The set of all CLI commands is grouped in hierarchical order, according to the type of the commands. The first two levels in the hierarchy are the User Exec and Privileged Exec modes. These are non-configuration modes in which the set of available commands enables the monitoring of the SCE platform, file system operations, and other operations that cannot alter the configuration of the SCE platform.

The next levels in the hierarchy are the Global and Interface configuration modes, which hold a set of commands that control the global configuration of the SCE platform and its interfaces. Any of the parameters set by the commands in these modes should be saved in the startup configuration, such that in the case of a reboot, the SCE platform restores the saved configuration.

The following tableshows the available CLI modes.

When you login to the system, you have the User authorization level and enter User Exec mode. Changing the authorization level to Viewer does not change the mode. Changing the authorization level to Admin automatically moves you to Privileged Exec mode. In order to move to any of the configuration modes, you must enter commands specific to that mode.

The list of available commands in each mode can be viewed using the question mark ‘?’ at the end of the prompt.

The figure below, illustrates the hierarchical structure of the CLI modes, and the CLI commands used to enter and exit a mode.

Figure 1.1. CLI Command Hierarchy

The following commands are used to enter the different configure interface modes and the Line Configuration Mode:

Example:

This example illustrates moving into and out of configuration modes as follows:

SCE#configure
SCE(config)#clock timezone PST -10
SCE(config)#interface Mng 0/1
SCE(config if)#speed 100
SCE(config if)#exit
SCE(config)#interface LineCard 0
SCE(config if)#link-mode all-links forwarding
SCE(config if)#exit
SCE(config)#exit
SCE#

The SCE platform has four authorization levels, which represent the user access permissions. When you initially connect to the SCE platform, you automatically have the most basic authorization level, that is User, which allows minimum functionality.

In order to monitor the system, you must have Viewer authorization, while in order to perform administrative functions on the SCE platform, you must have Admin or Root authorization. A higher level of authorization is accessed by logging in with appropriate password, as described in the procedures below.

In each authorization level, all the commands of the lower authorization layers are available in addition to commands that are authorized only to the current level.

The following CLI commands are related to authorization levels:

enable
disable

Each authorization level has a value (number) corresponding to it. When using the CLI commands, use the values, not the name of the level, as shown in the following table.

A telnet session begins with a request for password, and will not continue until the proper user password is supplied. This enhances the security of the system by not revealing its identity to unauthorized people.

Example:

The following example illustrates how to change the authorization level from User to Admin, and then revert back to Viewer. No password is required for moving to a lower authorization level.

SCE>enable 10
Password:  cisco
SCE#disable
SCE>

The on-screen prompt indicates your authorization level, your command hierarchy level, and the assigned host name. The structure of the prompt is: <hostname(mode-indication)level-indication>

Authorization levels are indicated as follows:

Command hierarchy levels are indicated as follows:

Example:

The prompt SCE1(config if)# indicates:

This section describes how to revert to a previous mode.

Example:

The following example shows the system response when you exit the Interface Configuration mode.

SCE(config if)#exit
SCE(config)#

The components that are configured by the Interface Configuration Modes are:

SCE(config)#interface FastEthernet 0/3
SCE(config if)#

SCE(config)#interface GigabitEthernet 0/2
SCE(config if)#

SCEconfig if# do show running-config

To obtain a list of commands that begin with a particular character string, enter the abbreviated command entry immediately followed by a question mark (?). This form of help is called partial help, because it lists only the keywords or arguments that begin with the abbreviation you entered.

Example:

The following example illustrates how typing c? displays all available arguments that start with the letter c.

SCE(config)#snmp-server c?
Community		contact
SCE(config)#snmp-server c

To obtain a list of command’s associated keywords or parameters, type a question mark (?) in place of a keyword or parameter on the command line.

Note that if <Enter> is acceptable input, the symbol <cr> represents the Enter key.

Example:

The following example illustrates how to get a list of all arguments or keywords expected after the command snmp-server.

SCE(config)#snmp-server ?
Community	Define community string
Contact		Set system contact
Enable		Enable the SNMP agent
Host   	 	Set traps destination
Location		Set system location
SCE(config)# snmp-server 

When asking for help on particular parameter, the system informs you of the type of data that is an accepted legal value. The types of parameters supported are:

Example:

The following example illustrates the use of ? to get help on commands syntax. In this example, you can enter either the word running-config, or any name of a file, after the word copy.

SCE#copy ?
	running-config		Copy running configuration file
	STRING			Source file name
SCE#copy

Many CLI commands offer the option of adding the word no before the command to disable the feature controlled by the command or revert it to its default configuration. This notation is shown in the CLI Command Reference as [no] to denote it is optional.

For example, no service telnetd disables the telnet server. Enabling the telnet server is done by typing service telnetd.

CLI maintains a history buffer of the most recent commands you used in the current CLI session for quick retrieval. Using the keyboard, you can navigate through your last commands, one by one, or all commands that start with a given prefix. By default, the system saves the last 30 commands you typed. You can change the number of commands remembered using the history size command.

To use the history functions, use the keys shown in the following table.

The SCE platform has a number of keyboard shortcuts that make it easier to navigate and use the system. The following table shows the keyboard shortcuts available.

You can get a display the keyboard shortcuts at any time by typing help bindings.

The CLI interface features tab completion. When you type in the first letters of a command and type <Tab>, the system automatically fills in the rest of the command or keyword. This feature works only when there is one possible command that could be possible using the starting letters.

Example:

The letters snm followed by <Tab> will be completed to the command snmp-server.

SCE(config)#snm<Tab>
SCE(config)#snmp-server

If you type <Enter> instead of <Tab>, and there is no ambiguity, the system actually carries out the command which would be filled in by the rest of the word.

Example:

The following example displays how the system completes a partial (unique) command for the enable command. Because enable does not require any parameters, the system simply carries out the enable command when the user presses Enter.

SCE>en<Enter>
Password:   
SCE#

CLI enables saving ftp user name and password to be used in FTP operations—download and upload, per session.

These settings are effective during the current CLI session.

Example:

The following example illustrates how to set FTP password and user name and the use in these settings for getting a file named config.tmp from a remote station using FTP protocol.

SCE#ip ftp password vk
SCE#ip ftp username vk
SCE#copy ftp://@10.1.1.253/h:/config.tmp myconf.txt
connecting 10.1.1.253 (user name vk password vk) to retrieve config.tmp 
SCE#

The output of some show and dir commands is quite lengthy and cannot all be displayed on the screen at one time. Commands with many lines of output are displayed in chunks of 24 lines. You can choose to scroll the display line by line or refresh the entire screen. At the prompt after any line, you can type one of the following keys for the desired action:

You can filter the output of certain commands, such as show, more, and dir, so that output lines are displayed only if they include or exclude a specified expression. The filtering options are as follows:

The syntax of filtered commands is as follows:

<command> | include <expression>
<command> | exclude <expression>
<command> | begin <expression>

The <expression> in these commands is case sensitive.

Example

Following is an example of how to filter the show version command to display only the last part of the output, beginning with the version information.

SCE#  show version begin revision

You can redirect the output of commands, such as show, more, and dir, to a file. When writing the output of these commands to a file, you can specify either of the following options:

The syntax of redirection commands is as follows:

<command> | redirect <file-name>
<command> | append <file-name>

Example

Following is an example of how to do the following:

Lists all of the commands available for the current command mode. You can also use the ? command to get specific information on a keyword or parameter.

To obtain a list of commands that begin with a particular character string, enter the abbreviated command entry immediately followed by a question mark (?). This form of help is called partial help, because it lists only the keywords or arguments that begin with the abbreviation you entered.

Syntax Description

This command has no arguments or keywords

Defaults

This command has no default settings

Command Modes

All

Usage Guidelines

To list a command’s associated keywords or arguments, enter a question mark (?) in place of a keyword or parameter on the command line. This form of help is called argument help because it lists the keywords or arguments that apply based on the command, keywords, and arguments you have already entered.

Authorization: User

Examples

The following example shows ways of requesting help using the ? wildcard.

SCE(config)#ip ?
default-gateway  Sets the default gateway
domain-lookup    Enables the IP DNS-based host name-to-address translation
domain-name      Define a default domain name
host             Add a host to the host table
name-server      Specify the address of one or more name servers to use for name and address resolution
route            Add IP routing entry
SCE(config)#ip d?
default-gateway  domain-lookup  domain-name
SCE(config)#ip de?
default-gateway
SCE(config)#ip de

Related Commands

Enables TACACS+ accounting.

