The Status LED provides a visual indicator of the available services. The following tables list the status LED colors and their meanings.

The antenna connector is a QMA, panel-mounted, 50-ohm connector for connecting the antenna to the WPAN module.

Enhanced Beacon (EB) messages allow communication modules to discover PANs that they can join. RMEs also use EB messages that disseminate useful PAN information to devices that are in the process of joining the PAN. Joining nodes are nodes that have not yet been granted access to the PAN. As such, joining nodes cannot communicate IPv6 datagrams with neighboring devices. The EB message is the only message sent in the clear that can provide useful information to joining nodes. CGRs drive the dissemination process for all PAN-wide information.

The following information is sent in the EB frame:

• SSID, which is used as a filter so new devices can avoid joining foreign networks.

• GTK info: Include GTK ID and a SHA256 key hash. Mesh nodes use it during the join process to check if it has the GTK or not. This IE is also used when the GTK is renewed by the FAR. Each node can store up to four keys per PAN and keys for up to two different PANs.

• Network Info.

• PAN size: number of RPL nodes. Value only updated by the FAR/RPL root.

• Path cost to the root: RPL Rank.

• Unicast/listening Schedule: Used to implement the channel-hopping algorithm.

Joining devices also use the RSSI value of the received EB message to determine if a neighbor is likely to provide a good link. The transceiver hardware provides the RSSI value. Neighbors that have an RSSI value below the minimum threshold during the course of receiving EB messages, are not considered for PAN access requests.

RMEs support the enhanced frame formats, specified by IEEE 802.15.4e-2012 and IEEE 802-15.4g-2012, that allow link frames to carry the following information:

• Frequency hopping synchronization

• Security capabilities in EB frames

• Received Signal Strength Indication (RSSI) information in acknowledgments for bi-directional link quality estimation

In addition, RMEs use secure, enhanced acknowledgment frames which are the same security mechanisms used to secure data frames.

In CR-Mesh Release 6.4, the frame beacon is updated for Wi-SUN 1.x:

• Header-IE, IEs:

  Wi-SUN FAN defines its own Information Elements (IEs) to support certain operations. Depending on where the MAC management information is encapsulated, IEs defined in Wi-SUN can be divided into two categories: Wi-SUN header IEs, and Wi-SUN payload IEs. A payload IE can be longer than a header IE, and can be encrypted as a part of the payload.

• Flow Control: unicast Extended Directed Frame Exchange (EDFE)

RMEs implement link-layer access control mechanisms that follow the functionality defined by the IEEE 802.1X standard for node authentication.

• Admitting nodes —The access control mechanism follows the concepts established by 802.1X for mutual authentication and 802.11i for group key management. RMEs use certificate-based EAP-TLS to perform mutual authentication with an AAA server. RMEs implement the supplicant, and the CGR implements the authenticator. RMEs use a stateless EAP proxy that forwards EAP messages between the CGR and a joining interface because the joining interface might be multiple mesh hops away from the CGR. CGRs communicate with a standard AAA server using the RADIUS protocol.

• Evicting nodes —To evict nodes from a network, the CGR must communicate a new Group Temporal Key (GTK) to all nodes in the PAN except those being evicted. The new GTK has a valid lifetime that begins immediately. After the new GTK is distributed to all allowed nodes, the CGR invalidates the old GTK. After the old GTK is invalidated, those nodes that did not receive the new GTK can no longer participate in the network and are considered evicted.

• Security mode —All data-and-acknowledgment traffic are protected using the IEEE 802.15.4 Counter with CBC-MAC (CCM) security mode.

• AES-128 keys —All nodes in a PAN share the same AES-128 keys for use with CCM.

• Device authentication —EAP-TLS, where the CGR serves as the authenticator and communicates with a standard AAA server using RADIUS.

• Handshake protocol —A handshake protocol similar to 802.11i is used to establish a Pairwise Temporal Key (PTK) between a device and a CGR. The PTK is used to securely distribute the GTK. The same handshake messages might be used to refresh the GTK.

Because communication modules might not be within direct communication range of a CGR, RMEs also implement an EAP proxy service so that communication modules can proxy messages between a joining device and the CGR.

The 6LoWPAN adaptation layer adapts IPv6 to operate efficiently over low-power and lossy links such as defined by IEEE 802.15.4 (low-rate WPAN (LR-WPANs)). The adaptation layer sits between the IPv6 and IEEE 802.15.4 layers and provides IPv6 header compression, IPv6 datagram fragmentation, and optimized IPv6 Neighbor Discovery.

The 6LoWPAN adaptation feature uses packet-header filtering for packet transmission when transporting IPv6 datagrams within IEEE 802.15.4e frames.

RMEs implement the 6LoWPAN header compression format: >RFC 6282 on Compression Format for IPv6 Datagrams over IEEE 802.15.4-Based Networks . For each IPv6 datagram submitted to the mesh interface for transmission, an RME attempts to compress the IPv6 header to the smallest encoding supported by the header compression mechanism.

Note	Initial 6LoWPAN RFC 4944 also includes an IPv6 header compression scheme that is now deprecated and replaced by RFC 6282 6LoWPAN header compression. The Cisco CGR implementation for 6LoWPAN header compression implements only RFC 6282.

For more information on RFC 6282, see http://datatracker.ietf.org/doc/rfc6282/ .

The Cisco 6LoWPAN implementation supports a 1576-byte MTU for Wi-SUN implementation in Cisco Resilient Mesh Release 6.3.

The unicast schedule supports unicast communication used for communicating MAC commands and IPv6 unicast datagrams.

Each node maintains its own channel-hopping schedule for receiving unicast messages. A unicast schedule is defined by the following parameters:

• Channel Sequence —A list of channels indexed by a 16-bit integer that a mesh interface follows when listening for unicast transmissions.

• Slot Duration —The equal-sized time slots of the unicast schedule. A node listens to a single channel for the entire duration of a slot before switching to the next channel in the unicast schedule for listening.

The Layer-2 broadcast schedule supports broadcast communication used for communicating Layer-3 IPv6 multicast datagrams. The broadcast schedule is established on a CGR and disseminated to all nodes in the PAN using a Trickle-based dissemination protocol. All nodes in the PAN synchronize to only one broadcast schedule. There is no coordination of broadcast schedules between PANs.

The following parameters define the broadcast schedule:

• Channel Sequence —Lists channels indexed by a 16-bit integer the mesh interface follows when listening for broadcast transmissions.

• Slot Duration —Specifies equal-sized time-slots for the broadcast schedule.

• Broadcast Listen Window —Specifies how long a node listens for broadcast messages within a broadcast slot. Broadcast packets must start their transmission within the Broadcast Listen Window to ensure that all neighboring nodes are listening for the broadcast transmission. The Broadcast Listen Window must specify a time that is no greater than the Slot Duration. At the beginning of each broadcast slot, the node switches to the next channel in the broadcast schedule to listen for broadcast transmissions. At the end of the Broadcast Listen Window, the node returns to listening for unicast transmissions until the start of the next broadcast slot. The unicast schedule is free running and the timing remains unaffected by the broadcast schedule. In other words, the broadcast schedule is overlaid on a node unicast schedule.

Cisco Resilient Mesh implements the following protocols to support IPv6:

• RFC 2460: Internet Protocol version 6

• RFC 4291: IP Version 6 Addressing Architecture

• RFC 6724: Default Address Selection for Internet Protocol Version 6 (IPv6)

• RFC 4861: Neighbor Discovery for IPv6

• RFC 4443: ICMP for the Internet Protocol Version 6 (IPv6)

• RFC 3315: Dynamic Host Configuration Protocol for IPv6

RMEs implement a DHCPv6 client for IPv6 address autoconfiguration. RMEs also support arbitrary DHCPv6 options (that is, vendor option 17) to allow additional stateless configuration information to be included in DHCPv6 replies from the server. Cisco Resilient Mesh uses the DHCPv6 Rapid Commit option to reduce the traffic to only Solicit and Reply messages, so the DHCPv6 server must support this option.

RMEs implement a DHCPv6 client, while the CGR implements a DHCPv6 Relay Agent. A joining node might not be within range of a CGR and must use a neighboring communication module to make DHCPv6 requests.

On a RME, no DHCPv6 server address needs to be configured. The DHCPv6 client requests are sent to the DHCPv6 Relay Agent on the CGR. The DHCPv6 Relay Agent forwards the DHCPv6 client messages to the DHCPv6 server.

RMEs perform routing at the network layer using the Routing Protocol for Low-Power and Lossy Networks (RPL):

• RFC 6550 RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) (to establish routes for delivering unicast IPv6 datagrams to their destinations).

• RFC 6551: Routing Metrics Used for Path Calculation in Low-Power and Lossy Networks

• RFC 6553: The Routing Protocol for Low-Power and Lossy Networks (RPL) Option for Carrying RPL Information in Data-Plane Datagrams

• RFC 6554: An IPv6 Routing Header for Source Routes with the Routing Protocol for Low-Power and Lossy Networks (RPL)

• RFC 6206: The Trickle Algorithm

• RFC 6719: The Minimum Rank with Hysteresis Objective Function

RPL does the following:

• Offers a number of advanced features, such as trickle timers limiting the chattiness of the control plane, dynamic link (hop count, throughput, latency, link/path reliability (ETX), link colors), and node routing metrics (node state/attribute, node power levels) for constraint-based routing useful for combined AMI (Advanced Metering Infrastructure) and DA (Distributed Automation) deployments.

• Supports multi-topology routing with the support of multiple Directed Acyclic Graphs (DAGs) where each DAG is optimized against different constraints and metrics dictated by the objective function.

• Reduces the probability of loops occurring as well as detects these loops by employing data path validation, and then breaking the loops using local poisoning.

• CGR and RME implementations support a non-storing mode for RPL.

• Supports both local repair (faster and sub-optimal) and global re-optimization.

• RPL constructs the routing tree of the meters.

Each node builds and maintains up to three Destination-Oriented Directed Acyclic Graphs (DODAG) parents that provide a path to the Root CGR.

RMEs implement a non-storing mode because the expected traffic flow for AMI applications primarily flows through the CGR. Implementing non-storing mode helps save memory on RMEs by only storing the DODAG parents and the neighbors on the sub-DAG. In non-storing mode, each node maintains their DODAG parents and uses them as default routes. The routing graph, created by the set of DODAG parents across all nodes, defines the set of upward routes—each node reports their DODAG parents to the CGR so that the router can generate source routes when delivering datagrams across the PAN. Likewise, nodes establish downward routes by advertising their parent set towards the DODAG Root. Because RMEs implement the non-storing mode of RPL, nodes report their parent sets directly to the Root; and, the Root must store the information. The Root uses this information when determining source routes needed for delivering datagrams to individual nodes within the mesh.

RMEs configure the RPL protocol to ensure routes are loop-free by disallowing nodes from selecting DODAG parents that are positioned further away from the CGR.

CG WPAN module for Cisco Resilient Mesh supports route redistribution of external RPL routes in Cisco Resilient Mesh networks for application modules and MAP-T addresses in DA networks. (See Configuring Redistribution of RPL in Other Routing Protocols).

RMEs implement a route-over architecture where forwarding occurs at the network layer. RMEs examine every IPv6 datagram that they receive and determine the next-hop destination based on information contained in the IPv6 header. RMEs do not use any information from the link-layer header to perform next-hop determination.

RMEs implement the options for carrying RPL information in Data-Plane datagrams ( RFC 6553 ) and Type 4 routing header as specified for RPL in RFC 6554 . The routing header allows a node to specify each hop that a datagram must follow to reach its destination.

