Cisco Smart Switches Configuration Guide for DPU Security Mode, Release 10.6(x)

PDF

Cisco Smart Switches Configuration Guide for DPU Security Mode, Release 10.6(x)

Commands executed by netsecops-admin

Updated: August 23, 2026

Want to summarize with AI?

Log in

Outlines the commands available to the netsecops-admin role for accessing and managing DPUs on the switch, including connecting to DPUs, running diagnostic and operational commands, using the console interface, and accessing the Hypershield agent container for advanced management tasks.

The netsecops-admin is the only role that has access to the DPU. However, feature service acceleration must be enabled to ensure that the DPU is accessible. The netsecops-admin user can then access the DPU and execute the commands related to DPU. These commands enable advanced management and security operations on the DPUs of the switch.

Use any one of these commands on the supervisor to connect to the DPU and run the DPU commands to check and troubleshoot the DPU firmware version, NPU-DPU port status, state, and so on:

  • Use the attach dpu dpu-id command to attach the user session to one DPU at a time, enabling direct SSH access to the DPU. The netsecops-admin user can then execute commands on the DPU.

    Example

    Use case: The netsecops-admin user wants to verify the firmware version using the attach dpu command.

    switch# attach dpu 1
Attaching to dpu 1 ...
To exit type 'exit'...
dpu1# pdsctl show version
Firmware Version : 1.162.2
Pipeline : rudra
P4 Program : hs-dp-app
Build Time : Mon Aug 3 08:18:19 UTC 2026

dpu1# exit
Connection to dpu1 closed.
switch#

  • Run the slot slot-num dpu dpu-id internal-DPU-commands command. This command allows executing commands directly from the switch Command Line Interface (CLI) without the attach dpu dpu-id command. It allows targeting a specific DPU in a given slot for command execution or monitoring.

    Example

    Use case: The netsecops-admin user does not want to log into the DPU but needs to verify the DPU port state-machine directly, so the user uses the slot dpu command to execute the internal DPU command and also revert to the Supervisor (SUP).

    switch# slot 1 dpu 1 pdsctl show port fsm

Port ID: 00000111-0000-0000-4242-9ca9b8dd73e0
Timestamp State Duration (sec)
---------------------------------------------------------------
1970-01-01 00:00:10.23 ENABLED -
1970-01-01 00:00:10.124 AN_CFG 0.100659465
1970-01-01 00:00:10.124 SERDES_CFG 0.000001245
1970-01-01 00:00:10.174 WAIT_SERDES_RDY 0.050439400
1970-01-01 00:00:10.174 MAC_CFG 0.000172545
1970-01-01 00:00:10.174 WAIT_PHY_LINK_UP 0.000139070
1970-01-01 00:00:10.174 SIGNAL_DETECT 0.000002575
1970-01-01 00:00:10.174 DFE_TUNING 0.000189905
1970-01-01 00:00:10.174 DFE_START_ICAL 0.000001085
1970-01-01 00:00:10.174 DFE_WAIT_ICAL 0.000001865
1970-01-01 00:00:11.666 DFE_START_PCAL 1.491027795
1970-01-01 00:00:11.666 DFE_WAIT_PCAL 0.000007260
1970-01-01 00:00:11.666 CLEAR_MAC_REMOTE_FAULTS 0.000325270
1970-01-01 00:00:11.666 WAIT_MAC_SYNC 0.000012750
1970-01-01 00:00:11.666 WAIT_MAC_FAULTS_CLEAR 0.000015845
1970-01-01 00:00:11.666 UP 0.000007625


Port ID: 00000211-0000-0000-4242-9ca9b8dd73e0
Timestamp State Duration (sec)
-----------------------------------------------------------------
1970-01-01 00:00:10.23 ENABLED -
1970-01-01 00:00:10.225 AN_CFG 0.201410325
1970-01-01 00:00:10.225 SERDES_CFG 0.000001045
1970-01-01 00:00:10.285 WAIT_SERDES_RDY 0.060090520
1970-01-01 00:00:10.285 MAC_CFG 0.000162035
1970-01-01 00:00:10.285 WAIT_PHY_LINK_UP 0.000133370
1970-01-01 00:00:10.285 SIGNAL_DETECT 0.000001940
1970-01-01 00:00:10.285 DFE_TUNING 0.000176350
1970-01-01 00:00:10.285 DFE_START_ICAL 0.000000830
1970-01-01 00:00:10.285 DFE_WAIT_ICAL 0.000001545
1970-01-01 00:00:11.718 DFE_START_PCAL 1.433245790
1970-01-01 00:00:11.719 DFE_WAIT_PCAL 0.000006890
1970-01-01 00:00:11.719 CLEAR_MAC_REMOTE_FAULTS 0.000316325
1970-01-01 00:00:11.719 WAIT_MAC_SYNC 0.000011745
1970-01-01 00:00:11.719 WAIT_MAC_FAULTS_CLEAR 0.000013710
1970-01-01 00:00:11.719 UP 0.000007615

switch#

  • Use the attach console dpu dpu-id command to attach or connect to the console of a DPU within the switch. The console window opens and the netsecops-admin user can interact directly with the DPU’s command-line interface for management or troubleshooting purposes.

    Note

    To navigate or close the console, see the instructions on the banner at the bottom of the console. For example, to return to NX-OS, press Ctrl-A, release, then Z, X, and Enter. For more information, refer to the Cisco Hypershield User Documentation and Cisco Hypershield Reference Documentation.

    Example

    Use case: The netsecops-admin user wants to verify the DPU port status using the console.

    switch# attach console dpu 1

Welcome to minicom 2.9

OPTIONS: I18n 
Compiled on Sep 22 2023, 21:10:41.
Port /dev/dpu00, 00:31:44

Press CTRL-A Z for help on special keys


dpu1# pdsctl show port status
MAC-Info: MAC ID/MAC Channel/Num lanes
FEC-Type: FC - FireCode, RS - ReedSolomon
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ID Name IfIndex Speed MAC-Info FEC AutoNeg MTU Pause Pause Debounce State Transceiver NumLinkDown LinkSM Loopback 
Cfg/Oper Cfg/Oper Type Tx/Rx (msecs) Admin/Oper 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
00000111-0000-0000-4242-9ca9b8dd73e0 Eth1/1 0x11010000 200G 0/0/4 RS/RS F/F 9440 NONE F/F 0 UP/UP REMOVED 0 UP NONE 
00000211-0000-0000-4242-9ca9b8dd73e0 Eth1/2 0x11020000 200G 0/4/4 RS/RS F/F 9440 NONE F/F 0 UP/UP REMOVED 0 UP NONE 

No. of ports : 2

dpu1#

  • Use the service system hypershield connect session [command] to open an interactive shell session inside the Hypershield agent container running on the switch.

    • If a command is specified, the command is executed non-interactively inside the container and returns the output to the terminal.

      Example- interactive session

      switch# service system hypershield connect session 
HypershieldAgent:/usr/src/app#

    • If a command is not specified, it opens an interactive shell session within the Hypershield agent container.

      Example – non-interactive session

      switch# service system hypershield connect session /usr/src/app/agwctl -v
agwctl version v1.19.0-pre.8-547-gb57fe1ed