Use the no form of the command to disable TACACS+ accounting.

aaa accounting commands level default stop-start group tacacs+

no aaa accounting commands level default

Syntax Description

level The privilege level for which to enable the TACACS+ accounting

0: User

5: Viewer

10: Admin

15: Root

Defaults

By default, TACACS+ accounting is disabled.

Command Modes

Global Configuration

Usage Guidelines

If TACACS+ accounting is enabled, the SCE platform sends an accounting message to the TACACS+ server after every command execution. The accounting message is logged in the TACACS+ server for the use of the network administrator.

The start-stop keyword (required) indicates that the accounting message is sent at the beginning and the end (if the command was successfully executed) of the execution of a CLI command.

Authorization: admin

Examples

The following example enables TACACS+ accounting for the admin privilege level (10).

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#aaa accounting commands 10 default stop-start group tacacs+ 
SCE(config)#

Related Commands

aaa authentication attempts

aaa authentication enable default

aaa authentication login default

tacacs-server host

tacacs-server key

Sets the maximum number of login attempts that will be permitted before a Telnet session is terminated.

aaa authentication attempts login number-of-attempts

Syntax Description

number-of-attempts the maximum number of login attempts that will be permitted before the telnet session is terminated

Defaults

Default number-of-attempts = 3

Command Modes

Global Configuration

Usage Guidelines

The maximum number of login attempts is relevant only for Telnet sessions. From the local console, the number of re-tries is unlimited.

Authorization: admin

Examples

The following example shows how to set the maximum number of logon attempts to five.

SCE>enable 10
Password:<cisco>
SCE#config
product>(config)# aaa authentication attempts login 5
SCE(config)#

Related Commands

aaa authentication accounting commands

aaa authentication enable default

aaa authentication login default

Specifies which privilege level authentication methods are to be used, and in what order of preference.

Use the no form of the command to delete the privilege level authentication methods list.

aaa authentication enable default method1 [method2...]

no aaa authentication enable default

Syntax Description

method the privilege level authentication methods to be used. You may specify up to four different methods, in the order in which they are to be used

Defaults

Default privilege level authentication method = enable only

Command Modes

Global Configuration

Usage Guidelines

Use this command to configure "backup" privilege level authentication methods to be used in the event of failure of the primary privilege level authentication method.

The following method options are available:

If the privilege level authentication methods list is deleted, the default privilege level authentication method only (enable password) will be used. TACACS+ authentication will not be used.

Authorization: admin

Example

This example shows how to configure privilege level authentication methods.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)# aaa authentication enable default group tacacs+ enable none
SCE(config)#

Related Commands

aaa authentication login default

aaa authentication accounting commands

aaa authentication attempts

tacacs-server host

Specifies which login authentication methods are to be used, and in what order of preference.

Use the no form of the command to delete the login authentication methods list.

aaa authentication login default method1 [method2...]

no aaa authentication login default

Syntax Description

method the login authentication methods to be used. You may specify up to four different methods, in the order in which they are to be used

Defaults

Default login authentication method = enable only

Command Modes

Global Configuration

Usage Guidelines

Use this command to configure "backup" login authentication methods to be used in the event of failure of the primary login authentication method.

The following method options are available:

If the login authentication methods list is deleted, the default login authentication method only (enable password) will be used. TACACS+ authentication will not be used.

Authorization: admin

Example

This example shows how to configure login authentication methods.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)# aaa authentication login default group tacacs+ enable none
SCE(config)#

Related Commands

aaa authentication enable default

aaa authentication accounting commands

aaa authentication attempts

tacacs-server host

Enables the drop-red-packets-by-hardware mode. This improves performance, but prevents the application from being able to count all dropped packets.

Use the no form to disable the drop-red-packets-by-hardware mode, enabling the software to count all dropped packets (at the expense of some loss of performance).

accelerate-packet-drops

no accelerate-packet-drops

Syntax Description

This command has no arguments or keywords.

Defaults

By default, accelerate-packet-drops (the drop-red-packets-by-hardware mode) is enabled.

Command Modes

Interface Linecard Configuration

Usage Guidelines

By default, the SCE platform hardware drops red packets (packets that are marked to be dropped due to BW control criteria). However, this presents a problem for the user who needs to know the number of dropped packets per service.

The user can disable the drop-red-packets-by-hardware mode. The application can then retrieve the number of dropped packets for every flow and provide the user with better visibility into the exact number of dropped packets and their distribution.

Note that counting all dropped packets has a considerable affect on system performance, and therefore, by default, the drop-red-packets-by-hardware mode is enabled.

Authorization: admin

Example

The following example shows how to disable the drop-red-packets-by-hardware mode so that the application can count all dropped packets.

SCE>enable 10
Password:<cisco>
SCE#>config
SCE(config)#interface linecard 0
SCE(config if)#no accelerate-packet-drops
SCE(config if)#

Related Commands

show interface linecard accelerate-packet-drops

Restricts Telnet server access to those addresses listed in the specified access list.

Use the no form of this command to set the Telnet server to accept access from any IP address.

access-class number in

no access-class number in

Syntax Description

number An access-list number (1–99).

Defaults

By default, no access list is configured (Telnet access is available from any IP address).

Command Modes

Line Configuration Mode

Usage Guidelines

Authorization: admin

Examples

The following are examples of the access-class command:

Example 1

The following example configures an access class for all Telnet lines.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#line vty 0
SCE(config-line)#access-class 1 in
SCE(config-line)#

Example 2

The following example removes an access class for Telnet lines.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#line vty 0
SCE(config-line)#no access-class in
SCE(config-line)#

Related Commands

access-list

show access-lists

Adds an entry to the bottom of the specified access list.

Use the no form of the command to remove an entry from the specified access list.

access-list number permission address

no access-list number

Syntax Description

number An access-list number (1–99).

permission Indicates whether the IP address should be allowed or denied access permission as described in the Valid Permission Values table in the Usage Guidelines..

address Addresses to be matched by this entry as described in the Valid Address Values table in the Usage Guidelines.

Defaults

This command has no default settings.

Command Modes

Global Configuration

Usage Guidelines

The SCE platform can be configured with Access Control Lists (ACLs), which are used to permit or deny incoming connections on any of the management interfaces. An access list is an ordered list of entries, each consisting of the following:

The order of the entries in the list is important. The default action of the first entry that matches the connection is used. If no entry in the Access List matches the connection, or if the Access List is empty, the default action is deny.

Authorization: admin

Examples

The following examples illustrate the use of this command.

Example 1

The following example adds entries to the bottom of access-list 1. The first entry permits access to 10.1.1.0 through 10.1.1.255. The second entry denies access to any address. Together this list allows access only to addresses 10.1.1.*.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#access-list 1 permit 10.1.1.0 0.0.0.255
SCE(config)#access-list 1 deny any
SCE(config)#

Example 2

The following example defines access list 2, a list that denies access to all IP addresses in the range: 10.1.2.0 to 10.1.2.255, permits access to all other addresses in the range 10.1.0.0 to 10.1.15.255, and denies access to all other IP addresses. Note that since the first range is contained within the second range, the order of entries is important. If they had been entered in the opposite order, the deny entry would not have any effect.

SCE>enable 10
Password:<cisco>
SCE#config
SCE (config)#access-list 2 deny 10.1.2.0 0.0.0.255 
SCE (config)#access-list 2 permit 10.1.0.0 0.0.15.255
SCE(config)#

Related Commands

access-class

snmp-server community

ip access-class

show access-lists

attack-detector

snmp-server community

Specifies which management port is currently active.

active-port

Syntax Description

This command has no arguments or keywords

Defaults

Default Mng port is 0/1.

Command Modes

Mng Interface Configuration

Usage Guidelines

The command must be executed from the Mng interface that is to be defined as the active port, as follows:

The use of this command varies slightly, depending on whether the management interface is configured as a redundant interface (auto fail-over enabled) or not (auto fail-over disabled)

Authorization: admin

Examples

The following example shows how to use this command to configure Mng port 2 as the currently active management port.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface mng 0/2
SCE(config-if)#active-port
SCE(config-if)#

Related Commands

auto-fail-over

interface mng

Forces the current application replace process to complete and immediately start finalization (killing all old flows).

application slot slot-number replace force completion

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example illustrates how to force the application replace operation to complete immediately.

