of the show mls command. The VLANs that have entry creation enabled are displayed as part of the VLANs that have the bridged-flow statistics feature enabled.
To enable or disable the NetFlow per-interface table entries, perform this task in privileged mode:
Enable the NetFlow per-interface table entries.
set mls netflow-per-interface [enable | disable]
This example shows how to enable the NetFlow per-interface table entries:
Console> (enable) set mls netflow-per-interface enableConsole> (enable)You can specify the VLANs for which the NetFlow entries can be enabled or disabled. To control the flow creation on a VLAN basis, perform this task in privileged mode:
Enable the per-VLAN NetFlow table entries.
set mls netflow-entry-create [enable | disable] vlan-list
This example shows how to specify the VLANs that are used to create the NetFlow table entries:
Console> (enable) set mls netflow-entry-create enable 150, 250Console> (enable)Specifying the NetFlow Table Entry Aging-Time Value
The entry aging time for each protocol (IP and IPX) applies to all the protocol-specific NetFlow table entries. Any entry that has not been used for agingtime seconds is aged out. The default is 16 seconds.
For normal aging time, you can specify the aging time in the range of 1-1092 seconds in 8-second increments. Any aging-time value that is not a multiple of 8 seconds is adjusted to the closest multiple of 8 seconds. For example, a value of 65 is adjusted to 64 and a value of 127 is adjusted to 128.
To specify the entry aging time for both IP and IPX, perform this task in privileged mode:
This example shows how to specify the entry aging time:
Console> (enable) set mls agingtime 16Multilayer switching agingtime IP and IPX set to 16Console> (enable)To specify the IP entry aging time, perform this task in privileged mode:
Specify the IP entry aging time for the NetFlow table.
set mls agingtime ip [agingtime]
This example shows how to specify the IP entry aging time:
Console> (enable) set mls agingtime ip 16Multilayer switching aging time IP set to 16Console> (enable)To specify the IPX entry aging time, perform this task in privileged mode:
Specify the IPX entry aging time for the NetFlow table.
set mls agingtime ipx [agingtime]
This example shows how to specify the IPX entry aging time:
Console> (enable) set mls agingtime ipx 16Multilayer switching aging time IPX set to 16Console> (enable)Specifying the NetFlow Table IP Entry Fast Aging Time and Packet Threshold Values
Note
To increase the utilization of the NetFlow table, enable IP entry fast aging time. The IP entry fast aging time applies to the NetFlow table entries that have no more than pkt_threshold packets that are routed within fastagingtime seconds after they are created. A typical NetFlow table entry that is removed is the entry for flows to and from a Domain Name Server (DNS) or TFTP server; the entry might never be used again after it is created. Detecting and aging out these entries saves space in the NetFlow table for other data traffic.
The default fastagingtime value is 0 (no fast aging). For Supervisor Engine 1 and Supervisor Engine 2, you can configure the fastagingtime value from 8-128 seconds in increments of 8 seconds. For Supervisor Engine 720, you can configure the fastagingtime value from 0-128 seconds in increments of 1 second. Any fastagingtime value that is not configured exactly as the indicated values is adjusted to the closest one. For Supervisor Engine 1 and Supervisor Engine 2, you can configure the pkt_threshold value to 0, 1, 3, 7, 15, 31, 63, or 127 packets. For Supervisor Engine 720, you can configure the pkt_threshold value from 1-127 packets in increments of 1 packet.
If you need to enable IP entry fast aging time, initially set the value to 128 seconds. If the NetFlow table remains full, decrease the setting. If the NetFlow table continues to remain full, decrease the normal IP entry aging time.
To specify the IP entry fast aging time and packet threshold, perform this task in privileged mode:
Specify the IP entry fast aging time and packet threshold for a NetFlow table entry.
set mls agingtime fast [fastagingtime] [pkt_threshold]
This example shows how to set the IP entry fast aging time to 8 seconds with a packet threshold of 15 packets:
Console> (enable) set mls agingtime fast 8 15Multilayer switching fast aging time set to 8 seconds for entries with no more than 15 packets switched.Console> (enable)You can force an active flow to age out by entering the set mls agingtime long-duration {longagingtime} command. You can specify the aging time of the active flow in the range of 64-1920 seconds in increments of 64. The default longagingtime is 320.
This example shows how to set the aging time for active flows:
Console> (enable) set mls agingtime long-duration 128Multilayer switching agingtime set to 128 seconds for long duration flowsConsole> (enable)Setting the Minimum Statistics Flow Mask
You can set the minimum granularity of the flow mask for the NetFlow table. The actual flow mask will be at least of the granularity that is specified by this command. For information on how the different flow masks work, see the "Flow Masks" section.
Note
To set the minimum NetFlow statistics flow mask, perform this task in privileged mode:
Set the minimum statistics flow mask.
set mls flow {destination | destination-source | null | full}
This example shows how to set the minimum statistics flow mask to destination-source-ip:
Console> (enable) set mls flow destination-sourceConfigured IP flow mask is set to destination-source flow.Console> (enable)Excluding the IP Protocol Entries from the NetFlow Table
You can configure the NetFlow table to exclude specified IP protocols.