The RME communication stack offers four priority queues for QoS and supports differentiated classes of service when forwarding IPv6 datagrams to manage interactions between different application traffic flows as well as control-plane traffic. RMEs implement a strict-priority queuing policy, where higher-priority traffic always takes priority over lower-priority traffic.

The traffic on RMEs is marked by the vendor implementation (configuration functionality is not available). If required, traffic can be remarked on the CGR.

RMEs deliver IPv6 multicast messages that have an IPv6 destination address scope larger than link-local when using a Layer-2 broadcast. When RMEs receive a global-scope IPv6 multicast message, the node delivers the message to higher layers if the node is subscribed to the multicast address. RMEs then forward the message to other nodes by transmitting the same IPv6 multicast message over the mesh interface. RMEs use an IPv6 Hop-by-Hop option containing a sequence number to ensure that a message is not received and forwarded more than once.

Group multicast can be used to control a specific group of devices by multicast. The devices in one group can cross multiple PANs. This feature is supported on CGEREF2/CGEREF2PLUS/CGEREF3 from Cisco Resilient Mesh Release 6.2.

Note	This feature only works when MPL is enabled.

In the following figure, headend services are composed of the third-party application server and FND. Headend router are used for managing and communicating with all nodes in multiple PANs. In an application data collection system, there are multiple groups crossing multiple CGRs to collect different data in the field. The nodes in a group intersperse in multiple PANs.

The group multicast configuration is supported on FND or application server. FND manages the group multicast addresses table based on customer’s configuration, while the application server managers the group multicast addresses.

Note	In Release 6.2, FND doesn't support the group configuration. You need to invoke API to config the group.

The overall process of FND management can be divided into the following stages:

• Stage 1: Subscribing IPv6 multicast group address from FND.

  After a node joins in the network, it will send the register message to FND shown in above picture. If FND has the preconfigured multicast group table, it will push the multicast group addresses to the node.

• Stage 2: Managing IPv6 multicast group address on node.

  FND posts node’s IPv6 multicast group addresses (maximum is 4) with TLV MulticastGroupSettings to the node. FND can add or delete the multicast group addresses by TLV MulticastGroupSettings.

• Stage 3: Notifying node’s IPv6 multicast group address to FND.

  After a node receive the multicast group addresses, it will send the confirmation message to FND. Then the node can register it into FND. At the same time, node will periodically send its group multicast address into FND.

• Stage 4: Subscribing all IPv6 multicast group addresses in a PAN on CGR.

  Nodes send DAO message directly to CGR. The multicast group information with multicast group addresses and MPL domain will be inserted into one DAO option. CGR will add the multicast group entry for WPAN interface, so that CGR can forward multicast data message from application server to nodes.

• Stage 5: Sending multicast message from application server to nodes.

  When application server sends a multicast message to nodes, if MPL is enabled on CGR, CGR inserts the MPL domain address (for example, FF03::FC) into original multicast message as shown in the following figure. Then CGR forwards the MPL message to WPAN interface. If node joins in the destination group address, it will receive the message and handle in the upper layer of nodes. If node does not join in the destination group address, it will forward this MPL message because all nodes join in the same MPL domain.

  

The overall process of application server management can be divided into the following stages:

• Stage 1: Optionally subscribing IPv6 multicast group address from application server.

  After a node joins in the network, the application layer of node can subscribe the multicast group addresses from application server shown in above figure.

• Stage 2: Managing IPv6 multicast group address on node.

  Application server pushes node’s IPv6 multicast group addresses (maximum is 4) to nodes. At the same time, nodes can also call SDK APIs (if_addmaddr, if_delmaddr, if_getmaddrs) to add/delete/get multicast group addresses.

• Stage 3: Optionally notifying node’s IPv6 multicast group address to application server.

  After a node receives the multicast address from application server, it sends the confirmation to the application server.

• Stage 4: Subscribing all IPv6 multicast group addresses in a PAN on CGR.

  Nodes send DAO message directly to CGR. The multicast group information with multicast group addressees and MPL domain will be inserted into one DAO option. CGR will add the multicast group entry for WPAN interface, so that CGR can forward multicast data message from application server to nodes.

• Stage 5: sending multicast message from application server to nodes.

  This stage is the same as the stage 5 of process with FND management.

For more information about configuring group multicast, see .

The following parameters are available from the RMEs through CSMP on IoT FND:

• Identification

• UTC time in seconds

• IEEE 802.15.4 link

• 6LoWPAN link

• Network interface (for both serial and mesh interface)

• RPL

• QoS

• MAPT

• Wi-SUN settings

• Cisco Resilient Mesh firmware

Network Access Control for CR-Mesh node consists of the following process:

• 802.1x Authentication Between CR-Mesh Node and AAA Server

• 802.11i Key Exchange with the Border Router

The following figure shows the CR-Mesh authentication overview:

A compromised node is one where the device can no longer be trusted by the network and/or operators. Nodes within an IEEE 802.15.4 PAN must possess the currently valid Group Temporal Key (GTK) to send and receive link-layer messages. The GTK is shared among all devices within the PAN and is refreshed periodically or on-demand. By only communicating new GTKs to trusted devices, compromised nodes might be evicted from the network.

Authentication for Cisco Resilient Mesh security behaves differently between a warm-boot versus a cold-boot:

• A warm boot is when the meter has a working key, in which case authentication has already been established and the meter joins the mesh quickly.

• A cold boot is when the meter has not yet been authenticated because it is the first time the meter has been authenticated or the meter key has expired.

You must enable the dot1x (802.1X), mesh-security, and DHCPv6 features to configure the WPAN interface.

To enable these features, use the following command:

dot1x system-auth-control

For dot1x, the WPAN interface configuration requires:

dot1x pae authenticator

See Sample Router Configuration.

See show dot1x all details.

For configuring mesh security, see Configuring Cisco Resilient Mesh Security.

For DHCPv6, you will also need in your WPAN running configuration:

ipv6 dhcp relay destination <IPv6 address >

See Sample Router Configuration.

In Cisco IOS on the CGR, various WPAN radio related commands are under the ieee154 parameter:

Router(config-if)#ieee154 ?
  beacon-async  IEEE154 async beacon parameters
  channel       Channel (for hw testing use only. 254 is channel hopping)
  dwell         Channel dwell configuration for regional compliance
  notch         Channel notch configuration for regional compliance
  panid         PAN ID
  ssid          SSID
  txpower       Transmission power configuration (hardware dependent)

To configure the name of your IEEE 802.15.4 Personal Area Network Identifier (PAN ID), use the following WPAN command:

Router(config-if)# ieee154 panid ?
  <0-65535>  Enter a value between 0 and 65535
Router (config-if)# ieee154 panid 2121

For sample configuration, see show wpan config.

The Service Set Identifier (SSID) identifies the owner of the RME. The SSID is set on a RME in manufacturing, and that same SSID must also be configured on the CGR WPAN interface.

To configure the name of the SSID, use the ssid command ieee154 ssid <ssid_name >, for example:

Router(config)# interface wpan 3/1
Router(config-if)# ieee154 ssid ?
  WORD  ssid string (Max size 32)
Router(config-if)# ieee154 ssid myWPANssid 

For sample configuration, see show wpan config.

Note	Transmit power must match the local regulation and be aligned with the Cisco Resilient Mesh value, which can be monitored through IoT FND.

The actual maximum possible power emitted by the radio antenna is approximately 28 to 30 dbm. However, this is not directly, nor linearly, mapped to the txpower designation in the configuration. The txpower in the configuration specifies the txpower setting in the physical hardware (chip). However, the radio signal out of the hardware chip must travel through the amplifier, front end, antenna, etc., which causes the output power of the chip to be less than the actual electro-magnetic signal that is emitted into the air.

Values range from 2 (high) to the default value of -34 dBm (low) as shown in the following table:

Note	This table is used for FSK WPAN module. For OFDM WPAN module, the txpower range is different based on different PHY modes.

The range provided in txpower configuration is an integer range, which is a superset of all the configurable values available.

Router(config-if)# ieee154 txpower ?
  <-65 - 64>  Enter a value between -65 and 64
*Default value is -34

To configure the transmit power for outdoor usage, specify a higher transmit power, such as:

Router (config-if)# ieee154 txpower 30

For sample configuration, see show wpan config.

A notch is a list of disabled channels from the 902-to-928 MHz range. If there is no notch at all, then all channels are enabled. if there is a notch [x, y], then channels between x and y are disabled.

Notch configuration must comply with your regional regulations (for example, a notch configuration is not required for U.S.). Notch configuration must match between the WPAN interface of the CGR and the RME.

For sample configuration, see show wpan config.

Note	A channel list is a list of enabled channels.

You can view the notch by using the following command:

Router(config-if)# ieee154 notch ?
  <0-63>  channel id
Router (config-if)# ieee154 notch 10-15, 30-35
Router (config-if)# end
Router# config in-hardware notch
notch: [10, 15]
notch: [30, 35]
Router# show wpan slot/port hardware channel-list
channellist: 0 1 2 3 4 5 6 7 8 9 16 17 18 19 20 21 22 23 24 25 26 27 28 29 36 37 38 39 40
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63

The following table provides the mapping of FSK Phy Mode ID between Release 6.4 and Release 6.2/6.3:

The following table provides the mapping of OFDM Phy Mode ID between Release 6.4 and Release 6.2/6.3:

To set the minimum time between RPL version increments, use the version-incr-time command:

Router(config-if)# rpl version-incr-time ?
  <10-600>  Enter a value between 10 and 600
Router (config-if)# rpl version-incr-time 15

For sample configuration, see show wpan config.

To set the Destination-Oriented Directed Acyclic Graph (DODAG) lifetime duration, use the dag lifetime command. Each node uses the lifetime duration parameter to drive its own operation (such as Destination Advertisement Object (DAO) transmission interval). Also, the CGR uses this lifetime value as the timeout duration for each RPL routing entry.

Router(config-if)# rpl dag-lifetime ?
  <60-255>  Enter a value between 60 and 255
Router(config-if)# rpl dag-lifetime 120

For sample configuration, see show wpan config.

To configure the DODAG Information Object (DIO) parameter per the RPL IETF specification, use the rpl dio-min command.

Caution

This command must only be used by an expert RPL protocol administrator.

Router(config-if)# rpl dio-MIN ?
  <14-24>  Enter a value between 14 and 24
Router(config-if)# rpl dio-MIN 21

For a sample configuration, see show wpan config.

To set the DIO double parameter as per the RPL IETF specification, use the dio-dbl command. DIO double is a doubling factor parameter used by the RPL protocol.

Caution

This command must only be used by an expert RPL protocol administrator.

Router(config-if)# rpl dio-dbl ?
  <0-10>  Enter a value between 0 and 10
Router(config-if)# rpl dio-dbl 5

For sample configuration, see Sample Router Configuration.

RPL metric container (dag_size, etx, and hop_count) provides more information of the topology. CR-Mesh 6.4 includes more RPL metrics in the DAO upstream message to help FND showcase more meaningful information and display the data on the google map as well as the device page.

The following commands on CGR configure whether BR’s DIO carries DAG Metric Container option and the private flag of DODAG configuration option.

• rpl option metric-container—Include metric option in DIO message in Wi-SUN mode core instance. no rpl option metric-container is used to disable this configuration.

• rpl option dodag-config cisco-flag <0-1>—Set Cisco flag to a value between 0 and 1 in DODAG configuration option in Wi-SUN mode core instance.

To configure the IPv6 DHCP relay, use the ipv6 dhcp relay command:

Router (config-if)#ipv6 dhcp relay destination 

The IPv6 address of the DHCP server displays as:

!
interface Wpan3/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7220
 ieee154 ssid myWPANssid
 rpl dio-dbl 5
 rpl dio-min 21
 rpl route-poisoning
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2091:1:1:1::/64
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
end
!