SCE>enable 10
Password:<cisco>
SCE#application slot 0 replace force completion
SCE#

Related Commands

Defines default thresholds and attack handling action. If a specific attack detector is defined for a particular situation (protocol/attack direction/side), it will override these defaults.

Use the no version of this command to delete the user-defined defaults. The system defaults will then be used.

attack-detector default protocol protocol attack-direction attack-direction side side [action action] [open-flows open-flows] [ddos-suspected-flows ddos-suspected-flows] [suspected-flows-ratio suspected-flows-ratio] [notify-subscriber|dont-notify-subscriber] [alarm|no-alarm]

no attack-detector default protocol protocol attack-direction attack-direction side side [action action] [open-flows open-flows] [ddos-suspected-flows ddos-suspected-flows] [suspected-flows-ratio suspected-flows-ratio]

Syntax Description

protocol TCP, UDP, IMCP, other

attack-direction attack-source, attack-destination, both

side subscriber, network, both

action report, block

open-flows Threshold for concurrently open flows (new open flows per second).

ddos-suspected-flows Threshold for DDoS-suspected flows (new suspected flows per second).

suspected-flows-ratio Threshold for ratio of suspected flow rate to open flow rate.

Defaults

The default values for the default attack detector are

Command Modes

Linecard Interface Configuration

Usage Guidelines

The following arguments must always be specified:

The following arguments are optional:

Use the optional keywords as follows:

Use the attack-detector <number> command to configure a specific attack detector.

Authorization: admin

Examples

The following examples illustrate the use of the attack-detector default command:

Example 1:

The following example configures a default attack detector for TCP flows from the attack source.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-detector default protocol TCP attack-direction attack-source side both action report open-flows 500 ddos-suspected-flows 75 suspected-flows-ratio 50 
SCE(config if)#

Example 2:

The following example enables subscriber notification for the specified default attack detector.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-detector default protocol TCP attack-direction attack-source side both notify-subscriber
SCE(config if)#

Related Commands

attack-detector <number>

attack-filter subscriber-notification ports

show interface linecard attack-detector

Enables the specified attack detector and assigns an access control list (ACL) to it.

attack-detector number access-list access-list

Syntax Description

number The attack detector number.

access-list The number of the ACL containing the IP addresses selected by this detector

Defaults

This command has no default settings.

Command Modes

Linecard Interface Configuration

Usage Guidelines

Use the following commands to define the attack detector and the ACL:

Authorization: admin

Examples

The following example enables attack detector number "2", and assigns ACL "8".

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-detector 2 access-list 8
SCE(config if)#

Related Commands

access-list

attack-detector <number>

show interface linecard attack-detector

show access-lists

Configures a specific attack detector for a particular attack type (protocol/attack direction/side) with the assigned number.

Use the attack-detector default form of this command to configure the default attack detector for the specified attack type.

Use the no form of this command to delete the specified attack detector.

Use the default attack-detector form of the command to use the default attack detector configuration for the specified attack detector(s).The all and all-numbered options also disable all numbered attack detectors.

attack-detector <number> protocol (((TCP|UDP) [dest-port (specific|not-specific|both)])|ICMP|other|all) attack-direction (single-side-source|single-side-destination|single-side-both|dual-sided|all) side (subscriber|network|both) [action (report|block)] [open-flows open-flows] [ddos-suspected-flows ddos-suspected-flows] [suspected-flows-ratio suspected-flows-ratio] [notify-subscriber|dont-notify-subscriber] [alarm|no-alarm]

no attack-detector <number>

attack-detector default protocol (((TCP|UDP) [dest-port (specific|not-specific|both)])|ICMP|other|all) attack-direction (single-side-source|single-side-destination|single-side-both|dual-sided|all) side (subscriber|network|both) [action (report|block)] [open-flows open-flows] [ddos-suspected-flows ddos-suspected-flows] [suspected-flows-ratio suspected-flows-ratio] [notify-subscriber|dont-notify-subscriber] [alarm|no-alarm]

no attack-detector default protocol (((TCP|UDP) [dest-port (specific|not-specific|both)])|ICMP|other|all) attack-direction (single-side-source|single-side-destination|single-side-both|dual-sided|all) side (subscriber|network|both)

default attack-detector {all |all-numbered}

default attack-detector <number> protocol (((all | IMCP | other | TCP | UDP) [dest-port (specific|not-specific|both)])|ICMP|other|all) attack-direction (single-side-source|single-side-destination|single-side-both|dual-sided|all) side (subscriber|network|both)

Syntax Description

number Assigned number for attack-detector

protocol TCP, UDP, IMCP, other

destination port {TCP and UDP protocols only): Defines whether the default attack detector applies to specific (port-based) or not specific (port-less) detections.

attack-direction single-side-destination|single-side-both|dual-sided|all

side subscriber, network, both

action report, block

open-flows-rate Threshold for rate of open flows (new open flows per second).

suspected-flows-rate Threshold for for rate of suspected DDoS flows (new suspected flows per second)

suspected-flows-ratio Threshold for ratio of suspected flow rate to open flow rate.

Defaults

The default values for the default attack detector are:

Command Modes

Linecard Interface Configuration

Usage Guidelines

If a specific attack detector is defined for a particular attack type, it will override the configured default attack detector.

The following arguments must always be specified:

The following arguments are optional:

Use the appropriate keyword to enable or disable subscriber notification by default:

Use the appropriate keyword to enable or disable sending an SNMP trap by default:

If the selected protocol is either TCP or UDP, specify whether the destination port is specific, not specific, or both. If the destination port or ports are specific, the specific destination ports are configured using the attack-detector TCP-port-list|UDP-port-list command.

Use the attack-detector command to enable a configured attack detector.

Use the attack-detector default command to configure a default attack detector.

Authorization: admin

Examples

The following examples illustrate the use of the attack-detector <number> command:

Example 1:

The following example configures the attack detector number "2".

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)# attack-detector 2 protocol UDP dest-port not-specific attack-direction single-side-destination side both action block open-flows-rate 500 suspected-flows-rate 500 suspected-flows-ratio 50 notify-subscriber alarm
SCE(config if)#

Example 2:

The following example deletes attack detector number "2".

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#no attack-detector 2
SCE(config if)#

Example 3:

The following example disables subscriber notification for attack detector number "2".

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-detector 2 protocol UDP dest-port not-specific attack-direction single-side-destination side both dont-notify-subscriber
SCE(config if)#

Related Commands

attack-detector

attack-detector tcp-port-list|udp-port-list

attack-filter subscriber-notification ports

attack-detector default

show interface linecard attack-detector

Defines the list of destination ports for specific port detections for TCP or UDP protocols.

attack-detector <number> (tcp-port-list|udp-port-list) (all|(<port1> [<port2> …]))

Syntax Description

number number of the attack detector for which this list of specific ports is relevant

Defaults

This command has no default settings.

Command Modes

Linecard Interface Configuration

Usage Guidelines

TCP and UDP protocols may be configured for specified ports only (port-based). Use this command to configure the list of specified destination ports per protocol.

Up to 15 different TCP port numbers and 15 different UDP port numbers can be specified.

Configuring a TCP/UDP port list for a given attack detector affects only attack types that have the same protocol (TCP/UDP) and are port-based (i.e. detect a specific destination port). Settings for other attack types are not affected by the configured port list(s).

Specify either TCP-port-list or UDP-port-list.

Use the all keyword to include all ports in the list.

Authorization: admin

Examples

This example shows how to configure the destination port list for the TCP protocol for attack detector #10.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-detector 10 TCP-port-list 100 101 102 103
SCE(config if)#

Related Commands

attack-detector <number>

attack-filter

Enables specific attack detection for a specified protocol and attack direction.

Use the no form of the command to disable attack detection.

attack-filter [protocol (((TCP|UDP) [dest-port (specific|non-specific|both)])|ICMP|other)] [attack-direction (single-side-source|single-side-destination|single-side-both|dual-sided|all)]

no attack-filter [protocol (((TCP|UDP) [dest-port (specific|non-specific|both)])|ICMP|other)] [attack-direction (single-side-source|single-side-destination|single-side-both|dual-sided|all)]

Syntax Description

protocol TCP, UDP, ICMP, or Other

attack direction: defines whether specific IP detection is enabled or disabled for single sided or dual sided attacks.

destination port (TCP and UDP protocols only): Defines whether specific IP detection is enabled or disabled for port-based (specific) or port-less (non-specific) detections.

Defaults

By default, attack-filter is enabled.

