> Ethernet Interface Configuration Mode Commands
> The Ethernet Interface Configuration Mode is used to create and manage the IP interface parameters within a specified context.
> crypto-map
> Applies the specified IPSec crypto-map to this interface.
> Product
> PDSN, HA
> Privilege
> Security Administrator, Administrator
> Syntax
> crypto-map map_name [ secondary-address sec_ip_addr ]
> no
> Deletes the application of the crypto map on this interface.
> map_name
> Specifies the name of the crypto map being applied as an alphanumeric string of 1 through 127 characters that is case sensitive.
> secondary-address sec_ip_addr
> Applies the crypto map to the secondary address for this interface. sec_ip_addr must be specified using the IPv4 dotted-decimal or IPv6 colon-separated notation.
> Usage
> In order for ISAKMP and/or manual crypto maps to work, they must be applied to a specific interface using this command. Dynamic crypto maps should not be applied to interfaces.
> The crypto map must be configured in the same context as the interface.
> Example
> To apply the IPSec crypto map named cmap1 to this interface, use the following command:
> crypto-map cmap1
> description
> Sets the descriptive text for the current interface.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> description text
> no description
> no
> Clears the description for the interface.
> text
> Specifies the descriptive text as an alphanumeric string of 0 through 79 characters.
> Usage
> Set the description to provide useful information on the interface’s primary function, services, end users, etc. Any information useful may be provided.
> Example
> description sampleInterfaceDescriptiveText
> end
> Exits the current configuration mode and returns to the Exec mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> end
> Usage
> Use this command to return to the Exec mode.
> exit
> Exits the current mode and returns to the parent configuration mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> exit
> Usage
> Use this command to return to the parent configuration mode.
> ip
> Configures the IP options for the current interface.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> ip { access-group acl_name { in | out } [ priority-value ] | address ip_address ip_mask [ secondary | srp-activate ] | arp { arpa | timeout seconds } }
> no ip { access-group acl_name { in | out } | address ip_address | arp { arpa | timeout } }
> no
> Disables and/or restores the option to the system default.
> access-group acl_name { in | out } [ priority-value ]
> Specifies the access control list to be added/removed from the group. The ACL rules must be configured in the same context as the interface.
> In Release 8.1 and later, acl_name must be an alphanumeric string of 1 through 47 characters.
> In Release 8.0 and earlier, acl_name must be an alphanumeric string of 1 through 79 characters.
> The direction must also be specified as either inbound or outbound using the keywords in and out, respectively.
> priority-value: Default: 0. If more than one ACL is applied, priority-value specifies the priority in which they will be compared against the packet. If not specified, the priority is set to 0. priority-value must be an integer from 0 through 4294967295. If access groups in the list have the same priority, the last one entered is used first.
> Important: Up to eight ACLs can be applied to a group provided that the number of rules configured within the ACL(s) does not exceed the 128-rule limit for the interface.
> address ip_address ip_mask [ secondary | srp-activate ]
> Configures the IP address for the interface specifying the networking mask as well. ip_address and ip_mask must be entered using IPv4 dotted-decimal or IPv6 colon-separated notation.
> Important: For IPv4 addresses, 31-bit subnet masks are supported per RFC 3021.
> The secondary keyword configures a secondary IP address on the interface. This is referred to as multi-homing of the interface.
> The srp-activate keyword activates the IP address for Interchassis Session Recovery (ICSR).
> arp { arpa | timeout seconds }
> Important: These keywords have been replaced by the R_arp command in the Global Configuration Mode. For backwards compatibility, however, these keywords are accepted as valid.
> Usage
> Create and manage the IP interfaces for the associated context.
> Example
> The following command configures the access group for the current context:
> ip access-group sampleAccessGroup
> ip address 10.2.3.4 0.0.0.128 secondary
> The following command sets the address resolution protocol timeout.
> ip arp timeout 1800
> The following commands remove the associated IP address and disable ARP for the interface, respectively.
> no ip address 10.2.3.4
> no ip arp arpa
> ip mtu
> Configures the Maximum Transmission Unit (MTU) for this IP interface.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> [ no ] ip mtu mtu-size
> no
> Deletes the MTU value.
> Usage
> IP MTU is supported for a normal interface and point-to-point interface (OLC ports).
> The maximum MTU size allowed with an OLC port is 1600. The maximum MTU size allowed with an Ethernet port is 2048. The default MTU size is 1500.
> Example
> The following command sets the MTU value to 2048.
> ip mtu 2048
> ip ospf authentication-key
> Configures the password for authentication with neighboring Open Shortest Path First (OSPF) routers.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf authentication-key [ encrypted ] password auth_key
> no ip ospf authentication-key
> no
> Deletes the authentication key.
> encrypted
> Use this keyword if you are pasting a previously encrypted authentication key into the CLI command.