See Sample Router Configuration.

CGR allows redistribution of the RPL routes including the WPAN prefix as well as the external RPL routes such as MAP-T addresses assigned to DA gateways or prefixes assigned to Application Modules.

Before redistributing RPL in OSPFv3, you must configure OSPFv3 on the uplink tunnel interface:

Router (config-if)# router ospfv3 process_id 
Router (config-if)# ipv6 ospf process_id area area_id 

To redistribute RPL in OSPFv3, use the following route-map and router OSPFv3 commands:

<!--snip--!>
!
interface Loopback0
 ip address 20.211.0.11 255.255.255.255
 ipv6 address 2001:420:7BF:7E8::B/128
 ipv6 enable
 ipv6 ospf 1 area 1
!
interface Tunnel0
 description IPsec tunnel to SOL-ASR-7
 ip unnumbered Loopback0
 ip pim sparse-mode
 ipv6 unnumbered Loopback0
 ipv6 enable
 ipv6 mld join-group FF38:40:2006:DEAD:BEEF:CAFE:0:1
 ipv6 ospf 1 area 1
 ipv6 ospf mtu-ignore
 tunnel source Dialer1
 tunnel destination dynamic
 tunnel protection ipsec profile FlexVPN_IPsec_Profile
!
<!--snip--!>
!
router ospfv3 1
 !
 address-family ipv6 unicast
  redistribute connected route-map WPAN
  router-id 2.0.0.7
 exit-address-family
<!--snip--!>
!
!
route-map WPAN permit 10
 match interface Wpan5/1
!
<!--snip--!>
CGR-JAF1626AQED#show ipv6 ospf neighbor 
            OSPFv3 Router with ID (2.0.0.7) (Process ID 1)
Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
20.0.0.3          0   FULL/  -        00:00:30    27              Tunnel0
CGR-JAF1626AQED#

Router (config-if)# mesh-security ?
  delete  Delete the session(s)
  expire  Force Expire
  set     Set parameters

To set the mesh key, use the mesh-security set mesh-key command in privileged mode:

Router# mesh-security set mesh-key interface wpan <slot>/<port> key ?
  Hex-string  Key - even number (max. 32) of hex digits 
Router# mesh-security set mesh-key interface wpan 3/1 key 1234567891234567 < --# Your secret key.

To configure the mesh key lifetime, use the mesh-security mesh-key command in interface configuration mode:

Note	Only call this command if you are an expert mesh-security administrator.

Note	The Mesh-key lifetime value should be less than 120 days (10368000 seconds).

Router(config-if)# mesh-security ?
  authentication-timeout     Set authentication timeout
  keystore-update-period     Set keystore update period
  max-active-authentication  Set number of parallel authentications
  max-active-key-exchange    Set number of parallel key exchanges
  mesh-key                   Mesh key

Router(config-if)# mesh-security mesh-key lifetime ?
  <60-2592000>  Key lifetime (in seconds)
 
Router (config-if)# mesh-security mesh-key lifetime 60

Note	Mesh-Security config and keys do not appear in the CGR configuration as shown by show running-config or show startup-config .

The following example shows what is required for mesh-security:

!
aaa new-model
!
!
aaa group server radius nps-group
 server name nps-radius
!
aaa authentication enable default none
aaa authentication dot1x default group nps-group
<...snip...>
dot1x system-auth-control
!
<...snip...>
!
!
interface Wpan4/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7224
 ieee154 ssid migration_far2
 ieee154 txpower -30
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2092:1:1:1::/64
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
mesh-security mesh-key lifetime 259200
end
!
!
radius server nps-radius
 address ipv4 <IP address> auth-port 1645 acct-port 1646
 key <RADIUS key>
!

Note	The MTU setting on the AAA server must be set to 800 bytes or lower, because IEEE802.1x implementation in RMEs limits the MTU to 800 bytes. RADIUS servers can use auth-port 1812 and acct-port 1813 instead of 1645 and 1646, respectively.

Note

In CR-mesh Release 6.1, mesh device supports radius server on TLS 1.2. On TLS 1.2. the supported cipher suites are: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 In CR-mesh Release 6.3 and 6.4, both TLS 1.0 and 1.2 are supported. For TLS1.0, supported cipher is: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA For TLS1.2, supported cipher suites are: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Note	From Release 6.3, only TLS 1.2 is supported.

Use the following commands to troubleshoot Cisco Resilient Mesh:

• show dot1x all details

• show mesh-security keys

• show mesh-security session all

• show mesh-security interface wpan <slot >/<port >

There are two ways to forward multicast traffic to a CGR running Cisco IOS from the head-end:

• Configure the CGR as multicast client where the tunnel is configured with ipv6 mld join-group .
• Enable IPv6 multicast routing on the and configure it as a PIM6 router. This is the preferred method.

Dual-PHY can have master and slave for PLC and RF WPAN modules. The IPv6 prefix of the master is used for IPv6 addressing of the nodes.

Router# show running-config interface wpan 4/1
Building configuration...
Current configuration : 471 bytes
!
interface Wpan4/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7224
 ieee154 ssid migration_far2
 ieee154 txpower -30
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2092:1:1:1::/64
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
 mesh-security mesh-key lifetime 259200
end

Router# show running-config interface wpan 5/1
Building configuration...
Current configuration : 481 bytes
!
interface Wpan5/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7215
 ieee154 ssid plc123
 slave-mode 4
 rpl dag-lifetime 240
 rpl dio-min 21
 rpl version-incr-time 240
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2091:1:1:1::/64
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
end
Router#

You can use the following show wpan commands to trace nodes in a Dual-PHY master-slave configuration:

• show wpan <master slot >/1 rpl itable —Shows information for the actual slot from which RPL DAOs originated.

• show wpan <master slot >/1 rpl stable —Shows slave slot information for the actual slot from which RPL DAOs originated.

• show wpan <master slot >/1 rpl stree —Shows the link type (or slave slot information) for each node in the RPL tree.

• show wpan <master slot >/1 eap-table —Shows slave slot information for the actual slot from which IEEE802.1x traffic originated.

• All configurations and show commands related to the physical layer or the WPAN module hardware remain as is; show wpan <slot >/1 hardware * remains the same, per the actual physical slot.

Router# show wpan 4/1 link-neighbors table
------------------------- WPAN LINK NEIGHBOR TABLE [4] -------------------------
EUI64                   RSSIF   RSSIR   LQIF    LQIR    FIRST_HEARD   LAST_HEARD
00078108003C2200        -70     -78     58      9       12:02:18      14:08:02
00078108003C2201        n/a     -75     n/a     18      13:05:15      13:53:48
00078108003C2202        -72     -74     35      64      11:51:40      14:06:09
00078108003C2203        -73     -76     9       17      11:51:55      14:07:28
00078108003C2204        -71     -75     35      23      12:02:34      14:01:45
00078108003C2205        -74     -77     18      16      12:02:12      14:06:04
00078108003C2206        -73     -74     19      26      12:02:08      14:08:12
00078108003C2207        -72     -70     15      75      13:04:39      14:03:56
00078108003C2209        -73     -77     45      36      11:58:20      14:02:20
00078108003C220A        -74     -75     5       27      12:13:40      14:07:48
Number of Entries in WPAN LINK NEIGHBOR TABLE: 10
Router# show wpan 5/1 link-neighbors table
-------------------------------------------------------------------------------- WPAN LINK NEIGHBOR TABLE [5] --------------------------------------------------------------------------------
EUI64                   RSSIF   RSSIR   LQIF    LQIR    MODF    MODR    TXGAINF TXGAINR TXRESF  TXRESR  TMF     TMR     TXCOEFFF   TXCOEFFR        DPHASE  APHASE  LOCKF LOCKR   LAST_HEARD
000781FE0000012C        114     114     95      95      D8PSK   D8PSK   1       1       6       6       1F      3F      0000FFFFFFFF       0000FFFFFFFF    3       5       0     0       14:05:00
000781FE0000012D        114     114     96      96      D8PSK   D8PSK   1       1       6       6       3F      3F      0000FFFFFFFF       0000FFFFFFFF    3       5       0     0       13:55:54
000781FE0000012E        114     114     104     104     D8PSK   D8PSK   1       1       6       6       3F      3F      0000FFFFFFFF       0000FFFFFFFF    3       5       0     0       14:08:39
000781FE0000012F        114     114     120     120     D8PSK   D8PSK   1       1       6       6       3F      3F      0000FFFFFFFF       0000FFFFFFFF    3       5       0     0       14:07:15
000781FE00000130        114     114     101     101     D8PSK   D8PSK   1       1       6       6       1F      3F      0000FFFFFFFF       0000FFFFFFFF    3       5       0     0       13:59:39
Number of Entries in WPAN LINK NEIGHBOR TABLE: 5
Router#
Router#
Router# show wpan 4/1 rpl table
-------------------------------- WPAN RPL ROUTE TABLE [4] --------------------------------
NODE_IPADDR                             NEXTHOP_IP                              LAST_HEARD
2092:1:1:1:AAAA:8108:3C:2200            2092:1:1:1:AAAA:8108:3C:2203            13:47:54
2092:1:1:1:AAAA:8108:3C:2201            2092:1:1:1:AAAA:8108:3C:2204            13:45:25
2092:1:1:1:AAAA:8108:3C:2202            2092:1:1:1::                            13:48:53
2092:1:1:1:AAAA:8108:3C:2203            2092:1:1:1::                            13:49:42
2092:1:1:1:AAAA:8108:3C:2204            2092:1:1:1::                            13:44:41
2092:1:1:1:AAAA:8108:3C:2205            2092:1:1:1::                            13:58:26
2092:1:1:1:AAAA:8108:3C:2206            2092:1:1:1::                            13:58:15
2092:1:1:1:AAAA:8108:3C:2209            2092:1:1:1::                            14:01:42
2092:1:1:1:AAAA:8108:3C:220A            2092:1:1:1::                            13:57:39
2092:1:1:1:AAAA:8108:3C:2300            2092:1:1:1:AAAA:8108:3C:2206            14:05:12
2092:1:1:1:AAAA:8108:3C:2301            2092:1:1:1:AAAA:8108:3C:2206            13:37:31
<!---snip--!>
2092:1:1:1:AAAA:8108:3C:240A            2092:1:1:1:AAAA:8108:3C:2303            14:03:54
2092:1:1:1:AAAA:8108:3C:240B            2092:1:1:1:AAAA:8108:3C:2301            13:35:32
2092:1:1:1:AAAA:81FE:0:12C              2092:1:1:1::                            13:51:17
2092:1:1:1:AAAA:81FE:0:12D              2092:1:1:1::                            13:55:54
2092:1:1:1:AAAA:81FE:0:12E              2092:1:1:1::                            14:01:06
2092:1:1:1:AAAA:81FE:0:12F              2092:1:1:1::                            13:53:45
2092:1:1:1:AAAA:81FE:0:130              2092:1:1:1::                            13:59:39
Number of Entries in WPAN RPL ROUTE TABLE: 36
Router#
Router#
Router# show wpan 4/1 rpl itable
----------------------------- WPAN RPL IPROUTE INFO TABLE [4] -----------------------------
NODE_IPADDR                             RANK    VERSION NEXTHOP_IP                              ETX_P   ETX_L   RSSIR   RSSIF      HOPS    PARENTS SSLOT
2092:1:1:1:AAAA:8108:3C:2200            523     4       2092:1:1:1:AAAA:8108:3C:2203            263     256     -50     -512       3       4
2092:1:1:1:AAAA:8108:3C:2201            527     3       2092:1:1:1:AAAA:8108:3C:2203            265     256     -47     -562       3       4
2092:1:1:1:AAAA:8108:3C:2202            333     4       2092:1:1:1::                            0       333     -77     -771       3       4
2092:1:1:1:AAAA:8108:3C:2203            269     4       2092:1:1:1::                            0       265     -70     -721       1       4
2092:1:1:1:AAAA:8108:3C:2204            290     4       2092:1:1:1::                            0       285     -70     -731       2       4
2092:1:1:1:AAAA:8108:3C:2205            292     4       2092:1:1:1::                            0       287     -72     -721       3       4
2092:1:1:1:AAAA:8108:3C:2206            256     4       2092:1:1:1::                            0       256     -74     -751       1       4
2092:1:1:1:AAAA:8108:3C:2209            366     4       2092:1:1:1::                            0       352     -71     -761       3       4
2092:1:1:1:AAAA:8108:3C:220A            345     4       2092:1:1:1::                            0       345     -73     -751       3       4
2092:1:1:1:AAAA:8108:3C:2300            512     4       2092:1:1:1:AAAA:8108:3C:2206            258     256     -72     -692       3       4
2092:1:1:1:AAAA:8108:3C:2301            512     4       2092:1:1:1:AAAA:8108:3C:2206            258     256     -76     -782       3       4
<!---truncated--!>
2092:1:1:1:AAAA:81FE:0:12C              302     4       2092:1:1:1::                            0       291     116     1161       1       5
2092:1:1:1:AAAA:81FE:0:12D              309     4       2092:1:1:1::                            0       302     116     1161       2       5
2092:1:1:1:AAAA:81FE:0:12E              331     4       2092:1:1:1::                            0       321     116     1161       3       5
2092:1:1:1:AAAA:81FE:0:12F              348     4       2092:1:1:1::                            0       336     116     1161       3       5
2092:1:1:1:AAAA:81FE:0:130              342     4       2092:1:1:1::                            0       321     116     1161       3       5
Number of Entries in WPAN RPL IPROUTE INFO TABLE: 36
Router#
Router# show wpan 4/1 rpl stable
------------------------------ WPAN RPL ROUTE SLOT TABLE [4] ------------------------------
NODE_IPADDR                             NEXTHOP_IP                              SSLOT   LAST_HEARD
2092:1:1:1:AAAA:8108:3C:2200            2092:1:1:1:AAAA:8108:3C:2203            4       15:12:29
2092:1:1:1:AAAA:8108:3C:2201            2092:1:1:1:AAAA:8108:3C:2203            4       14:43:10
2092:1:1:1:AAAA:8108:3C:2202            2092:1:1:1::                            4       15:16:55
2092:1:1:1:AAAA:8108:3C:2203            2092:1:1:1::                            4       15:13:21
2092:1:1:1:AAAA:8108:3C:2204            2092:1:1:1::                            4       14:48:37
2092:1:1:1:AAAA:8108:3C:2205            2092:1:1:1::                            4       15:05:00
2092:1:1:1:AAAA:8108:3C:2206            2092:1:1:1::                            4       15:01:05
2092:1:1:1:AAAA:8108:3C:2209            2092:1:1:1::                            4       15:06:11
2092:1:1:1:AAAA:8108:3C:220A            2092:1:1:1::                            4       14:58:23
2092:1:1:1:AAAA:8108:3C:2300            2092:1:1:1:AAAA:8108:3C:2206            4       15:05:55
2092:1:1:1:AAAA:8108:3C:2301            2092:1:1:1:AAAA:8108:3C:2206            4       15:04:19
2092:1:1:1:AAAA:8108:3C:2302            2092:1:1:1:AAAA:8108:3C:2206            4       14:56:48
<!---snip--!>
2092:1:1:1:AAAA:81FE:0:12C              2092:1:1:1::                            5       14:53:32
2092:1:1:1:AAAA:81FE:0:12D              2092:1:1:1::                            5       14:50:57
2092:1:1:1:AAAA:81FE:0:12E              2092:1:1:1::                            5       15:06:24
2092:1:1:1:AAAA:81FE:0:12F              2092:1:1:1::                            5       15:15:45
2092:1:1:1:AAAA:81FE:0:130              2092:1:1:1::                            5       15:03:24
Number of Entries in WPAN RPL ROUTE SLOT TABLE: 36 (external 0) (RF 31) (PLC 5)