Default protocols = all protocols (no protocol specified)

Default attack direction = all directions

Default destination port = oth port-based and port-less

Command Modes

Linecard Interface Configuration

Usage Guidelines

Specific attack filtering is configured in two steps:

In addition, the user can manually override the configured attack detectors to either force or prevent attack filtering in a particular situation (using the attack-filter force-filter | dont-filter command).

By default, specific-IP detection is enabled for all attack types. You can configure specific IP detection to be enabled or disabled for a specific, defined situation only, depending on the following options:

If the selected protocol is either TCP or UDP, specify whether the destination port is specific (port-based), not specific (port-less), or both. If the destination port or ports are specific, the specific destination ports are configured using the attack-detector TCP-port-list|UDP-port-list command.

Authorization: admin

Examples

The following examples illustrate the use of this command.

Example 1

The following example shows how to enable specific, dual-sided attack detection for TCP protocol only.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-filter protocol TCP dest-port specific attack-direction dual-sided
SCE(config if)#

Example 2

The following example shows how to enable single-sided attack detection for ICMP protocol only.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-filter protocol ICMP attack-direction single-side-source
SCE(config if)#

Example 3

The following example disables attack detection for all non TCP, UDP, or ICMP protocols.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#no attack-filter protocol other attack-direction all
SCE(config if)#

Related Commands

attack-detector tcp-port-list|udp-port-list

attack-detector <number>

show interface linecard attack-filter

This command prevents attack filtering for a specified IP address/protocol. If filtering is already in process, it will be stopped.

When attack filtering has been stopped, it remains stopped until explicitly restored by another CLI command (either specific or general). Use the no form of this command to restore attack filtering.

The force-filter keyword forces attack filtering for a specified IP address/protocol. When attack filtering has been forced, it continues until explicitly stopped by another CLI command (either specific or general). Use the no form of this command to stop attack filtering.

attack-filter dont-filter protocol (((TCP|UDP) [dest-port (port-number |not-specific))|ICMP|other) attack-direction (((single-side-source|single-side-destination|single-side-both) ip ip-address)|(dual-sided source-ip ip-address destination-ip ip-address)) side (subscriber|network|both)

attack-filter force-filter protocol (((TCP|UDP) [dest-port (port-number |not-specific))|ICMP|other) attack-direction (((single-side-source|single-side-destination|single-side-both) ip ip-address)|(dual-sided source-ip ip-address destination-ip ip-address)) side (subscriber|network|both)

no attack-filter dont-filter protocol (((TCP|UDP) [dest-port (port-number |not-specific))|ICMP|other) attack-direction (((single-side-source|single-side-destination|single-side-both) ip ip-address)|(dual-sided source-ip ip-address destination-ip ip-address)) side (subscriber|network|both)

no attack-filter force-filter protocol (((TCP|UDP) [dest-port (port-number |not-specific))|ICMP|other) attack-direction (((single-side-source|single-side-destination|single-side-both) ip ip-address)|(dual-sided source-ip ip-address destination-ip ip-address)) side (subscriber|network|both)

no attack-filter force-filter all

no attack-filter dont-filter all

Syntax Description

protocol TCP, UDP, ICMP, or Other

destination port (TCP and UDP protocols only): Defines whether specific IP detection is enabled or disabled for port-based (specific) or port-less (non-specific) detections.

attack direction: defines whether specific IP detection is enabled or disabled for single sided or dual sided attacks.

ip-address IP address from which traffic will not be filtered. For single-sided filtering, only one IP address is specified. For dual-sided filtering, both a source IP address and a destination IP address are specified

side subscriber, network, both

Defaults

This command has no default settings.

Command Modes

Linecard Interface Configuration

Usage Guidelines

After configuring the attack detectors, the SCE Platform automatically detects attacks and handles them according to the configuration. However, there are scenarios in which a manual intervention is desired, either for debug purposes, or because it is not trivial to reconfigure the SCE attack-detectors properly.

The user can use the CLI attack filtering commands to do the following:

Attack filtering can be prevented for a specified IP address/protocol by executing a dont-filter CLI command. If filtering is already in process, it will be stopped. When attack filtering has been stopped, it remains stopped until explicitly restored by another CLI command (either force-filter or no dont-filter).

Attack filtering can be forced for a specified IP address/protocol. If filtering is already in process, it will be stopped. Forced attack filtering will continue until undone by an explicit CLI command (either no force-filter or dont-filter).

Use the all keyword to restore or stop all filtering.

Authorization: admin

Examples

The following are examples of the attack-filter command:

Example 1:

The following example prevents attack filtering for the specified conditions.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-filter dont-filter protocol other attack-direction single-side-source ip 10.10.10.10 side both 
SCE(config if)#

Example 2:

The following example restores all attack filtering.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#no attack-filter dont-filter all
SCE(config if)#

Example 3:

The following example forces attack filtering.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-filter force-filter protocol TCP dest-port not-specific attack-direction dual-sided source-ip 10.10.10.10 destination-ip 20.20.20.20 side both 
SCE(config if)#

Example 4:

The following example stops all forced attack filtering.

SCE>enable 10 Password:<cisco> SCE#config SCE(config)#interface linecard 0 SCE(config if)#no attack-filter force-filter all SCE#

Related Commands

attack-filter

show interface linecard attack-filter

Specifies a port as subscriber notification port. TCP traffic from the subscriber side to this port will never be blocked by the attack filter, leaving it always available for subscriber notification.

Use the [no] form of this command to remove the port from the subscriber notification port list.

attack-filter subscriber-notification ports port

no attack-filter subscriber-notification ports port

Syntax Description

port Port number. One port can be specified as the subscriber notification port.

Defaults

This command has no default settings.

Command Modes

Linecard Interface Configuration

Usage Guidelines

Use this command to configure the port to be used for subscriber notification as configured using the attack-filter and attack-detector <number> commands.

Authorization: admin

Examples

The following example specifies port 100 as the subscriber notification port.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#attack-filter subscriber-notification ports 100
SCE(config if)#

Related Commands

attack-detector default

attack-detector <number>

show interface linecard attack-filter (subscriber-notification ports option)

Enables automatic fail-over on the Mng ports.

Use the no form of the command to disable automatic fail-over on the Mng ports.

auto-fail-over

no auto-fail-over

Syntax Description

This command has no arguments or keywords.

Defaults

By default, the auto fail-over mode is enabled.

Command Modes

Interface Management Configuration

Usage Guidelines

This parameter can be configured for either management port, and is applied to both ports with one command.

The automatic mode must be enabled to support management interface redundancy. This mode automatically switches to the backup management link when a failure is detected in the currently active management link.

When the automatic fail-over mode is disabled, by default Mng port 1 is the active port. If Mng port 2 will be the active port, it must be explicitly configured as such (see active-port)

Authorization: admin

Examples

This example shows how to disable the auto fail-over mode.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface Mng 0/1
SCE(config if)#no auto-fail-over
SCE(config if)#

Related Commands

active-port

Configures the GigabitEthernet interface auto-negotiation mode. Use this command to either enable or disable auto-negotiation. When set to no auto-negotiate, auto-negotiation is always disabled, regardless of the connection mode.

auto-negotiate

no auto-negotiate

default auto-negotiate

Syntax Description

This command has no arguments or keywords.

Defaults

By default, auto-negotiation is:

Command Modes

GigabitEthernet Interface Configuration

Usage Guidelines

Note that auto-negotiation does not work when the SCE platform is connected via an optical splitter (receive-only connection mode).

Authorization: admin

Examples

The following example configures GigabitEthernet line interface #1 (0/1) to perform no auto-negotiation.

SCE_GBE>enable 10
Password:<cisco>
SCE_GBE#config
SCE_GBE(config)#interface GigabitEthernet 0/1
SCE_GBE(config if)#no auto-negotiate
SCE_GBE(config if)#

Related Commands

show interface GigabitEthernet

Sets Ethernet shaping for the FastEthernet or GigabitEthernet line interfaces.

bandwidth bandwidth burst-size burstsize

Syntax Description

bandwidth Bandwidth measured in kbps.

burstsize Burst size in bytes.

Defaults

bandwidth = 100000K (100 Mbps) burst-size = 5000 (5K bytes)

Command Modes

FastEthernet Interface Configuration GigabitEthernet Interface Configuration

Usage Guidelines

This command is valid for a specified FastEthernet or GigabitEthernet line interface only. It must be executed explicitly for each interface.