To exclude the IP protocols from the NetFlow table, perform this task in privileged mode:
Exclude the IP protocols from the NetFlow table.
set mls exclude protocol {tcp | upd | both} port
The port parameter can be a port number or a keyword: dns, ftp, smtp, telnet, x (X-Windows), or www.
This example shows how to exclude the Telnet traffic from the NetFlow table:
Console> (enable) set mls exclude protocol tcp telnetNetFlow table will not create entries for TCP packets with protocol port 23.Note: MLS exclusion only works in full flow mode.Console> (enable)Displaying the NetFlow Statistics
Note
To display a summary of the NetFlow table entries and statistics, perform this task in privileged mode:
This example shows how to display all the NetFlow table entries (the display is from a Supervisor Engine 2):
Console> (enable) show mlsshow mls=======Total packets switched = 2Total bytes switched = 112Total routes = 48IP statistics flows aging time = 16 secondsIP statistics flows fast aging time = 0 seconds, packet threshold = 0IP Current flow mask is Full flowNetflow Data Export version:7Netflow Data Export disabledNetflow Data Export port/host is not configured.Total packets exported = 0IPX statistics flows aging time = 16 secondsIPX flow mask is Destination flowIPX max hop is 15Module 15:Physical MAC-Address 00-50-3e-a9-ab-fcVlan Virtual MAC-Address(es)---- -----------------------42 00-00-0c-07-ac-00Console>This example shows how to display all the NetFlow table entries (the display is from a Supervisor Engine 720):Console> (enable) show mlsTotal packets switched = 35254Total bytes switched = 2256256Total routes = 120569Total number of Netflow entries = 120000IP statistics flows aging time = 50 secondsLong-duration flows aging time = 320 secondsIP statistics flows fast aging time = 0 seconds, packet threshold = 0IP Current flow mask is Full-Vlan flowNetflow Data Export version: 7Netflow Data Export disabledNetflow Data Export port/host is not configured.Total packets exported = 0Destination Ifindex export is enabledSource Ifindex export is enabledRate limiting is turned off, packets are bridged to routerLoad balancing hash is based on source and destination IP addresses and universcPer-prefix Stats for ALL FIB entries is EnabledConsole> (enable)The show mls statistics entry command can display all statistics or the statistics for the specific NetFlow table entries. Specify the destination address, source address, and for IP, the protocol, and source and destination ports to see the statistics for a specific NetFlow table entry.
A value of zero (0) for src_port or dst_port is treated as a wildcard, and all the NetFlow statistics are displayed (unspecified options are treated as wildcards). If the protocol that is specified is not TCP or UDP, set the src_port and dst_prt to 0 or no NetFlow statistics will display.
To display the statistics for the NetFlow table entries, perform this task in privileged mode:
This example shows how to display the NetFlow statistics for a particular NetFlow table entry:
Console> show mls statistics entry ip destination 172.20.22.14Last UsedDestination IP Source IP Prot DstPrt SrcPrt Stat-Pkts Stat-Bytes--------------- --------------- ---- ------ ------ --------- -----------MSFC 127.0.0.12:172.20.22.14 172.20.25.10 6 50648 80 3152 347854Console>The show mls statistics entry ip top-talkers command can display the statistics for the netflows with the maximum amount of network usage. The NetFlow entries are pulled out of the NetFlow table based on the number of packets that each flow has. The results are displayed in descending order with the top talkers being the entries with the largest packet count. You can get the statistics for the network (the top 32 talkers are displayed) or for a specified number of flows such as the top 1 or 2 talkers.
To display the NetFlow top talkers for the NetFlow table entries, perform this task in privileged mode:
Display the NetFlow talkers with the maximum amount of network usage.
show mls statistics entry ip top-talkers
This example shows how to display the NetFlow top talkers for a network:
Console> show mls statistics entry ip top-talkersLast UsedDestination IP Source IP Prot DstPrt SrcPrt Vlan Stat-Pkts Stat-Bytes---------------- --------------- ----- ------ ------ ----- --------- -----------12.0.0.5 11.0.0.6 255 N/A N/A N/A 387110 1780706012.0.0.5 11.0.0.7 255 N/A N/A N/A 387109 1780701412.0.0.5 11.0.0.4 TCP 8 7 N/A 20 920127.0.0.20 127.0.0.19 UDP 67 68 N/A 18 82812.0.0.5 11.0.0.2 TCP 6 5 N/A 15 69012.0.0.5 11.0.0.5 TCP 8 7 N/A 15 69012.0.0.5 11.0.0.3 TCP 6 5 N/A 12 552Console>This example shows how to display the statistics for a specified number of NetFlows with the maximum network usage:
Console> show mls statistics entry ip top-talkers 2Last UsedDestination IP Source IP Prot DstPrt SrcPrt Vlan Stat-Pkts Stat-Bytes---------------- --------------- ----- ------ ------ ----- --------- -----------12.0.0.5 11.0.0.6 255 N/A N/A N/A 387110 1780706012.0.0.5 11.0.0.7 255 N/A N/A N/A 387109 17807014Console>Clearing the NetFlow IP and IPX Statistics
These sections describe how to clear the NetFlow statistics:
•
•
•
•
Note
Clearing All the NetFlow Statistics
To clear all the NetFlow IP and IPX statistics, perform this task in privileged mode:
This example shows how to clear all the NetFlow statistics:
Console> (enable) clear mls statistics entry allAll MLS IP and IPX entries cleared.Console> (enable)Clearing the NetFlow IP Statistics
The clear mls statistics entry ip command clears the NetFlow IP statistics. Use the all keyword to clear all the NetFlow IP statistics. The destination and source keywords specify the source and destination IP addresses. The destination and source ip_addr_spec can be a full IP address or a subnet address in the format ip_subnet_addr, ip_addr/subnet_mask, or ip_addr/subnet_mask_bits.