Router# show wpan 4/1 rpl stree
----------------------------- WPAN RPL SLOT TREE [4] -----------------------------
  [2092:1:1:1::]
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2202
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2203
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2200
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2201
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2204
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2205
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2206
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2300
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2301
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2406
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2408
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2302
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2303
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2407
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:240A
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2304
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2400
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2403
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2404
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2305
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2307
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2402
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2405
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2308
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2309
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:240B
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:230A
                   \--(RF )-- 2092:1:1:1:AAAA:8108:3C:230B
                           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2409
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:2209
           \--(RF )-- 2092:1:1:1:AAAA:8108:3C:220A
           \--(PLC)-- 2092:1:1:1:AAAA:81FE:0:12C
           \--(PLC)-- 2092:1:1:1:AAAA:81FE:0:12D
           \--(PLC)-- 2092:1:1:1:AAAA:81FE:0:12E
           \--(PLC)-- 2092:1:1:1:AAAA:81FE:0:12F
           \--(PLC)-- 2092:1:1:1:AAAA:81FE:0:130
RPL SLOT TREE: Num.DataEntries 36, Num.GraphNodes 37 (external 0) (RF 31) (PLC 5)

This section shows example output from the commands to remove the master-slave relationship between two CGR WPAN modules. In this example, the master WPAN module is in slot 4, and the slave WPAN module is in slot 5.

Router# show run interface wpan 4/1
 
!<<<<<---- #Initially configured as master WPAN
Building configuration...
Current configuration : 471 bytes
!
interface Wpan4/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7224
 ieee154 ssid migration_far2
 ieee154 txpower -30
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2092:1:1:1::/64
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
 mesh-security mesh-key lifetime 259200
end

Router# show run interface wpan 5/1
 
!<<<<<---- #Initially configured as slave
Building configuration...
Current configuration : 481 bytes
!
interface Wpan5/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7215
 ieee154 ssid plc123

 slave-mode 4
 
!<<<<---- #WPAN 5/1 has a master WPAN in slot 4
 rpl dag-lifetime 240
 rpl dio-min 21
 rpl version-incr-time 240
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2091:1:1:1::/64                  
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
end

Router# show wpan 5/1 config
module type:    PLC-WPAN (IEEE P1901.2 PLC)
ssid:           plc123
panid:          7215
transmit power: 32
ref-phase:      1
tonemap:        unlocked (not used)
phy_params:     1 (ceneleca) 000000000FFFFFFFFF
beacon async:   min-interval 120 max-interval 900 suppression-coefficient 1
security mode:  1
test mode:      0 (test firmware only)
admin_status:   up
rpl prefix:            2091:1:1:1::/64
rpl route-poisoning:   off
rpl dodag-lifetime:    240
rpl dio-dbl:           0
rpl dio-min:           21
rpl version-incr-time: 240
detach bridge:         no
bootloader mode:       no
mcast-agent:           FF38:40:2091:1:1:1:0:1 61624 1153
firmware version:      5.5.48
slave mode:            4
 (slot 5 is attached to master slot 4)

Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)# interface wpan 5/1
Router(config-if)# no slave-mode 4
 
!<<<<<---- #Ends slave mode to master-slot 4
Router(config-if)# end
Router#

Router(config)# hw poweroff 5
Router(config)#
*May 22 12:42:15.511 PST: %CGR1K_SYS-5-MODULE_POWER_DOWN: Module in slot 5 is powered down.
Router(config)#
*May 22 12:42:17.539 PST: %LINK-3-UPDOWN: Interface Wpan5/1, changed state to down
*May 22 12:42:18.539 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface Wpan5/1, changed state to down
Router(config)#
Router(config)# no hw poweroff 5
*May 22 12:43:38.763 PST: %CGR1K_SYS-5-MODULE_POWER_UP: Module in slot 5 is powered up.
Router(config)#
*May 22 12:43:56.591 PST: %LINK-3-UPDOWN: Interface Wpan5/1, changed state to up
*May 22 12:43:57.591 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface Wpan5/1, changed state to up
Router(config)# end

Adding Mesh-Security keys for WPAN 5/1

Router# mesh-security set mesh-key interface wpan 5/1 key 5551
Key ID       : 0
Key expiry   : Sat Jun 21 12:55:43 2014
Router# mesh-security set mesh-key interface wpan 5/1 key 5552
Key ID       : 1
Key expiry   : Mon Jul 21 12:55:43 2014

Note	There can be up to four mesh-security keys configured for a WPAN slot.

Router# show run interface wpan 5/1
Building configuration...
Current configuration : 467 bytes
!
interface Wpan5/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1
 ieee154 panid 7215
 ieee154 ssid plc123
 rpl dag-lifetime 240
 rpl dio-min 21
 rpl version-incr-time 240
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2091:1:1:1::/64
 ipv6 enable
 ipv6 dhcp relay destination  2010:A0B0:1001:22::2
 dot1x pae authenticator
end
Router#
Router# show wpan 5/1 config
module type:    PLC-WPAN (IEEE P1901.2 PLC)
ssid:           plc123
panid:          7215
transmit power: 32
ref-phase:      1
tonemap:        unlocked (not used)
phy_params:     1 (ceneleca) 000000000FFFFFFFFF
beacon async:   min-interval 120 max-interval 900 suppression-coefficient 1
security mode:  1
test mode:      0 (test firmware only)
admin_status:   up
rpl prefix:            2091:1:1:1::/64
rpl route-poisoning:   off
rpl dodag-lifetime:    240
rpl dio-dbl:           0
rpl dio-min:           21
rpl version-incr-time: 240
detach bridge:         no
bootloader mode:       no
mcast-agent:           FF38:40:2091:1:1:1:0:1 61624 1153
firmware version:      5.5.48
slave mode:            no
Router#
Router# show mesh-security keys
Mesh Interface: Wpan4/1
Master Key Lifetime  : 12 Days 0 Hours 0 Minutes 0 Seconds
Temporal Key Lifetime: 6 Days 0 Hours 0 Minutes 0 Seconds
Mesh Key Lifetime    : 3 Days 0 Hours 0 Minutes 0 Seconds
Key ID         : 0 *
Key expiry     : Sat May 24 11:51:35 2014
Time remaining : 1 Days 22 Hours 55 Minutes 39 Seconds
Key ID         : 1 
Key expiry     : Tue May 27 11:51:35 2014
Time remaining : 4 Days 22 Hours 55 Minutes 39 Seconds
Key ID         : 2 
Key expiry     : Fri May 30 11:51:35 2014
Time remaining : 7 Days 22 Hours 55 Minutes 39 Seconds
Key ID         : 3 
Key expiry     : Mon Jun  2 11:51:35 2014
Time remaining : 10 Days 22 Hours 55 Minutes 39 Seconds
Mesh Interface: Wpan5/1
Master Key Lifetime  : 120 Days 0 Hours 0 Minutes 0 Seconds
Temporal Key Lifetime: 60 Days 0 Hours 0 Minutes 0 Seconds
Mesh Key Lifetime    : 30 Days 0 Hours 0 Minutes 0 Seconds
Key ID         : 0 *
Key expiry     : Sat Jun 21 12:55:43 2014
Time remaining : 29 Days 23 Hours 59 Minutes 47 Seconds
Key ID         : 1 
Key expiry     : Mon Jul 21 12:55:43 2014
Time remaining : 59 Days 23 Hours 59 Minutes 47 Seconds
Router#