Use the interface fastethernet or interface gigabitethernet command to access the configuration mode for the desired interface.

Authorization: admin

Examples

The following examples illustrate how to use this command.

Example 1

The following sets bandwidth and burst size for a Fast Ethernet line interface (0/1) of a SCE 2000 4/8xFE.

SCEconfig
SCE(config)#interface FastEthernet 0/1
SCE(config-if)#bandwidth 100000 burstsize 5000
SCE(config-if)#

Example 2

The following sets bandwidth and burst size for a Gigabit Ethernet line interface (0/2) of a SCE 2000 4xGBE or SCE 1000 2xGBE.

SCEconfig
SCE(config)#interface GigabitEthernet 0/2
SCE(config-if)#bandwidth 100000 burstsize 5000
SCE(config-if)#

Related Commands

interface fastethernet

interface gigabitethernet

queue

Blinks a slot LED for visual identification. Use the no form of this command to stop the slot blinking.

blink slot slot-number

no blink slot slot-number

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

Defaults

Not blinking

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example configures the SCE platform to stop blinking.

SCE>enable 10
Password:<cisco>
SCE#no blink slot 0
SCE#

Related Commands

show blink

Specifies a new package file to install. The SCE platform extracts the actual image file(s) from the specified package file only during the copy running-config startup-config command.

boot system ftp://username[:password]@server-address[:port]/path/source-file destination-file

no boot system

Syntax Description

ftp://…destination-file The ftp site and path of a package file that contains the new firmware. The filename should end with the .pkg extension.

Defaults

This command has no default settings.

Command Modes

Global Configuration

Usage Guidelines

Use this command to upgrade the SCE platform embedded firmware. The package file is verified for the system and checked that it is not corrupted. The actual upgrade takes place only after executing the copy running-config startup-config command and rebooting the SCE platform.

Authorization: admin

Examples

The following example upgrades the system.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#boot system ftp://vk:vk@10.1.1.230/downloads/SENum.pkg.pkg
Verifying package file…
Package file verified OK.
SCE(config)#do copy running-config startup-config
Backing –up configuration file…
Writing configuration file…
Extracting new system image…

Extracted OK.

Related Commands

copy running-config startup-config

Sets the system calendar. The calendar is a system clock that continues functioning even when the system shuts down.

calendar set hh:mm:ss day month year

Syntax Description

hh:mm:ss Current local time in hours in 24-hour format, minutes and seconds (HH:MM:SS).

day Current day (date) in the month.

month Current month (by three-letter abbreviated name).

year Current year using a 4-digit number.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Always coordinate between the calendar and clock by using the clock read-calendar command after setting the calendar.

Authorization: admin

Examples

The following example sets the calendar to 20 minutes past 10 AM, January 13, 2006, synchronizes the real-time clock to the calendar time, and displays the result.

SCE>enable 10
Password:<cisco>
SCE#calendar set 10:20:00 13 jan 2006
SCE#clock read-calendar
SCE#show calendar
10:20:03  UTC  THU  January  13  2006
SCE#show clock
10:20:05  UTC  THU  January  13  2006
SCE#

Related Commands

clock read-calendar

clock set

clock update-calendar

clock timezone

clock summertime

show calendar

show clock

Changes the path of the current working directory.

cd new-path

Syntax Description

new-path The path name of the new directory. This can be either a full path or a relative path.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

The new path should already have been created in the local flash file system.

Authorization: admin

Examples

The following example shows the current directory (root directory) and then changes the directory to the log directory located under the root directory.

SCE>enable 10
Password:<cisco>
SCE#pwd
tffs0
SCE#cd log
SCE#pwd
tffs0:log
SCE#

Related Commands

pwd

mkdir

Deletes all dynamic entries from the ARP cache.

The Address Resolution Protocol (ARP) is a TCP/IP protocol that converts IP addresses to physical addresses. Dynamic entries are automatically added to and deleted from the cache during normal use. Entries that are not reused age and expire within a short period of time. Entries that are reused have a longer cache life.

clear arp-cache

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears the ARP cache.

SCE>enable 10
Password:<cisco>
SCE#clear arp-cache
SCE#

Related Commands

Clears the linecard Interface counters.

clear interface linecard slot-number counters

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears the Line-Card 0 counters.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 counters
SCE#

Related Commands

show interface linecard counters

Clears the specified MPLS VPN counter:

clear interface linecard slot-number mpls vpn [bypassed-vpns][non-vpn-mappings]

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

bypassed-VPNs Displays all currently bypassed VPNs, grouped by downstream label

non-VPN-mappings Displays the mappings of upstream labels that belong to non-VPN flows

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears the MPLS VPN counter for non-VPN-mappings.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 mpls vpn non-vpn-mappings
SCE#

Related Commands

show interface linecard mpls

no mpls vpn pe-database

Clears all anonymous subscribers in the system.

clear interface linecard slot-number subscriber anonymous all

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears all anonymous subscribers.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 subscriber anonymous all
SCE#

Related Commands

no subscriber

no subscriber anonymous-group

show interface linecard subscriber anonymous

Clears the “total” and “maximum” subscribers database counters.

clear interface linecard slot-number subscriber db counters

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears all anonymous subscribers.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 subscriber db counters
SCE#

Related Commands

show interface linecard subscriber db counters

Clears the specified traffic counter.

clear interface linecard slot-number traffic-counter name [all]

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

name Name of the traffic counter to be cleared.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Use the all keyword to clear all traffic counters.

Authorization: admin

Examples

The following example clears the traffic counter name counter1.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 traffic-counter name counter1
SCE#

Related Commands

traffic-counter

show interface linecard traffic-counter

Clears the VAS health check counters.

Use the all keyword to clear counters for all VAS servers.

clear interface linecard slot-number vas-traffic-forwarding vas server-id number counters health-check

clear interface linecard slot-number vas-traffic-forwarding vas all counters health-check

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

number ID number of the specified VAS server clear the counters.

Defaults

This command has no default settings.

Command Modes

Privilege Exec

Usage Guidelines

Use the all keyword to clear counters for all VAS servers.

Authorization: admin

Examples

This example illustrates how to clear the health check counters for all VAS servers.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 vas-traffic-forwarding vas all counters health-check
SCE#

Related Commands

vas-traffic-forwarding vas server-id health-check

show interface linecard vas-traffic-forwarding (To display the VAS health check counters)

Removes all learned upstream labels of a specified VPN.

clear interface linecard slot-number vpn name vpn-name upstream-mpls all

Syntax Description

slot-number The number of the identified slot. Enter a value of 0.

vpn-name The name of the VPN for which to clear the learned upstream labels.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears all learned upstream labels for the specified VPN.

SCE>enable 10
Password:<cisco>
SCE#clear interface linecard 0 vpn name vpn1 upstream-mpls all
SCE#

Related Commands

Clears the counters for the specified SCMP peer device.

clear scmp name name counters

Syntax Description

name Name of the SCMP peer device.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears the counters for the SCMP peer device named device_1.

SCE>enable 10
Password:<cisco>
SCE#clear scmp name device_1 counters 
SCE#

Related Commands

show scmp

Clears SCE platform logger (user log files). This erases the information stored in the user log files.

When using the counters keyword, it clears the counters of the SCE platform logger (user log files). The counters keep track of the number of info, warning, error and fatal messages.

When using the nv-counters keyword, it clears the non-volatile counters for the entire log or only the specified SCE platform. These counters are not cleared during bootup, and must be cleared explicitly by using this command.

clear logger [device user-file-log|line-attack-file-log] [counters|nv-counters]

Syntax Description

device The device name to be cleared, either user-file-log or line-attack-file-log

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

The users log files have a size limit, with new entries overwriting the oldest entries. Therefore, there is no need to regularly clear the log files. Use this operation when you are certain that the information contained on the logs is irrelevant and might be confusing (For example, when re-installing the system at a new site, whose administrators should not be confused with old information).

Authorization: admin

Examples

The following examples illustrate the use of the clear logger command:

Example 1:

The following example clears the SCE platform user file logs:

SCE>enable 10
Password:<cisco>
SCE#clear logger device User-File-Log
Are you sure?Y
SCE#

Example 2:

The following example clears the SCE platform user log file counters.

SCE>enable 10
Password:<cisco>
SCE#clear logger device User-File-Log counters
Are you sure?Y
SCE#

Example 3:

The following example clears the user log file non-volatile counters.