> password auth_key
> Specifies the password to use for authentication as an alphanumeric string of 1 through 16 characters entered in clear text format.
> Usage
> Use this command to set the authentication key used when authenticating with neighboring routers.
> Example
> To set the authentication key to 123abc, use the following command;
> ip ospf authentication-key password 123abc
> Use the following command to delete the authentication key;
> no ip ospf authentication-key
> ip ospf authentication-type
> Configures the OSPF authentication method to be used with OSPF neighbors over the logical interface.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf authentication-type { message-digest | null | text }
> no ip ospf authentication-type { message-digest | null | text }
> no
> Disable this function.
> message-digest
> Uses the message digest (MD) authentication method.
> null
> Uses no authentication, thus disabling either MD or clear text methods.
> text
> Uses the clear text authentication method.
> Usage
> Use this command to set the type of authentication to use when authenticating with neighboring routers.
> Example
> To set the authentication type to use clear text, enter the following command;
> ip ospf authentication-type text
> ip ospf cost
> Configures the cost associated with sending a packet over the OSPF logical interface.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf cost value
> no ip ospf cost
> no
> Disable this function.
> value
> Specifies the cost to assign to OSPF packets as an integer from 1 through 65535. Default: 10
> Usage
> Use this command to set the cost associated with routes from the interface.
> Example
> Use the following command to set the cost to 20;
> ip ospf cost 20
> Use the following command to disable the cost setting;
> no ip ospf cost
> ip ospf intervals
> Configures the interval or delay type, and the interval or delay time in seconds, for OSPF communications.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf { dead-interval value | hello-interval value | retransmit-interval value | transmit-delay value }
> no ip ospf { dead-interval | hello-interval | retransmit-interval | transmit-delay }
> no
> Deletes the value set and returns the value to its default.
> dead-interval value
> Specifies the interval (in seconds,) that the router should wait, during which time no packets are received and after the router considers a neighboring router to be off-line. value must be an integer from 1 through 65535. Default: 40
> hello-interval value
> Specifies the interval (in seconds) between sending hello packets as an integer from 1 through 65535. Default: 10
> retransmit-interval value
> Specifies the interval in (seconds) between LSA (Link State Advertisement) retransmissions as an integer from 1 through 65535. Default: 5
> transmit-delay value
> Specifies the interval (in seconds) that the router should wait before transmitting a packet. value must be an integer from 1 through 65535. Default: 1
> Usage
> Use this command to set the intervals or delays for OSPF communications.
> Example
> To set the dead-interval to 100, use the following command;
> ip ospf dead-interval 100
> To delete the setting for the dead-interval and reset the dead-interval value to its default of 40, use the following command’
> no ip ospf dead-interval
> ip ospf message-digest-key
> Enables or disables the use of MD5-based OSPF authentication.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf message-digest-key key_id md5 [ encrypted ] password authentication_key
> no ip ospf message-digest-key key_id
> no
> Deletes the key.
> message-digest-key key_id
> Specifies the key identifier number as an integer from 1 through 255.
> encrypted
> Use this if you are pasting a previously encrypted authentication key into the CLI command.
> password authentication_key
> Specifies the password to use for authentication as an alphanumeric string of 1 through 16 characters entered in clear text format.
> Usage
> Use this command to create an authentication key that uses MD5-based OSPF authentication.
> Example
> To create a key with the ID of 25 and a password of 123abc, use the following command;
> ip ospf message-digest-key 25 md5 password 123abc
> To delete the same key, enter the following command;
> no ip ospf message-digest-key 25
> ip ospf network
> Configures the Open Shortest path First (OSPF) network type.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf network { broadcast | non-broadcast | point-to-multipoint | point-to-point }
> no ip ospf network
> no
> Disable this function.
> broadcast
> Sets the network type to broadcast.
> non-broadcast
> Sets the network type to non-broadcast multi access (NBMA).
> point-to-multipoint
> Sets the network type to point-to-multipoint.
> point-to-point
> Sets the network type to point-to-point.
> Usage
> Use this command to specify the OSPF network type.
> Example
> To set the OSPF network type to broadcast, enter the following command;
> ip ospf network broadcast
> To disable the OSPF network type, enter the following command;
> no ip ospf network
> ip ospf priority
> Designates the OSPF router priority.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> ip ospf priority value
> no ip ospf priority value
> no
> Disable this function.
> value
> Sets the priority value as an integer from 0 through 255.
> Usage
> Use this command to set the OSPF router priority.
> Example
> To set the priority to 25, enter the following command:
> ip ospf priority 25
> To disable the priority, enter the following command:
> no ip ospf priority
> ipv6 access-group
> Specifies the name of the access control list (ACL) group to assign to this interface. You can filter for either inbound or outbound traffic.