Router# show wpan 5/1 rpl table
 
-------------------------------- WPAN RPL ROUTE TABLE [5] --------------------------------
NODE_IPADDR					NEXTHOP_IP			LAST_HEARD
2091:1:1:1:AAAA:81FE:0:12C			2091:1:1:1::			13:42:17
2091:1:1:1:AAAA:81FE:0:12D			2091:1:1:1::			13:40:47
2091:1:1:1:AAAA:81FE:0:12F			2091:1:1:1::			13:41:59
Number of Entries in WPAN RPL ROUTE TABLE: 3

Router# show wpan 5/1 rpl stable
------------------------------ WPAN RPL ROUTE SLOT TABLE [5] ------------------------------
NODE_IPADDR					NEXTHOP_IP		SSLOT		LAST_HEARD
2091:1:1:1:AAAA:81FE:0:12C			2091:1:1:1::	5	13:42:17
2091:1:1:1:AAAA:81FE:0:12D			2091:1:1:1::	5	13:40:47
2091:1:1:1:AAAA:81FE:0:12F			2091:1:1:1::	5	13:41:59
Number of Entries in WPAN RPL ROUTE SLOT TABLE: 3 (external 0) (RF 0) (PLC 3)

Router# ping 2091:1:1:1:AAAA:81FE:0:12C 
  
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2091:1:1:1:AAAA:81FE:0:12C, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 256/268/276 ms
Router#

Router# show wpan 4/1 config
module type:    RF-WPAN (IEEE 802.15.4e/g RF 900MHz)
ssid:           migration_far2     <-- #See Naming the SSID.
panid:          7224               <-- #See Naming Your PAN.
transmit power: -30                <-- #See Configuring Transmit Power.
channel:        254                <-- #Channel hopping setting
dwell:          window 20000 max-dwell 400
beacon async:   min-interval 120 max-interval 900 suppression-coefficient 1
security mode:  1
test mode:      0 (test firmware only)
admin_status:   up
rpl prefix:            2092:1:1:1::/64
rpl route-poisoning:   off
rpl dodag-lifetime:    120
rpl dio-dbl:           0
rpl dio-min:           20
rpl version-incr-time: 60
detach bridge:         no
bootloader mode:       no
mcast-agent:           FF38:40:2092:1:1:1:0:1 61624 1153
firmware version:      5.5.48
slave mode:            no

To view the WPAN configuration that resides on the WPAN hardware, use the show wpan <slot >/1 hardware configuration command:

Router# show wpan 4/1 hardware hwversion
hardware version: Itron OWCM
Hardware rev : 3.1
Model name   : OWCM
Hardware ID  : RFLAN/3.60/3.80
Router# show wpan 4/1 hardware version
firmware version: 5.5.48, apps/bridge, master, 4b89e37, Apr  4
Router# show wpan 4/1 hardware config
serial number:  FF-FF-FF-FF-FF-FF-FF-FF
eui64:          000781080067B074
ssid:           migration_far2
panid:          7224
transmit power: -30  (<-txpower_reg 0x12)
channel:        254
channel notch:  none
dwell:          window 20000 max-dwell 400
beacon async:   min-interval 120 max-interval 900 suppression-coefficient 1
security mode:  1
admin_status:   up

Other show wpan hardware options are:

Router# show wpan 4/1 hardware ?
  channel-list      Channel list
  config            Configuration
  debug             Debug information
  global-time       Global time
  hwversion         Hardware version
  key-info          Mesh key information
  leds              LED status
  link-neighbors    Layer 2 link neighbor information
  link-stats        Link statistics
  network-if-stats  Network interface statistics
  security-mode     Security mode (enabled by dot1x)
  test-mode         Test mode (for test firmware only)
  uptime            Uptime
  version           Firmware version

The output of the command show wpan <slot >/1 hardware key shows mesh-security keys (GTKs) that reside on the WPAN hardware. The show wpan <slot >/1 hardware key output should agree with the output of show mesh-security-keys . (See show mesh-security keys.)

Router# show wpan 4/1 hard key
keyinfo:
        key 0: valid *
        key 1: valid
        key 2: empty
        key 3: empty
        key x: valid

The show wpan <slot >/1 hardware link-neighbor command shows the list of recently heard IEEE 802.15.4 link neighbors. These link neighbors are RMEs within a 1-hop transmit range from the CGR and from which the CGR has recently heard IEEE 802.15.4 frames. The list shows only the most recently heard subset from all possible 1-hop neighbors.

Router# show wpan 4/1 hardware link-neighbors
eui64                 heard   etx     sent / ack    rssif / rssir   lqif / lqir
0007810800A909A1      5       65535      0 / 0        n/a / -99      n/a / 41
0007810800CBF246      23      65535      0 / 0        n/a / -86      n/a / 76
0007810800000001      38      65535      0 / 0        n/a / -114     n/a / 127
00078108003C2206      59      263        3 / 3       - 71 / -74       36 / 14
00078108003C2202      65      278        0 / 0       - 71 / -77       72 / 36
00078108003C2207      113     258        1 / 1       - 71 / -76       14 / 18

Router# show wpan 4/1 hardware link-stats ?
  bridge          Link statistics bridge
  brief           Link statistics brief
  ieee154-beacon  Link statistics ieee154 beacon
  ieee154-device  Link statistics ieee154 device
  ieee154-mac     Link statistics ieee154 mac
  lowpan          Link statistics lowpan
  radio           Link statistics radio

Router# show wpan 4/1 hardware link-stats brief
linkstats info:
---------------
lowpan
  tx frames: 5244  (1349356 bytes)
  rx frames: 2483  (740228 bytes)
  tx errors: 0
  rx errors: 0
  tx discards: 113
  rx discards: 22
serial
  tx frames: 2340  (250602 bytes)
  rx frames: 1031  (308456 bytes)
  tx errors: 0
  rx errors: 3
  tx discards: 0
  rx discards: 0

Router# show wpan 4/1 packet-count
TOTAL:
        incoming: 940        (183959   bytes)
        outgoing: 739        (192452   bytes)
-------------------------------------------------
lowpan:
        incoming: 395        (81660    bytes)
        outgoing: 79         (11483    bytes)
dot1x:
        incoming: 545        (102299   bytes)
        outgoing: 660        (180969   bytes)
outage:
        incoming: 0          (0        bytes)
restoration:
        incoming: 0          (0        bytes)
-------------------------------------------------
lowpan.icmp:
        incoming: 143        (16601    bytes)
         rpl dao: 41         (7160     bytes)
         rpl dio: 38         (4125     bytes)
         rpl dis: 0          (0        bytes)
         nd ns  : 39         (2816     bytes)
        outgoing: 40         (4000     bytes)
         rpl ra : 0          (0        bytes)
         nd rs  : 0          (0        bytes)
lowpan.dhcp:
        incoming: 179        (23850    bytes)
        outgoing: 27         (6595     bytes)
lowpan.csmp:
        incoming: 73         (41209    bytes)
         - mcast: 0          (0        bytes)
         - ucast: 73         (41209    bytes)
        outgoing: 1          (52       bytes)
         - mcast: 0          (0        bytes)
         - ucast: 1          (52       bytes)
lowpan.c1222:
        incoming: 0          (0        bytes)
         - mcast: 0          (0        bytes)
         - ucast: 0          (0        bytes)
        outgoing: 0          (0        bytes)
         - mcast: 0          (0        bytes)
         - ucast: 0          (0        bytes)
lowpan.other_udp:
        incoming: 0          (0        bytes)
        outgoing: 0          (0        bytes)
lowpan.tcp:
        incoming: 0          (0        bytes)
        outgoing: 0          (0        bytes)
lowpan.other_ip:
        incoming: 0          (0        bytes)
        outgoing: 11         (836      bytes)
-------------------------------------------------
ucast:
        incoming: 902        (179834   bytes)
        outgoing: 728        (191616   bytes)
mcast:
        incoming: 0          (0        bytes)
        outgoing: 0          (0        bytes)
bcast:
        incoming: 38         (4125     bytes)
        outgoing: 11         (836      bytes)
-------------------------------------------------
bridge:
        incoming: 0          (0        bytes)
        outgoing: 0          (0        bytes)
-------------------------------------------------
(ios):
        incoming: 792        (169418   bytes)
        outgoing: 861        (155858   bytes)
(hdlc):
        incoming: 2131       (216892   bytes)
        outgoing: 972        (306238   bytes)
-------------------------------------------------
udp checksum error:
        incoming: 0          (0        bytes)
icmp checksum error:
        incoming: 0          (0        bytes)
tcp checksum error:
        incoming: 0          (0        bytes)
-------------------------------------------------
queue overflow:
        hdlc queue: 0           hold queue: 0
Router#

The command show wpan link-neighbors shows the information about the WPAN link neighbors. These link neighbors are RMEs within a 1-hop transmit range from the CGR that sent at least one IPv6 or IEEE 802.1X packet to the CGR during the last hour.

Router# show wpan 4/1 link-neighbors table
------------------------- WPAN LINK NEIGHBOR TABLE [4] -------------------------
EUI64                   RSSIF   RSSIR   LQIF    LQIR    FIRST_HEARD   LAST_HEARD
00078108003C2200        -69     -76     51      7       15:09:50      16:38:17
00078108003C2201        -72     -77     29      14      14:46:01      16:39:57
00078108003C2202        -71     -77     72      21      14:51:32      16:51:14
00078108003C2203        -70     -74     57      10      14:49:31      16:45:44
00078108003C2204        -74     -75     8       14      15:09:39      16:49:39
00078108003C2205        -70     -76     76      15      14:45:01      16:35:16
00078108003C2206        -71     -75     36      20      15:09:44      16:50:37
00078108003C2207        -71     -75     14      16      14:46:25      16:37:48
00078108003C2208        -71     -78     47      7       14:52:51      16:44:15
00078108003C2209        -73     -78     66      15      15:13:34      16:51:16
00078108003C220A        -72     -76     18      14      14:51:51      16:49:21
00078108003C220B        -69     -76     45      9       15:09:37      16:47:55
Number of Entries in WPAN LINK NEIGHBOR TABLE: 12

Router# show wpan 4/1 link-neighbors brief
Number of Entries:      12
Last Reset:     2014:05:18-14:43:33
First Heard:    2014:05:18-14:45:01     00078108003C2205     -76    -70
Last Joined:    2014:05:18-15:13:34     00078108003C2209     -80    -73
Last Heard:     2014:05:18-16:58:54     00078108003C2208     -75    -71

Note	The minimum RSSI to join a mesh network is -95 dBm; a lower RSSIF/RRSIR value will not allow the node to establish connectivity.

The show wpan < slot>/1 outage table command shows recent power-outage notification (PON) events in the PAN during the past hour.

Route# show wpan 4/1 outage-table 
---------------------- WPAN POWER OUTAGE NOTIFICATION TABLE ----------------------
EUI64	      TIMESTAMP       CNT_B    CNT_R    FIRST_HEARD   LAST_HEARD   SSLOT
00078108003C2200      1399405190      1        0        12:39:51      12:39:51      4
00078108003C2201      1399405193      1        0        12:39:54      12:39:54      4
Number of Entries in WPAN RECENT POWER OUTAGE NOTIFICATION (PON) TABLE: 2

The show wpan < slot>/1 restoration-table command shows recent power restoration notification (PRN) events in the PAN during the past hour.