SCE>enable 10
Password:<cisco>
SCE#clear logger device user-file-log nv-counters
Are you sure?Y
SCE#

Related Commands

show logger device

show log

Clears the counters for the number of notifications sent to the management agent.

clear management-agent notifications counters

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears the management agent notifications counters.

SCE>enable 10
Password:<cisco>
SCE#clear management-agent notifications counters
SCE#

Related Commands

Clears the RDR formatter counters and statistics.

clear rdr-formatter

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example clears the RDR-formatter counters.

SCE>enable 10
Password:<cisco>
SCE#clear rdr-formatter
SCE#

Related Commands

show rdr-formatter counters

Synchronizes clocks by setting the system clock from the calendar.

clock read-calendar

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example updates the system clock from the calendar.

SCE>enable 10
Password:<cisco>
SCE#clock read-calendar
SCE#

Related Commands

calendar set

clock update-calendar

show calendar

show clock

Manually sets the system clock.

clock set hh:mm:ss day month year

Syntax Description

hh:mm:ss Current local time in hours in 24-hour format, minutes and seconds (HH:MM:SS).

day Current day (date) in the month.

month Current month (by three-letter abbreviated name).

year Current year using a 4-digit number.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Always coordinate between the calendar and clock by using the clock update-calendar command after setting the clock.

Authorization: admin

Examples

The following example sets the clock to 20 minutes past 10 PM, January 13, 2006.

SCE>enable 10
Password:<cisco>
SCE#clock set 22:20:00 13 jan 2006
SCE#clock update-calendar
SCE#show clock
22:21:10  UTC  THU  January  13  2006
SCE#show calendar
22:21:18  UTC  THU  January  13  2006
SCE#

Related Commands

clock update-calendar

show calendar

show clock

Configures the SCE platform to automatically switch to daylight savings time on a specified date, and also to switch back to standard time. In addition, the three-letter time zone code can be configured to vary with daylight savings time if required. (For instance, in the eastern United States, standard time is designated EST, and daylight savings time is designated EDT).

Use the no form of this command to cancel the daylight savings time transitions configuration.

clock summertime

no clock summertime

The format of the command varies somewhat, depending on how the dates for the beginning and end of daylight savings time are determined for the particular location:

General guidelines for configuring daylight savings time transitions:

For the clock summer-time recurring command, the default values are the United States transition rules:

Syntax Description

zone The code for the time zone for daylight savings.

week1/week2 The week of the month on which daylight savings begins (week1) and ends (week2). A day of the week, such as Monday, must also be specified. The week/day of the week is defined for a recurring configuration only. Default: Not used

day1/day2 The day of the week on which daylight savings begins (day1) and ends (day2). For recurrent configuration: day is a day of the week, such as Sunday. Use the keywords first/last to specify the occurrence of a day of the week in a specified month: For example: last Sunday March. For non-recurrent configuration: day is a day in the month, such as 28. Default: day1 = second Sunday, day2 = first Sunday

month1/month2 The month in which daylight savings begins (month1) and ends (ends2). Default: month1 = March, month2 = November

year1/year2 The year in which daylight savings begins (month1) and ends (ends2). For non -recurring configuration only. Default = not used

time1/time2 The time of day (24-hour clock) at which daylight savings begins (time1) and ends (time2). Required for all configurations. Default: time1/time2 = 2:00

offset The difference in minutes between standard time and daylight savings time. Default = 60

Defaults

recurring, offset = 60 minutes

By default, the following recurrent time changes are configured:

Command Modes

Global Configuration

Usage Guidelines

Use the recurring keyword to enable subscriber notification.

Use the first/last keywords to specify the occurrence of a day of the week in a specified month: For example: last Sunday March.

Use a specific date including the year for a not recurring configuration. For example: March 29, 2004.

Use week/day of the week/month (no year) for a recurring configuration:

Authorization: admin

Examples

The following examples illustrate the use of the clock summertime command:

Example 1:

The following example shows how to configure recurring daylight savings time for a time zone designated "DST" as follows:

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#clock summer-time DST recurring last Sunday March 00:00 4 Saturday November 23:59
SCE(config)#

Example 2:

The following example shows how to configure non-recurring daylight savings time for a time zone designated "DST" as follows:

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#clock summer-time DST April 16 2005 00:00 October 23 2005 23:59
SCE(config)#

Example 3:

The following example shows how to cancel the daylight savings configuration.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#no clock summer-time
SCE(config)#

Related Commands

clock set

calendar set

show calendar

show clock

Sets the time zone. Use the no version of this command to remove current time zone setting. The purpose of setting the time zone is that the system can correctly interpret time stamps data coming from systems located in other time zones.

clock timezone zone hours [minutes]

no clock timezone

Syntax Description

zone The name of the time zone to be displayed.

hours The hours offset from GMT (UTC). This must be an integer in the range –23 to 23.

minutes The minutes offset from GMT (UTC). This must be an integer in the range of 0 to 59. Use this parameter to specify an additional offset in minutes when the offset is not measured in whole hours.

Defaults

GMT (hours = 0)

Command Modes

Global Configuration

Usage Guidelines

Authorization: admin

Examples

The following example sets the time zone to Pacific Standard Time with an offset of 10 hours behind GMT.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#clock timezone PST –10
SCE(config)#

Related Commands

calendar set

clock set

show calendar

show clock

Synchronizes clocks by setting the calendar from the system clock.

clock update-calendar

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example updates the calendar according to the clock.

SCE>enable 10
Password:<cisco>
SCE#clock update-calendar
SCE#

Related Commands

clock set

calendar set

clock read-calendar

show calendar

show clock

Enables the user to move from Privileged Exec Mode to Configuration Mode.

configure

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

After the user enters the configure command, the system prompt changes from <host-name># to <host-name>(config)#, indicating that the system is in Global Configuration Mode. To leave Global Configuration Mode and return to the Privileged Exec Mode prompt, type exit.

Authorization: admin

Examples

The following example enters the Global Configuration Mode.

SCE>enable 10
Password:<cisco>
SCE#configure
SCE(config)#

Related Commands

exit

Sets the connection mode parameters for an SCE 1000 platform.

connection-mode connection-mode on-failure on-failure

Syntax Description

connection-mode inline or receive-only setting. inline SCE platform is connected in a bump-in-the-wire topology. receive-only SCE platform is connected in an out-of-line topology using a splitter or switch.

On-failure determines system behavior on failure of the SCE platform. (inline topologies only) Bypass cutoff

Defaults

connection mode = inline

Command Modes

Linecard Interface Configuration

Usage Guidelines

Authorization: admin

Examples

The following example sets the connection-mode to inline and the on-failure mode to cutoff.

SCE1000>enable 10
Password:<cisco>
SCE1000#config
SCE1000(config)#interface linecard 0
SCE1000(config if)#connection-mode inline on-failure cutoff
SCE1000(config if)#

Related Commands

show interface linecard connection-mode

Sets the connection mode parameters for an SCE 2000 platform.

connection-mode connection-mode physically-connected-links physically-connected-links Priority Priority On-failure On-failure

Syntax Description

connection mode inline: single SCE platform inline receive-only: single SCE platform receive-only inline-cascade: two SCE platforms inline receive-only-cascade: two SCE platforms receive-only

physically-connected-links The number of the link connected to the SCE platform. (two SCE platform topology only) link 0 link 1

priority Defines which is the primary SCE platform.(two SCE platform topologies only). primary secondary

on-failure Determines system behavior on failure of the SCE platform. (inline topologies only) bypass cutoff

Defaults

connection mode = inline

physically-connected-links =link 0

priority = primary

on-failure = bypass

Command Modes

Linecard Interface Configuration

Usage Guidelines

Authorization: admin

Examples

The following example shows how to configure the primary SCE 2000 platform in a two-SCE platform inline topology. Link "0" is connected to this SCE platform, and the behavior of the SCE platform if a failure occurs is “bypass”.

SCE2000>enable 10
Password:<cisco>
SCE2000#config
SCE2000(config)#interface linecard 0
SCE2000(config if)#connection-mode inline-cascade physically-connected-links link-0 priority primary on-failure bypass
SCE2000(config if)#

Related Commands

show interface linecard connection-mode

show interface linecard physically-connected-links (SCE 2000 only)

Copies any file from a source directory to a destination directory on the local flash file system.

copy source-file destination-file

Syntax Description

source-file The name of the original file.

destination-file The name of the new destination file.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Both file names should be in 8.3 format, that is, there are a maximum of 8 characters before the period and three characters following it.