> Product
> PDSN, HA
> Privilege
> Security Administrator, Administrator
> Syntax
> [ no ] ipv6 access-group group name { in | out } { priority-value priority_value }
> no
> Removes a previously configured access group association.
> group_name
> Specifies the name of the access group as an alphanumeric string of 1 to 79 characters.
> in
> Applies the filter to the inbound traffic.
> out
> Applies the filter to the outbound traffic.
> priority-value
> Specifies the priority of the access group as an integer from 0 to 4294967295. 0 is the highest priority. If priority-value is not specified, the priority is set to 0.
> If access groups in the list have the same priority, the last one entered is used first.
> Usage
> Use this command to specify the ACL group to assign the interface to. Specify an ACL group name with this command.
> Important: Up to eight ACLs can be applied to a group provided that the number of rules configured within the ACL(s) does not exceed the 128-rule limit for the interface.
> Example
> Use the following command to associate the group_1 access group with the current IPv6 profile for inbound access:
> ipv6 access-group group_1 in 1
> ipv6 address
> Specifies the address and subnet mask.
> Product
> PDSN, HA
> Privilege
> Security Administrator, Administrator
> Syntax
> ipv6 address ip_address
> ip_address
> Specifies an individual host IP address to add to this host pool in IPv6 colon-separated notation.
> Usage
> Configures the IPv6 address and subnet mask for a specific interface.
> ipv6 ospf
> Enables Open Shortest Path First Version 3 (OSPFv3) functionality on this interface.
> Product
> PDSN, HA, GGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> [ no ] ipv6 ospf [ area { integer_value | ipv4-address } | cost cost-value | dead-interval dead-intrv | hello-interval hello-intrvl | priority p-value | retransmit-interval retx-interval | transmit-delay td-interval ]
> no
> Removes a previously configured access group association.
> area { integer_value | ipv4-address
> Specifies an OSPFv3 area.
> decimal_value: Specifies the identification number of the area as an integer from 0 through 4294967295.
> ipv4address: Specifies the IP address of the area in IPv4 dotted-decimal notation.
> cost cost-value
> Specifies a link cost as an integer from 1 through 65535. The link cost is carried in the LSA updates for each link. The cost is an arbitrary number.
> dead-interval dead-intrv
> Specifies the interval (in seconds) after which a neighbor is declared dead when no hello packets as an integer from 1 through 65535.
> hello-interval hello-intrvl
> Specifies the interval (in seconds) between hello packets that OSPFv3 sends on an interface as an integer from 1 through 65535.
> priority p-value
> Specifies the of the interface as an integer from 0 through 255.
> retransmit-interval retx-interval
> Specifies the time (in seconds) between link-state advertisement (LSA) retransmissions for adjacencies belonging to the OSPFv3 interface as an integer from 1 through 65535.
> transmit-delay td-interval
> Specifies the estimated time (in seconds) required to send a link-state update packet on the interface as an integer from 1 through 65535.
> Usage
> Configure an OSPFv3 interface in this context.
> Example
> ipv6 ospf area 334 cost 555 dead-interval 40 hello-interval 10 priority 10 retransmit-interval 5 transmit-delay 10
> ipv6 router advertisement
> Enables or disables the system to send IPv6 router advertisements.
> Product
> PDSN, HA
> Privilege
> Security Administrator, Administrator
> Syntax
> [ no ] ipv6 router advertisement
> Usage
> Enables sending of router advertisements on the interface. All of the pool prefixes in the context (belonging to the interface) will be advertised in the router advertisement.
> The router-lifetime in the advertisement is sent as 0 to indicate to the receiver that the sender cannot be a default-router. For all the prefixes (pools), the valid and preferred lifetime are sent as default. The router-advertisement is sent every 600 seconds.
> If the pool-prefix is deleted, then an router-advertisement is sent for that particular prefix with the valid and preferred time set to 0.
> policy-forward
> Configures the system for redirecting the HA packets to new HA during existing HA upgrade.
> Product
> PDSN, HA
> Privilege
> Security Administrator, Administrator
> Syntax
> policy-forward { icmp unreachable next-hop ip address | unconnected-address next-system ip_address }
> no policy-forward unconnected-address
> no
> Deletes the policy forwarding configuration for unconnected address for the current interface.
> icmp unreachable next-hop ip address
> Specifies routing of Internet Control Message Protocol (ICMP) unreachable is required in overlapping pool configuration. ip_address must be an IP address expressed in IPv4 dotted-decimal or IPv6 colon-separated notation.
> unconnected-address next-system ip address
> Specifies the IP address of the next system HA to handle processing during HA upgrade. ip_address must be an IP address expressed in IPv4 dotted-decimal or IPv6 colon-separated notation.
> Usage
> Use this command to set the redirecting policy for IP packets from an existing HA to a new HA during upgrade. To configure this command both keywords will be in separate interface.