Router# show wpan 4/1 restoration-table
 
---------------------- WPAN POWER RESTORATION NOTIFICATION TABLE ---------------------
EUI64   	      TIMESTAMP     OUTAGE_TIME   CNT_B  CNT_R  FIRST_HEARD  LAST_HEARD  SSLOT
00078108003C2200      1399405290    1399405190    3      33     12:53:30     12:54:15     4
00078108003C2201      1399405293    1399405193    2      34     12:52:44     12:53:26     4
Number of Entries in WPAN RECENT PRN TABLE (POWER RESTORATION NOTIFICATION): 2

To view the RPL Directed Acyclic Graph (DAG) and its routing table, use the following commands:

Router# show wpan 4/1 rpl ?
  atable             Show RPL routing table with external modules
  atree              Show RPL routing tree figure with external modules
  brief              Show RPL routing table brief information
  config             Show RPL configuration
  dag-lifetime       Show DAG lifetime in minutes
  dio-dbl            Show DIO dbl value
  dio-min            Show DIO minimum value
  etree              Show RPL routing tree figure with EUI64
  hopinfo            Show RPL routing tree hops information
  itable             Show RPL routing table with IP route information
  ptable             Show RPL routing table with parent information
  route-poisoning    Show route poisoning
  stable             Show RPL routing table with actual slot info
  stree              Show RPL routing tree figure with actual slot info
  table              Show RPL routing table
  tree               Show RPL routing tree figure
  version-incr-time  Show version increment time in minutes

Router# show wpan 4/1 rpl table
-------------------------------- WPAN RPL ROUTE TABLE [4] --------------------------------
NODE_IPADDR                             NEXTHOP_IP                              LAST_HEARD
2092:1:1:1:AAAA:8108:3C:2200            2092:1:1:1::                            16:29:40
2092:1:1:1:AAAA:8108:3C:2203            2092:1:1:1::                            16:43:10
2092:1:1:1:AAAA:8108:3C:2205            2092:1:1:1:AAAA:8108:3C:2206            16:47:38
2092:1:1:1:AAAA:8108:3C:2206            2092:1:1:1::                            16:55:09
2092:1:1:1:AAAA:8108:3C:2207            2092:1:1:1::                            16:53:00
2092:1:1:1:AAAA:8108:3C:2208            2092:1:1:1::                            16:43:36
2092:1:1:1:AAAA:8108:3C:2209            2092:1:1:1::                            17:02:49
2092:1:1:1:AAAA:8108:3C:220A            2092:1:1:1::                            16:55:20
2092:1:1:1:AAAA:8108:3C:220B            2092:1:1:1::                            16:58:26
2092:1:1:1:AAAA:8108:3C:2301            2092:1:1:1:AAAA:8108:3C:2206            16:55:35
2092:1:1:1:AAAA:8108:3C:2302            2092:1:1:1:AAAA:8108:3C:2206            16:53:06
2092:1:1:1:AAAA:8108:3C:2304            2092:1:1:1:AAAA:8108:3C:2206            16:42:55
2092:1:1:1:AAAA:8108:3C:2306            2092:1:1:1:AAAA:8108:3C:220A            16:47:15
2092:1:1:1:AAAA:8108:3C:2308            2092:1:1:1:AAAA:8108:3C:2206            16:49:26
2092:1:1:1:AAAA:8108:3C:2309            2092:1:1:1:AAAA:8108:3C:2206            17:00:24
2092:1:1:1:AAAA:8108:3C:2402            2092:1:1:1:AAAA:8108:3C:2304            16:29:54
2092:1:1:1:AAAA:8108:3C:2403            2092:1:1:1:AAAA:8108:3C:2304            16:56:58
2092:1:1:1:AAAA:8108:3C:2404            2092:1:1:1:AAAA:8108:3C:2304            17:02:23
2092:1:1:1:AAAA:8108:3C:2405            2092:1:1:1:AAAA:8108:3C:2304            16:40:57
2092:1:1:1:AAAA:8108:3C:2406            2092:1:1:1:AAAA:8108:3C:2308            17:05:55
2092:1:1:1:AAAA:8108:3C:2407            2092:1:1:1:AAAA:8108:3C:2304            17:03:14
2092:1:1:1:AAAA:8108:3C:2409            2092:1:1:1:AAAA:8108:3C:2304            17:06:08
2092:1:1:1:AAAA:8108:3C:240A            2092:1:1:1:AAAA:8108:3C:2304            16:36:29
2092:1:1:1:AAAA:8108:3C:240B            2092:1:1:1:AAAA:8108:3C:2304            16:56:51
Number of Entries in WPAN RPL ROUTE TABLE: 24

Router# show wpan 4/1 rpl tree
----------------------------- WPAN RPL TREE FIGURE [4] -----------------------------
  [2092:1:1:1::] (8/25)
           \--- 2092:1:1:1:AAAA:8108:3C:2200
           \--- 2092:1:1:1:AAAA:8108:3C:2203
           \--- 2092:1:1:1:AAAA:8108:3C:2206 (7/16)
                   \--- 2092:1:1:1:AAAA:8108:3C:2201
                   \--- 2092:1:1:1:AAAA:8108:3C:2205
                   \--- 2092:1:1:1:AAAA:8108:3C:2301
                   \--- 2092:1:1:1:AAAA:8108:3C:2302
                   \--- 2092:1:1:1:AAAA:8108:3C:2304 (7)
                           \--- 2092:1:1:1:AAAA:8108:3C:2403
                           \--- 2092:1:1:1:AAAA:8108:3C:2404
                           \--- 2092:1:1:1:AAAA:8108:3C:2405
                           \--- 2092:1:1:1:AAAA:8108:3C:2407
                           \--- 2092:1:1:1:AAAA:8108:3C:2409
                           \--- 2092:1:1:1:AAAA:8108:3C:240A
                           \--- 2092:1:1:1:AAAA:8108:3C:240B
                   \--- 2092:1:1:1:AAAA:8108:3C:2308 (2)
                           \--- 2092:1:1:1:AAAA:8108:3C:2402
                           \--- 2092:1:1:1:AAAA:8108:3C:2406
                   \--- 2092:1:1:1:AAAA:8108:3C:2309
           \--- 2092:1:1:1:AAAA:8108:3C:2207
           \--- 2092:1:1:1:AAAA:8108:3C:2208
           \--- 2092:1:1:1:AAAA:8108:3C:2209
           \--- 2092:1:1:1:AAAA:8108:3C:220A (1)
                   \--- 2092:1:1:1:AAAA:8108:3C:2306
           \--- 2092:1:1:1:AAAA:8108:3C:220B
RPL TREE: Num.DataEntries 25, Num.GraphNodes 26

Router# show wpan 4/1 rpl atable
-------------------------------- WPAN RPL ROUTE TABLE [4] --------------------------------
NODE_IPADDR                             NEXTHOP_IP                              LAST_HEARD
2092:1:1:1:AAAA:8108:3C:2200            2092:1:1:1::                            17:12:08
2092:1:1:1:AAAA:8108:3C:2201            2092:1:1:1:AAAA:8108:3C:2206            17:11:59
2092:1:1:1:AAAA:8108:3C:2203            2092:1:1:1::                            16:43:10
2092:1:1:1:AAAA:8108:3C:2205            2092:1:1:1:AAAA:8108:3C:2206            16:47:38
2092:1:1:1:AAAA:8108:3C:2206            2092:1:1:1::                            16:55:09
2092:1:1:1:AAAA:8108:3C:2207            2092:1:1:1::                            16:53:00
2092:1:1:1:AAAA:8108:3C:2208            2092:1:1:1::                            17:11:41
2092:1:1:1:AAAA:8108:3C:2209            2092:1:1:1::                            17:02:49
2092:1:1:1:AAAA:8108:3C:220A            2092:1:1:1::                            16:55:20
2092:1:1:1:AAAA:8108:3C:220B            2092:1:1:1::                            16:58:26
2092:1:1:1:AAAA:8108:3C:2301            2092:1:1:1:AAAA:8108:3C:2206            16:55:35
2092:1:1:1:AAAA:8108:3C:2302            2092:1:1:1:AAAA:8108:3C:2206            16:53:06
2092:1:1:1:AAAA:8108:3C:2304            2092:1:1:1:AAAA:8108:3C:2206            16:42:55
2092:1:1:1:AAAA:8108:3C:2306            2092:1:1:1:AAAA:8108:3C:220A            16:47:15
2092:1:1:1:AAAA:8108:3C:2308            2092:1:1:1:AAAA:8108:3C:2206            16:49:26
2092:1:1:1:AAAA:8108:3C:2309            2092:1:1:1:AAAA:8108:3C:2206            17:00:24
2092:1:1:1:AAAA:8108:3C:2402            2092:1:1:1:AAAA:8108:3C:2308            17:09:36
2092:1:1:1:AAAA:8108:3C:2403            2092:1:1:1:AAAA:8108:3C:2304            16:56:58
2092:1:1:1:AAAA:8108:3C:2404            2092:1:1:1:AAAA:8108:3C:2304            17:02:23
2092:1:1:1:AAAA:8108:3C:2405            2092:1:1:1:AAAA:8108:3C:2304            16:40:57
2092:1:1:1:AAAA:8108:3C:2406            2092:1:1:1:AAAA:8108:3C:2308            17:05:55
2092:1:1:1:AAAA:8108:3C:2407            2092:1:1:1:AAAA:8108:3C:2304            17:03:14
2092:1:1:1:AAAA:8108:3C:2409            2092:1:1:1:AAAA:8108:3C:2304            17:06:08
2092:1:1:1:AAAA:8108:3C:240A            2092:1:1:1:AAAA:8108:3C:2304            17:10:25
2092:1:1:1:AAAA:8108:3C:240B            2092:1:1:1:AAAA:8108:3C:2304            16:56:51
Number of Entries in WPAN RPL ROUTE TABLE: 25 (external 0)

Router# show wpan 4/1 rpl ptable
----------------------------- WPAN RPL PARENT INFO TABLE [4] -----------------------------
NODE_IPADDR                             NODE_EUI                RANK    VERSION PRIMARY NEXTHOP_IPADDR                    NEXTHOP_EUI              ETX_P   ETX_L   RSSIR   RSSIF   LQIR    LQIF    HOPS    PARENTS SSLOT
2092:1:1:1:AAAA:8108:3C:2200            00078108003C2200        298     3       *       2092:1:1:1::                               000781080067B074        0       298     -74     -78     7       7       1       3       4
2092:1:1:1:AAAA:8108:3C:2200            00078108003C2200        298     3               2092:1:1:1:AAAA:8108:3C:2206               00078108003C2206        256     256     -42     -47     67      22      2       3       4
2092:1:1:1:AAAA:8108:3C:2200            00078108003C2200        298     3               2092:1:1:1:AAAA:8108:3C:220A               00078108003C220A        258     256     -49     -51     58      26      2       3       4
2092:1:1:1:AAAA:8108:3C:2201            00078108003C2201        512     3       *       2092:1:1:1:AAAA:8108:3C:2206               00078108003C2206        256     256     -40     -45     38      10      2       3       4
2092:1:1:1:AAAA:8108:3C:2201            00078108003C2201        512     3               2092:1:1:1:AAAA:8108:3C:2208               00078108003C2208        267     256     -41     -40     67      73      2       3       4
2092:1:1:1:AAAA:8108:3C:2201            00078108003C2201        512     3               2092:1:1:1::                               000781080067B074        0       550     -70     -76     37      38      1       3       4
2092:1:1:1:AAAA:8108:3C:2203            00078108003C2203        360     3       *       2092:1:1:1::                               000781080067B074        0       347     -74     -74     12      22      1       3       4
<-..truncated..->