Authorization: admin

Examples

The following example copies the local analysis.sli file located in the root directory to the applications directory.

SCE>enable 10
Password:<cisco>
SCE#copy analysis.sli applications/analysis.sli
SCE#

Related Commands

copy ftp://

copy-passive

Downloads a file from a remote station to the local flash file system, using FTP.

copy ftp://username[:password]@server-address[:port]/path/source-file destination-file

Syntax Description

username The username known by the FTP server.

password The password of the given username.

server-address The dotted decimal IP address of the FTP server.

port Optional port number on the FTP server.

source-file The name of the source file located in the on the server.

destination-file The name of the file to be saved in the local flash file system. The file should be in 8.3 format, that is 8 digits, dot, then 3 digits.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Use the following syntax for remote upload/download using FTP:

ftp://username[:password]@server-address[:port]/path/file

You can configure keyword shortcuts for the copy command using the following commands:

Authorization: admin

Examples

The following example downloads the ftp.sli file from the host 10.1.1.105 with user name “vk” and password “vk”.

SCE>enable 10
Password:<cisco>
SCE#copy ftp://vk:vk@10.1.1.105/p:/applications/ftp.sli
SCE#

Related Commands

copy-passive

ip ftp password

ip ftp username

Uploads or downloads a file using passive FTP.

copy-passive source-file ftp://username[:password]@server-address[:port]/path/destination-file [overwrite]

Syntax Description

source-file The name of the source file located in the local flash file system.

username The username known by the FTP server.

password The password of the given username.

server-address The dotted decimal IP address.

port Optional port number on the FTP server.

destination-file The name of the file to be created in the FTP server.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Use the following format for remote upload/download using FTP: ftp://username[:password]@serveraddress[:port]/path/file

Use the overwrite keyword to permit the command to overwrite an existing file.

You can configure keyword shortcuts for the copy command using the following commands:

Authorization: admin

Examples

The following example performs the same operation as the previous copy ftp example using passive FTP.

SCE>enable 10
Password:<cisco>
SCE#copy-passive appl/analysis.sli ftp://myname:mypw@10.1.1.105/p:/applications/analysis.sli
SCE#

Related Commands

copy ftp://

ip ftp password

ip ftp username

Builds a configuration file with general configuration commands called config.txt, which is used in successive boots.

copy running-config startup-config

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

This command must be entered to save newly configured parameters, so that they will be effective after a reboot. You can view the running configuration before saving it using the more running-config command.

The old configuration file is automatically saved in the tffs0:system/prevconf directory.

Authorization: admin

Examples

The following example saves the current configuration for successive boots.

SCE>enable 10
Password:<cisco>
SCE#copy running-config startup-config
Backing-up configuration file...
Writing configuration file...
SCE#

Related Commands

more

show running-config

Uploads a file to a remote station, using FTP.

copy source-file ftp://username[:password]@server-address[:port]/path/destination-file

Syntax Description

source-file The name of the source file located in the local flash file system.

username The username known by the FTP server.

password The password of the given username.

server-address The dotted decimal IP address.

port Optional port number on the FTP server.

destination-file The name of the file to be created in the FTP server.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Use the following format for remote upload/download using FTP: ftp://username[:password]@serveraddress[:port]/path/file

You can configure keyword shortcuts for the copy command using the following commands:

Authorization: admin

Examples

The following example uploads the analysis.sli file located on the local flash file system to the host 10.1.1.105.

SCE>enable 10
Password:<cisco>
SCE#copy /appl/analysis.sli ftp://myname:mypw@10.1.1.105/p:/applications/analysis.sli
SCE#

Related Commands

copy ftp://

Copies the specified source file to the startup-config file.

Use this command to upload a backup configuration file created using the copy startup-config destination-file command.

This is useful in a cascaded solution for copying the configuration from one SCE platform to the other.

copy source-file startup-config

Syntax Description

source-file The name of the backup configuration file.

ftp://user:pass@host/drive:/dir/bckupcfg.txt

/tffs0

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

The source file name should be in 8.3 format, that is, there are a maximum of 8 characters before the period and three characters following it.

Authorization: admin

Examples

The following example shows how to upload a backup configuration file.

SCE>enable 10
Password:<cisco>
SCE#copy ftp://user:pass@host/drive:/dir/bakupcfg.txt startup-config
SCE#

Related Commands

copy startup-config destination-file

Copies the startup-config file to the specified destination file.

Use this command to create a backup configuration file.

This is useful in a cascaded solution for copying the configuration from one SCE platform to the other. The file created by this command can then be uploaded to the second SCE platform using the copy source-file startup-config command.

copy startup-config destination-file

Syntax Description

destination-file The name of the file to which the configuration is copied.

ftp://user:pass@host/drive:/dir/bckupcfg.txt

/tffs0

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

The destination file name should be in 8.3 format, that is, there are a maximum of 8 characters before the period and three characters following it.

Authorization: admin

Examples

The following example shows how to create a backup configuration file.

SCE>enable 10
Password:<cisco>
SCE#copy startup-config ftp://user:pass@host/drive:/dir/bckupcfg.txt
SCE#

Related Commands

copy source-file startup-config

Removes all user-defined subscriber templates from the system. The default template only remains.

default subscriber template all

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

LineCard Interface Configuration

Usage Guidelines

Authorization: admin

Examples

The following example removes all user-defined subscriber templates.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface LineCard 0
SCE(config if)# default subscriber template all
SCE(config if)#

Related Commands

subscriber template import csv-file

show interface LineCard subscriber templates

Deletes a file from the local flash file system.

Use the recursive switch to delete a complete directory and its contents. When used with the recursive switch, the filename argument specifies a directory rather than a file.

delete file-name [/recursive]

Syntax Description

file-name The name of the file or directory to be deleted.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following examples illustrate how to use this command:

Example 1:

The following example deletes the oldlog.txt file.

SCE>enable 10
Password:<cisco>
SCE#delete oldlog.txt
SCE#

Example 2:

The following example deletes the oldlogs directory.

SCE>enable 10
Password:<cisco>
SCE#delete oldlogs /recursive
3 files and 1 directories will be deleted.
Are you sure? y
3 files and 1 directories have been deleted.
SCE#

Related Commands

dir

rmdir

Displays the files in the current directory.

dir [applications] [-r]

Syntax Description

applications Filters the list of files to display only the application files in the current directory.

-r Includes all files in the subdirectories of the current directory as well as the files in the current directory.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following example displays the files in the current directory (root).

SCE>enable 10
Password:<cisco>
SCE#dir
File list for /tffs0/
512	TUE JAN 01 00:00:00 1980	LOGDBG   		DIR
512	TUE JAN 01 00:00:00 1980	LOG      		DIR
7653 	TUE JAN 01 00:00:00 1980	FTP.SLI
29 	TUE JAN 01 00:00:00 1980	SCRIPT.TXT
512 	TUE JAN 01 00:00:00 1980	SYSTEM    		DIR
SCE#

Related Commands

pwd

cd

Moves the user from a higher level of authorization to a lower user level, as illustrated in the following figure.

disable [level]

Syntax Description

level User authorization level (0, 5, 10, 15) as specified in CLI Authorization Levels.

Defaults

This command has no default settings.

Command Modes

Privileged Exec and Viewer

Usage Guidelines

Use this command with the level option to lower the user privilege level. If a level is not specified, it defaults to User mode.

Note that you must exit to the Privileged Exec command mode to use this command.

Authorization: user

Examples

The following example shows how to change from root to admin mode:

SCE>enable 15
Password:<cisco>
SCE#>disable 10
SCE#

Related Commands

enable

Use the 'do' command to execute an EXEC mode command (such as a show command) or a privileged EXEC command (such as show running-config) without exiting to the relevant command mode.

do command

Syntax Description

command command to be executed.

Defaults

This command has no default settings.

Command Modes

All configuration modes

Usage Guidelines

Use this command when in any configuration command mode (global configuration, linecard configuration, or any interface configuration) to execute a user exec or privileged exec command.

Enter the entire command with all parameters and keywords as you would if you were in the relevant command mode.