The flow keyword specifies the following additional flow information:
•
•
To clear the statistics for a NetFlow table IP entry, perform this task in privileged mode:
Clear the statistics for a NetFlow table IP entry.
clear mls statistics entry ip [destination ip_addr_spec] [source ip_addr_spec] [flow protocol src_port dst_port] [all]
This example shows how to clear the statistics for NetFlow table entries with destination IP address 172.20.26.22:
Console> (enable) clear mls statistics entry ip destination 172.20.26.22MLS IP entry clearedConsole> (enable)This example shows how to clear the statistics for the NetFlow table entries with destination IP address 172.20.22.113, TCP source port 1652, and TCP destination port 23:
Console> (enable) clear mls statistics entry ip destination 172.20.26.22 source 172.20.22.113 flow tcp 1652 23MLS IP entry clearedConsole> (enable)Clearing the NetFlow IPX Statistics
The clear mls statistics entry ipx command clears the NetFlow IPX statistics. Use the all keyword to clear all the NetFlow IPX statistics. The destination and source keywords specify the source and destination IPX addresses.
To clear the statistics for a NetFlow table IPX entry, perform this task in privileged mode:
Clear the statistics for a NetFlow table IPX entry.
clear mls statistics entry ipx [destination ipx_addr_spec] [source ipx_addr_spec] [all]
This example shows how to clear the statistics for the IPX MLS entries with destination IPX address 1.0002.00e0.fefc.6000:
Console> (enable) clear mls statistics entry ipx destination 1.0002.00e0.fefc.6000MLS IPX entry cleared.Console> (enable)Clearing the NetFlow Statistics Totals
The clear mls statistics command clears the following NetFlow statistics:
•
•
To clear the NetFlow statistic totals, perform this task in privileged mode:
This example shows how to clear the NetFlow statistics totals:
Console> (enable) clear mls statisticsAll mls statistics cleared.Console> (enable)Displaying the NetFlow Statistics Debug Information
The show mls debug command displays the NetFlow statistics debug information that you can send to your technical support representative for analysis if necessary.
To display the NetFlow statistics debug information, perform this task:
Display the NetFlow statistics debug information that you can send to your technical support representative.
show mls debug
Note
Configuring the MLS IP-Directed Broadcasts on the Switch
The IP-directed broadcasts are used primarily for ticker-type (stock quote) devices; however, when the feature is enabled on router interfaces, it provides a means to enable malicious denial-of-service attacks.
An IP-directed broadcast is a datagram that is sent to the broadcast address of a subnet to which the sending machine is not directly connected. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link layer broadcast. Due to the IP addressing architecture, only the last router in the chain, the one that is connected directly to the target subnet, can conclusively identify an IP-directed broadcast.
Before supervisor engine software release 7.2(2), the IP-directed broadcast traffic was handled by enabling the IP-directed broadcasts using the ip directed-broadcast command on the MSFC. The MSFC handled the traffic at the process level, which caused high CPU utilization.
With software release 7.2(2) and later releases, you can configure MSFC2 to handle the IP-directed broadcasts in the hardware using PFC2.
Note
This example shows how to enable the IP-directed broadcasts:
Router(config-if)# mls ip directed-broadcast ?exclude-router exclude router from recepient list for directed broadcastinclude-router include router in recepient list for directed broadcastThe exclude-router option forwards the IP-directed broadcast packet in the hardware to all the hosts in the VLAN except the router.
The include-router option forwards the IP-directed broadcast packet in the hardware to all the hosts in the VLAN including the router. With this option, the router does not forward the IP-directed broadcast packet again.
The no form of the command is as follows:
Router(config-if)# no mls ip directed-broadcast [exclude-router | include-router]The no form returns the interface configuration to the default mode. In the default mode, the IP-directed broadcast packets are not hardware forwarded. They are handled at the process level by MSFC2. The MSFC2 decision to forward or not forward the packet depends on the ip directed-broadcast command configuration.
There is no interaction between the ip directed-broadcast command and the mls ip directed-broadcast command. The ip directed-broadcast command involves software forwarding and the mls ip directed-broadcast command involves hardware forwarding.