Router# show wpan 4/1 rpl brief
Number of Entries:      25
Last Reset:     2014:05:18-14:57:10     (reason: configure panid)
First Heard:    2014:05:18-15:25:43     2092:1:1:1:AAAA:8108:3C:220A
Last Joined:    2014:05:18-17:11:59     2092:1:1:1:AAAA:8108:3C:2201
Last Heard:     2014:05:18-17:13:21     2092:1:1:1:AAAA:8108:3C:2405

Router# show wpan 4/1 rpl hopinfo
-------- RPL TREE HOP INFO [4] --------
              NUM_NODES      (REPORTED)
Hop  0:             1           (    1)
Hop  1:             8           (    8)
Hop  2:             8           (    8)
Hop  3:             9           (    9)
RPL HOPINFO: # DataEntries 25, # External 0, # GraphNodes 26

CGR-JAF1626AQED# show run brief
Building configuration...
Current configuration : 13616 bytes
!
! Last configuration change at 11:35:03 PDT Fri May 16 2014
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime localtime
no service password-encryption
service internal
!
hostname CGR-JAF1626AQED
!
boot-start-marker
boot system flash:/cgr1000-universalk9-mz.SSA.154-2.12.CG015
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
aaa group server radius nps-group
 server name nps-radius
!
aaa authentication dot1x default group nps-group
aaa authorization network FlexVPN_Author local 
!
!
!
!
!
aaa session-id common
clock timezone PST -8 0
clock summer-time PDT recurring
!
dot11 ssid sol50_wifi
 authentication key-management wpa2
 wpa2-psk ascii encrypted 7 072C285F4D0626544541
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip dhcp pool GOS
 host 192.168.1.1 255.255.255.0
 client-identifier d48c.b5a2.ee4c
!
!
!
no ip domain lookup
ip domain name ipv6lab.com
ip host cenbu-tps1.ipv6lab.com 192.168.193.120
ip host cenbu-nms1.ipv6lab.com 2001:C1::C0A8:C10E
ip inspect WAAS flush-timeout 10
ip cef
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint LDevID
 enrollment mode ra
 enrollment profile LDevID
 serial-number none
 fqdn none
 ip-address none
 password
 fingerprint F23314787BD98B99AF1FE0B2D338961D125EAE51
 subject-name CN=CGR-JAF1626AQED/serialNumber=PID:CGR1120/K9 SN:JAF1626AQED
 revocation-check none
 rsakeypair LDevID 2048
!
crypto pki profile enrollment LDevID
 enrollment url  http://192.168.100.120/certsrv/mscep/mscep.dll
!
!
!
crypto pki certificate map FlexVPN_Cert_Map 1
 issuer-name co cn = ipv6lab-sol-radius1-ca
!
crypto pki certificate chain LDevID
 certificate 610380E2000100000120
 certificate ca 2539E6B5CFF2FB894AC90A73EA69A645
!
chat-script hspa-R7 "" "AT!SCACT=1,1" TIMEOUT 60 "OK"
license udi pid CGR1240/K9 sn JAF1626BKLG
license accept end user agreement
license boot module cgr1000 technology-package securityk9
license boot module cgr1000 technology-package datak9
dot1x system-auth-control
!
!
!
!
!
archive
 path flash:/archive/
 maximum 8
username admin privilege 15 password 0 Cisco_123
username cg-nms-administrator privilege 15 password 0 Cisco_123
!
redundancy
 notification-timer 60000
!
crypto ikev2 authorization policy FlexVPN_Author_Policy 
 route set interface
 route set access-list FlexVPN_Client_IPv4_LAN
 route set access-list ipv6 FlexVPN_Client_IPv6_LAN
!
crypto ikev2 proposal FlexVPN_IKEv2_Proposal 
 encryption aes-cbc-128
 integrity sha1
 group 5
!
crypto ikev2 policy FLexVPN_IKEv2_Policy 
 proposal FlexVPN_IKEv2_Proposal
!
!
crypto ikev2 profile FlexVPN_IKEv2_Profile
 match certificate FlexVPN_Cert_Map
 identity local dn 
 authentication remote rsa-sig
 authentication local rsa-sig
 pki trustpoint LDevID
 aaa authorization group cert list FlexVPN_Author FlexVPN_Author_Policy
!
crypto ikev2 dpd 30 5 on-demand
crypto ikev2 client flexvpn FlexVPN_Client
  peer 1 173.36.248.224
  client connect Tunnel0
!
!
!
controller Cellular 3/1
!
ip ssh rsa keypair-name CGR-JAF1626AQED
ip ssh version 2
! 
!
!
crypto ipsec transform-set AES_128_SHA1 esp-aes esp-sha-hmac 
 mode transport
!
crypto ipsec profile FlexVPN_IPsec_Profile
 set transform-set AES_128_SHA1 
 set ikev2-profile FlexVPN_IKEv2_Profile
!
!
!
!
!
!
!
interface Loopback0
 ip address 20.211.0.11 255.255.255.255
 ipv6 address 2001:420:7BF:7E8::B/128
 ipv6 enable
 ipv6 ospf 1 area 1
!
interface Tunnel0
 description IPsec tunnel to SOL-ASR-7
 ip unnumbered Loopback0
 ip pim sparse-mode
 ipv6 unnumbered Loopback0
 ipv6 enable
 ipv6 mld join-group FF38:40:2006:DEAD:BEEF:CAFE:0:1
 ipv6 ospf 1 area 1
 ipv6 ospf mtu-ignore
 tunnel source Dialer1
 tunnel destination dynamic
 tunnel protection ipsec profile FlexVPN_IPsec_Profile
!
interface Tunnel1
 no ip address
!
interface GigabitEthernet0/1
 ip address 100.0.0.1 255.255.255.0
 duplex auto
 speed auto
!
interface Dot11Radio2/1
 ssid sol50_wifi
 power local 8
 ip address 192.168.111.254 255.255.255.0
 load-interval 30
 ipv6 enable
 no mop enabled
 no mop sysid
!
interface FastEthernet2/3
 no switchport
 no ip address
!
interface FastEthernet2/4
 no switchport
 no ip address
 shutdown
 ipv6 address 2011:DEAD:BEEF:CAFE::2/64
 ipv6 enable
 ipv6 mld join-group FF38:40:2006:DEAD:BEEF:CAFE:0:1
 ipv6 ospf 1 area 1
!
interface FastEthernet2/5
 no switchport
 ip address 172.27.126.11 255.255.255.128
!
interface FastEthernet2/6
 no switchport
 ip address 2.4.53.7 255.255.0.0
!
interface GigabitEthernet2/1
 no switchport
 ip address 1.0.0.11 255.255.255.0
 shutdown
 duplex auto
 speed auto
!
interface GigabitEthernet2/2
 description SPIRENT-ip address 201.0.0.1 255.255.255.0
 no switchport
 ip address 201.0.0.1 255.255.255.0
 load-interval 30
 duplex auto
 speed auto
!
interface Wpan5/1
 no ip address
 ip broadcast-address 0.0.0.0
 no ip route-cache
 ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 0
 ieee154 panid 99
 ieee154 ssid migration_soltn
 ieee154 txpower 2
 outage-server cenbu-nms1.ipv6lab.com
 rpl dag-lifetime 60
 rpl dio-min 18
 rpl version-incr-time 120
 authentication host-mode multi-auth
 authentication port-control auto
 ipv6 address 2006:DEAD:BEEF:CAFE::/64
 ipv6 dhcp relay destination  2001:64::C0A8:647D
 ipv6 ospf 1 area 1
 dot1x pae authenticator
 mesh-security max-active-key-exchange 10
 mesh-security max-active-authentication 15
 mesh-security authentication-timeout 45
!
interface Cellular3/1
 ip address negotiated
 ip virtual-reassembly in
 encapsulation slip
 load-interval 30
 dialer in-band
 dialer pool-member 1
 dialer idle-timeout 0
 no peer default ip address
 async mode interactive
 routing dynamic
!
interface Vlan1
 no ip address
!
interface Async1/1
 no ip address
 encapsulation raw-tcp
!
interface Async1/2
 no ip address
 encapsulation scada
!
interface Dialer1
 ip address negotiated
 ip virtual-reassembly in
 encapsulation slip
 dialer pool 1
 dialer idle-timeout 0
 dialer string hspa-R7
 dialer persistent
!
!
router ospfv3 1
 !
 address-family ipv6 unicast
  redistribute connected route-map WPAN
  router-id 2.0.0.7
 exit-address-family
!
router ospf 1
 network 1.0.0.0 0.0.0.255 area 1
 network 20.211.0.11 0.0.0.0 area 1
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http secure-ciphersuite aes-128-cbc-sha aes-256-cbc-sha dhe-aes-128-cbc-sha dhe-aes-256-cbc-sha
ip http secure-client-auth
ip http secure-port 8443
ip http secure-trustpoint LDevID
ip http max-connections 2
ip http timeout-policy idle 600 life 86400 requests 3
ip http client connection timeout 5
ip http client connection retry 5
ip http client source-interface Loopback0
ip http client secure-ciphersuite aes-128-cbc-sha aes-256-cbc-sha dhe-aes-128-cbc-sha dhe-aes-256-cbc-sha
!
ip route 10.28.29.227 255.255.255.255 172.27.126.1
ip route 101.0.0.100 255.255.255.255 192.168.160.1
ip route 101.0.0.101 255.255.255.255 192.168.161.1
ip route 101.0.0.102 255.255.255.255 192.168.162.1
ip route 170.0.0.2 255.255.255.255 192.168.161.1
ip route 171.70.60.115 255.255.255.255 172.27.126.1
ip route 172.27.167.0 255.255.255.128 172.27.126.1
ip route 173.36.248.197 255.255.255.255 Dialer1
ip route 173.36.248.224 255.255.255.255 Dialer1
ip route 173.36.248.225 255.255.255.255 Dialer1
ip route 192.168.100.121 255.255.255.255 192.168.160.1
ip route 192.168.100.168 255.255.255.255 192.168.160.1
ip route 223.255.254.252 255.255.255.255 2.4.0.1
!
ip access-list standard FlexVPN_Client_IPv4_LAN
 permit 20.211.0.11
!
dialer-list 1 protocol ip permit
ipv6 pim rp-address 2333::1
!
route-map WPAN permit 10
 match interface Wpan5/1
!
!
snmp-server group cgnms v3 priv 
snmp-server group cg-nms-administrator v3 priv 
snmp-server ifindex persist
snmp-server trap-source Loopback0
snmp-server enable traps snmp linkdown linkup coldstart
snmp-server enable traps flash removal
snmp-server enable traps flash low-space
snmp-server enable traps cisco-sys heartbeat
snmp-server enable traps auth-framework auth-fail
snmp-server enable traps c3g
snmp-server enable traps envmon status
snmp-server enable traps wpan
snmp-server enable traps aaa_server
snmp-server enable traps entity-ext
snmp-server enable traps fru-ctrl
snmp-server enable traps mempool
snmp-server host 2001:C1::C0A8:C10E version 3 priv cg-nms-administrator 
!
radius server nps-radius
 address ipv4 192.168.100.121 auth-port 1645 acct-port 1646
 key Cisco123
!
!
!
ipv6 access-list FlexVPN_Client_IPv6_LAN
 sequence 20 permit ipv6 host 2001:420:7BF:7E8::B any
!
control-plane
!
!
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
line 1/1
 raw-socket tcp server 5001
 transport preferred none
 transport input telnet
 stopbits 1
line 1/2
 transport preferred none
 transport input telnet
 stopbits 1
line 1/3 1/6
 transport preferred none
 transport input all
 transport output all
 stopbits 1
line 3/1
 script dialer hspa-R7
 modem InOut
 no exec
 transport input telnet
 transport output all
 rxspeed 21600000
 txspeed 5760000
line vty 0 4
 exec-timeout 0 0
 privilege level 15
 length 0
 transport input all
 transport output all
!
ntp server 192.168.100.250
wsma agent exec
 profile exec
 profile cgmsexec
!
wsma agent config
 profile config
!
wsma agent filesys
 profile filesys
!
!
wsma profile listener exec
 transport https path /wsma/exec
!
wsma profile listener cgmsexec
 transport http path /cgmsexec
!
wsma profile listener config
 transport https path /wsma/config
!
wsma profile listener filesys
 transport https path /wsma/filesys
!
wsma profile listener cgmslisten
cgna gzip
cgna geo-fence interval 1
cgna geo-fence active
cgna heart-beat interval 15
cgna heart-beat active
!
cgna profile cg-nms-tunnel
 add-command show hosts | format flash:/managed/odm/cg-nms.odm
 add-command show ipv6 interface | format flash:/managed/odm/cg-nms.odm
 add-command show interfaces | format flash:/managed/odm/cg-nms.odm
 add-command show version | format flash:/managed/odm/cg-nms.odm
 interval 10
 url https://cenbu-tps1.ipv6lab.com:9120/cgna/ios/tunnel
 gzip
!
cgna profile cg-nms-register
 add-command show hosts | format flash:/managed/odm/cg-nms.odm
 add-command show interfaces | format flash:/managed/odm/cg-nms.odm
 add-command show ipv6 dhcp | format flash:/managed/odm/cg-nms.odm
 add-command show ipv6 interface | format flash:/managed/odm/cg-nms.odm
 add-command show platform gps location | format flash:/managed/odm/cg-nms.odm
 add-command show platform hypervisor | format flash:/managed/odm/cg-nms.odm
 add-command show sd-card password status | format flash:/managed/odm/cg-nms.odm
 add-command show snmp mib ifmib ifindex | format flash:/managed/odm/cg-nms.odm
 add-command show tpm application list | format flash:/managed/odm/cg-nms.odm
 add-command show version | format flash:/managed/odm/cg-nms.odm
 interval 10
 url https://cenbu-nms1.ipv6lab.com:9121/cgna/ios/registration
 gzip
!
cgna profile cg-nms-periodic
 add-command show version | format flash:/managed/odm/cg-nms.odm
 add-command show environment temperature | format flash:/managed/odm/cg-nms.odm
 add-command show hosts | format flash:/managed/odm/cg-nms.odm
 add-command show interfaces | format flash:/managed/odm/cg-nms.odm
 add-command show ipv6 dhcp | format flash:/managed/odm/cg-nms.odm
 add-command show ipv6 interface | format flash:/managed/odm/cg-nms.odm
 add-command show snmp mib ifmib ifindex | format flash:/managed/odm/cg-nms.odm
 add-command show platform hypervisor | format flash:/managed/odm/cg-nms.odm
 add-command show sd-card password status | format flash:/managed/odm/cg-nms.odm
 add-command show platform gps location | format flash:/managed/odm/cg-nms.odm
 add-command show raw-socket tcp sessions | format flash:/managed/odm/cg-nms.odm
 add-command show raw-socket tcp statistics | format flash:/managed/odm/cg-nms.odm
 add-command show scada tcp | format flash:/managed/odm/cg-nms.odm
 add-command show scada statistics | format flash:/managed/odm/cg-nms.odm
 add-command show tpm application list | format flash:/managed/odm/cg-nms.odm
 add-command show controllers dot16radio 6/1 | format flash:/managed/odm/cg-nms.odm
 add-command show interfaces dot16radio 6/1 association | format flash:/managed/odm/cg-nms.odm
 add-command show wpan 5/1 hardware version | format flash:/managed/odm/cg-nms.odm
 add-command show cellular 3/1 all | format flash:/managed/odm/cg-nms.odm
 interval 5
 url https://cenbu-nms1.ipv6lab.com:9121/cgna/ios/metrics
 gzip
 active
!
!
!
cgna exec-profile cgdm-dashboard-profile
 add-command show inventory | format flash:/managed/odm/cg-dm.odm
 add-command show module | format flash:/managed/odm/cg-dm.odm
 add-command show platform led | format flash:/managed/odm/cg-dm.odm
 add-command show platform led summary | format flash:/managed/odm/cg-dm.odm
 add-command show processes cpu | format flash:/managed/odm/cg-dm.odm
 add-command show memory statistics | format flash:/managed/odm/cg-dm.odm
 interval 10
 exec-count 1
!
cgna exec-profile cgdm-minidashboard-profile
 add-command show version | format flash:/managed/odm/cg-dm.odm
 add-command show inventory | format flash:/managed/odm/cg-dm.odm
 add-command show environment temperature | format flash:/managed/odm/cg-dm.odm
 add-command dir | format flash:/managed/odm/cg-dm.odm
 add-command show platform hypervisor | format flash:/managed/odm/cg-dm.odm
 interval 10
 exec-count 1
!
event manager environment ZTD_SCEP_CGNA_Profile cg-nms-tunnel
event manager environment ZTD_SCEP_LDevID_trustpoint_name LDevID
event manager directory user policy "flash:/eem"
event manager policy tm_ztd_scep.tcl type system
event manager policy cg-nms-eem.tcl
!
end
CGR-JAF1626AQED#