> Important: This is a customer specific command.
> Example
> To configure existing HA system for redirecting the HA packets to new HA during existing HA upgrade enter the following commands:
> policy-forward unconnected-address next-system ip_address
> policy-forward icmp unreachable next-hop ip_address
> pool-share-protocol
> Configures the primary or secondary system for the IP pool sharing protocol and enter IPSP configuration mode.
> Product
> PDSN, HA
> Privilege
> Security Administrator, Administrator
> Syntax
> pool-share-protocol { primary ip_address | secondary ip_address } [ mode { active | inactive | check-config } ]
> no pool-share-protocol
> no
> Deletes the IP pool sharing protocol information from the current interface.
> primary address
> On the secondary system, defines the IP address of an interface on the primary system that has identical IP pools configured for use with the IP pool sharing protocol. ip_address must be expressed in IP v4 dotted-decimal notation.
> secondary ip_address
> On the primary system, define the IP address of an interface on the secondary system that has identical IP pools configured for use with the IP pool sharing protocol. ip_address must be expressed in IP v4 dotted-decimal notation.
> mode {active | inactive | check-config}
> This is an optional command to manage the mode for IP pool sharing protocol for primary or secondary HA.
> active: Activates the IP pool sharing protocol mode.
> inactive: Inactivates the IP pool sharing protocol mode.
> check-config: Verifies the IP pool sharing protocol configuration.
> Usage
> Use this command to set the IP address of the primary or secondary system for use with the IP pool sharing protocol and enter ipsp configuration mode. This command must be configured for an interface in each context that has IP pools configured. Refer to the System Administration and Configuration Guide for information on configuring and using the IP pool sharing protocol.
> Important: Both the primary and secondary systems must be in the same subnet.
> Important: For information on configuring and using IP Pool Sharing Protocol (IPSP), refer to the Packet Data Serving Node Administration Guide.
> Important: Reserve free addresses on the primary HA for this command via the reserved-free-percentage command as described in the IPSP Configuration Mode Commands chapter of this guide.
> Example
> To configure a secondary system with an IP address of 192.168.100.10 for use with the IP pool sharing protocol, enter the following command:
> pool-share-protocol secondary 192.168.100.10
> To inactivate a secondary system with an IP address of 192.168.100.10 for use with the IP pool sharing protocol, enter the following command:
> pool-share-protocol secondary 192.168.100.10 mode inactive
> port-switch-on-L3-fail
> Causes the line card port to which the current interface is bound to switch over to the port on the redundant line card when connectivity to the specified IP address is lost.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> port-switch-on-L3-fail address { ip_address | ipv6_address } [ minimum-switchover-period switch_time ] [ interval int_time ] [ timeout time_out ] [ num-retry number ]
> no port-switch-on-L3-fail
> no
> Disable port switchover on failure.
> ip_address
> The IP address to monitor for connectivity, entered in IPv4 dotted-decimal or IPv6 colon-separated notation.
> minimum-switchover-period switch_time
> After a switchover occurs, another switchover cannot occur until the specified amount of time (in seconds) has elapsed. switch_time must be an integer from 1 through 3600. Default: 120
> interval int_time
> Specifies how often (in seconds) monitoring packets are sent to the IP address being monitored. int_time must be an integer from 1 through 3600. Default: 60
> timeout time_out
> Specifies how long to wait (in seconds) without a reply before resending monitoring packets to the IP address being monitored. time_out must be an integer from 1 through 10. Default: 3
> num-retry number
> Specifies how many times to retry sending monitor packets to the IP address being monitored before performing the switchover. number must be an integer from 1 through 100. Default: 5
> Usage
> Use this command to monitor a destination in your network to test for L3 connectivity. The destination being monitored should be reachable from both the active and standby line cards.
> Example
> The following command enables port switchover on connectivity failure to the IP address 192.168.10.100 using default values:
> port-switch-on-L3-fail address 192.168.10.100
> The following command disables port switchover on connectivity failure:
> no port-switch-on-L3-fail
> vlan-map
> Sets a single next-hop IP address so that multiple VLANs can use a single next-hop gateway. The vlan-map is associated with a specific interface.
> Product
> PDSN, HA, SGSN
> Privilege
> Security Administrator, Administrator
> Syntax
> vlan-map next-hop ip_address
> next-hop ip_address
> Defines an IP address for the next-hop gateway in IPv4 dotted-decimal or IPv6 colon-separated notation.
> Usage
> Use this command to combine multiple VLAN links to go through a single IP address. This feature is used in conjunction with nexthop forwarding and overlapping IP pools.
> After configuring the vlan-map, move to the Port Ethernet Configuration mode to attach the vlan-map to a specific VLAN.
> Example
> The following command sets an IPv4 address for a next-hop gateway.
> vlan-map next-hop 123.123.123.1

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883