Authorization: admin

Examples

The following example assumes that the on-failure action of the SCE platform has been changed to 'bypass'. The connection mode configuration is then displayed to verify that the parameter was changed. The do command is used to avoid having to exit to the user exec mode.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#connection-mode on-failure bypass
SCE(config if)#do show interface linecard 0 connection-mode
Connection mode is inline
slot failure mode is bypass
Redundancy status is standalone
SCE(config if)#

Related Commands

Configures the duplex operation of a FastEthernet Interface (may be either line or management interface).

duplex mode

no duplex

Syntax Description

mode Set to the desired duplex mode: full: full duplex half: half duplex auto: auto-negotiation (do not force duplex on the link)

Defaults

mode = Auto

Command Modes

FastEthernet Interface Configuration

Mng Interface Configuration

Usage Guidelines

Use this command to configure the duplex mode of any Fast Ethernet interface. There are two types of Fast Ethernet interfaces:

If the speed (see speed) of the relevant interface is configured to auto, changing this configuration has no effect.

Authorization: admin

Examples

The following examples illustrate how to use this command.

Example 1

The following example configures line FastEthernet port #3 to half duplex mode.

SCE2000>enable 10
Password:<cisco>
SCE2000FE#config
SCE2000FE(config)#interface FastEthernet 0/3
SCE2000FE(config if)#duplex half
SCE2000FE(config if)#

Example 2

The following example configures management port #2 to auto mode.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface mng 0/2
SCE(config if)#duplex auto
SCE(config if)#

Related Commands

speed

interface fastethernet

interface mng

show interface mng

show interface fastethernet

Enables the user to access a higher authorization level, as illustrated in the following figure.

enable [level]

Syntax Description

level User authorization level (0, 5, 10, 15) as specified in CLI Authorization Levels.

Defaults

level = admin

Command Modes

User Exec

Usage Guidelines

If a level is not specified, the level defaults to admin authorization, level 10.

Note that you cannot use the enable command from the Privileged Exec or any of the configuration command modes.

Authorization: User

Examples

The following example accesses the administrator authorization level. Note that the prompt changes from SCE> to SCE#, indicating that the privilege is the administrator privilege level.

SCE>enable
Password:<cisco>
SCE#

Related Commands

disable

enable password

Configures a password for the specified authorization level, thus preventing unauthorized users from accessing the SCE platform.

Use the no form of the command to disable the password for the specified authorization level.

enable password [Level level] [encryption-type] password

no enable password [Level level]

Syntax Description

level User authorization level (0, 5, 10, 15) as specified in CLI Authorization Levels. If no level is specified, the default is Admin (10).

encryption-type If you want to enter the encrypted version of the password, set the encryption type to 5, to specify the algorithm used to encrypt the password.

password A regular or encrypted password set for the access level. If you specify encryption-type, you must supply an encrypted password.

Defaults

password = cisco

Command Modes

Global Configuration

Usage Guidelines

After the command is entered, any user executing the enable command must supply the specified password.

Authorization: admin

Examples

The following example sets a level 10 password as a123*man.

SCE>enable 10 Password:<cisco> SCE#config SCE(config)#enable password Level 10 a123*man SCE(config)#

Related Commands

enable

Removes all current configuration by removing all configuration files.

erase startup-config-all

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Usage Guidelines

The following data is deleted by this command:

After using this command, the SCE platform should be reloaded immediately to ensure that it returns to the 'factory default' state.

You can use the copy startup-config destination-file command to create a backup of the current configuration before it is deleted.

Authorization: admin

Example

The following example shows how to erase the startup configuration.

SCE>enable 10
Password:<cisco>
SCE#erase startup-config-all

Related Commands

reload

copy startup-config destination-file

Exits from the current mode to the next "lower" mode, as illustrated in the following figure.

exit

Syntax Description

This command has no arguments and keywords.

Defaults

This command has no default settings.

Command Modes

All

Usage Guidelines

Use this command each time you want to exit a mode. The system prompt changes to reflect the lower-level mode.

Authorization: admin

Examples

The following example exits from the Linecard Interface Configuration Mode to Global Configuration Mode and then to Privileged Exec and Viewer Modes.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#exit
SCE(config)#exit
SCE#

Related Commands

configure

interface fastethernet

interface gigabitethernet

interface linecard

interface mng

line vty

Specifies the operation mode to be applied after boot resulting from failure. When using the default switch, you do not have to specify the mode.

failure-recovery operation-mode mode

default failure-recovery operation-mode

Syntax Description

mode operational or non-operational. Indicates whether the system will boot as operational or not following a failure.

Defaults

mode = operational

Command Modes

Global Configuration

Usage Guidelines

Authorization: admin

Examples

The following example sets the system to boot as operational after a failure

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#failure-recovery operation-mode operational
SCE(config)#

Related Commands

show failure-recovery operation-mode

Forces a virtual failure condition, and exits from the failure condition, when performing an application upgrade.

force failure-condition

no force failure-condition

Syntax Description

This command has no arguments or keywords

Defaults

This command has no default settings.

Command Modes

Linecard Interface Configuration

Usage Guidelines

When upgrading the application in a cascaded system, use this command to force failure in the active SCE 2000 platform (see 'System Upgrades' in the Chapter "Redundancy and Fail-Over" in the Cisco Service Control Engine Software Configuration Guide).

Authorization: admin

Examples

The following example forces a virtual failure condition.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#interface linecard 0
SCE(config if)#force failure-condition
SCE(config if)#

Related Commands

pqi upgrade file

Displays information relating to all available CLI commands.

help bindings|tree

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Exec

Usage Guidelines

Use the bindings keyword to print a list of keyboard bindings (shortcut commands).

Use the tree keyword to display the entire tree of all available CLI commands.

Authorization: User

Examples

The following example shows the partial output of the help bindings command.

SCE>help bindings

Line Cursor Movements
---------------------
Ctrl-F /->	Moves cursor one character to the right.
Ctrl-B /<-	Moves cursor one character to the left.
Esc-F		Moves cursor one word to the right.
Esc-B		Moves cursor one word to the left.
Ctrl-A		Moves cursor to the start of the line.
Ctrl-E		Moves cursor to the end of the line.
Esc F 		Moves cursor forward one word.
Esc B		Moves cursor backward one word.

Editing
-------
Ctrl-D		Deletes the character where the cursor is located.
Esc-D		Deletes from the cursor position to the end of the word.
Backspace	Deletes the character before the current location of the cursor.
Ctrl-H 		Deletes the character before the current location of the cursor.
Ctrl-K		Deletes from the cursor position to the end of the line.
Ctrl-U		Deletes all characters from the cursor to the beginning of the line.
Ctrl-X		Deletes all characters from the cursor to the beginning of the line.
Ctrl-W		Deletes the word to the left of the cursor.
Ctrl-Y		Recall the last item deleted.

Help and Operation Features
----------------------------

? 		Argument help.
<Tab>		Toggles between possible endings for the typed prefix.
<Esc><Tab>	Displays all the possible arguments backwards.
Ctrl-I		<TAB>

SCE>

Related Commands

Enables the history feature, that is, a record of the last command lines that executed. Use the no form of this command to disable history.

history

no history

Syntax Description

This command has no arguments or keywords.

Defaults

History is enabled.

Command Modes

Privileged EXEC

Usage Guidelines

Authorization: admin

Examples

The following examples illustrate how to use this command.

Example 1

The following example enables the history feature.

SCE>enable 10
Password:<cisco>
SCE#history
SCE#

Example 2

The following example disables the history feature.

SCE>enable 10
Password:<cisco>
SCE#no history
SCE#

Related Commands

history size

Sets the number of command lines that the system records in the history.

history size size

no history size

Syntax Description

size The number of command lines stored in the history of commands for quick recall.

Defaults

size = 10 lines

Command Modes

Privileged EXEC

Usage Guidelines

The size of the history buffer can be any number from 0-50. Use the [no] form of this command to restore the default size.

Authorization: admin

Examples

The following example sets the history buffer size to 50 command lines.

SCE>enable 10
Password:<cisco>
SCE#history size 50
SCE#

Related Commands

history

Modifies the name of the SCE platform. The host name is part of the displayed prompt.

hostname host-name

Syntax Description

host-name The new host name. Maximum length is 20 characters.

Defaults

host-name = SCE

Command Modes

Global Configuration

Usage Guidelines

Authorization: admin

Examples

The following example changes the host name to MyHost.

SCE>enable 10
Password:<cisco>
SCE#config
SCE(config)#>hostname MyHost
MyHost(config)#>

Related Commands

show hostname

Enters FastEthernet Interface Configuration mode to configure a specified Fast Ethernet line interface. This command is supported by the SCE 2000 4/8xFE platform only.