SOL-ASR-7# show run brief
Building configuration...
Current configuration : 5512 bytes
!
! Last configuration change at 10:38:26 PST Fri May 16 2014 by admin
! NVRAM config last updated at 13:44:36 PST Thu May 15 2014 by admin
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime localtime
no platform punt-keepalive disable-kernel-core
!
hostname SOL-ASR-7
!
boot-start-marker
boot system flash:asr1000rp1-adventerprisek9.03.11.00.S.154-1.S-std.bin
boot-end-marker
!
aqm-register-fnf
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
no logging console
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local 
aaa authorization network FlexVPN_Author local 
!
!
!
!
!
aaa session-id common
clock timezone PST -8 0
!
!
!
!
!
!
!
no ip domain lookup
ip domain name ipv6lab.com
!
!
!
ipv6 unicast-routing
ipv6 multicast-routing
!
!
!
!
!
!
!
subscriber templating
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
crypto pki trustpoint LDevID
 enrollment retry count 10
 enrollment retry period 2
 enrollment mode ra
 enrollment profile LDevID
 serial-number
 ip-address none
 password
 fingerprint F23314787BD98B99AF1FE0B2D338961D125EAE51
 revocation-check none
 rsakeypair LDevID
!
crypto pki profile enrollment LDevID
 enrollment url  http://192.168.100.120/certsrv/mscep/mscep.dll
!
!
!
crypto pki certificate map FlexVPN_Cert_Map 1
 issuer-name co cn = ipv6lab-sol-radius1-ca
!
crypto pki certificate chain LDevID
 certificate 4B8801480001000000FC
 certificate ca 2539E6B5CFF2FB894AC90A73EA69A645
spanning-tree extend system-id
!
username admin privilege 15 password 0 cisco
!
redundancy
 mode none
!
crypto ikev2 authorization policy FlexVPN_Author_Policy 
 route set interface
 route set access-list FlexVPN_Client_Default_IPv4_Route
 route set access-list ipv6 FlexVPN_Client_Default_IPv6_Route
!
crypto ikev2 redirect gateway init
crypto ikev2 proposal FlexVPN_IKEv2_Proposal 
 encryption aes-cbc-128
 integrity sha1
 group 5
!
crypto ikev2 policy FLexVPN_IKEv2_Policy 
 proposal FlexVPN_IKEv2_Proposal
!
!
crypto ikev2 profile FlexVPN_IKEv2_Profile
 match certificate FlexVPN_Cert_Map
 identity local dn 
 authentication remote rsa-sig
 authentication local rsa-sig
 pki trustpoint LDevID
 aaa authorization group cert list FlexVPN_Author FlexVPN_Author_Policy
 virtual-template 1
!
!
crypto ikev2 cluster
 port 2000
 standby-group group1
 slave priority 90
 slave max-session 10
 no shutdown
!
!
cdp run
!
ip tftp source-interface GigabitEthernet0/0/3
ip ssh version 2
!
! 
!
!
!
!
!
!
crypto ipsec transform-set AES_128_SHA1 esp-aes esp-sha-hmac 
 mode transport
!
crypto ipsec profile FlexVPN_IPsec_Profile
 set transform-set AES_128_SHA1 
 set ikev2-profile FlexVPN_IKEv2_Profile
 responder-only
!
!
!
!
!
!
! 
!
interface Loopback0
 ip address 20.0.0.3 255.255.0.0
 ipv6 address 2003:20::1/128
 ipv6 address 2333::1/64
 ipv6 enable
 ipv6 ospf 1 area 1
!
interface GigabitEthernet0/0/0
 ip address 173.36.248.224 255.255.255.192
 negotiation auto
 cdp enable
!
interface GigabitEthernet0/0/1
 ip address 10.0.2.70 255.255.255.0
 ip pim sparse-mode
 negotiation auto
 ipv6 address 2001:A02::A00:246/64
 ipv6 enable
 ipv6 ospf 1 area 1
 ipv6 ospf mtu-ignore
 cdp enable
!
interface GigabitEthernet0/0/2
 ip address 11.0.0.70 255.255.255.0
 standby 1 ip 11.0.0.100
 standby 1 priority 110
 standby 1 name group1
 negotiation auto
 ipv6 enable
 cdp enable
!
interface GigabitEthernet0/0/3
 ip address 11.0.1.70 255.255.255.0
 negotiation auto
 cdp enable
!
interface GigabitEthernet0/1/0
 description WIMAX-BASESTATION
 ip address 192.10.0.88 255.255.255.0
 negotiation auto
!
interface GigabitEthernet0/1/1
 no ip address
 ip pim sparse-mode
 negotiation auto
 ipv6 address 2010:DEAD:BEEF:CAFE::1/64
 ipv6 enable
 ipv6 ospf 1 area 1
 ipv6 ospf mtu-ignore
!
interface GigabitEthernet0/1/2
 no ip address
 ip pim sparse-mode
 negotiation auto
 ipv6 address 2011:DEAD:BEEF:CAFE::1/64
 ipv6 enable
 ipv6 ospf 1 area 1
 ipv6 ospf mtu-ignore
!
interface GigabitEthernet0/1/3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/1/4
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0
 vrf forwarding Mgmt-intf
 no ip address
 shutdown
 negotiation auto
!
interface Virtual-Template1 type tunnel
 description ip pim sparse-mode
 ip unnumbered Loopback0
 ipv6 address autoconfig
 ipv6 unnumbered Loopback0
 ipv6 enable
 ipv6 ospf 1 area 1
 ipv6 ospf mtu-ignore
 tunnel protection ipsec profile FlexVPN_IPsec_Profile
!
router ospf 1
 redistribute static subnets
 network 10.0.2.0 0.0.0.255 area 1
 network 11.0.0.0 0.0.0.255 area 1
 network 11.0.1.0 0.0.0.255 area 1
 network 173.36.0.0 0.0.255.255 area 1
 network 192.10.0.0 0.0.0.255 area 1
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip route 10.0.0.0 255.255.255.0 173.36.248.193
!
ip access-list standard FlexVPN_Client_Default_IPv4_Route
 permit any
!
ipv6 route 2005:DEAD:BEEF:CAFE::/64 2001:420:7BF:7E8::1
ipv6 route 2006:DEAD:BEEF:CAFE::/64 2001:420:7BF:7E8::B
ipv6 local pool IPV6_POOL 2001:10::/64 64
ipv6 pim rp-address 2333::1
ipv6 router ospf 1
 redistribute static
!
!
!
!
!
!
ipv6 access-list FlexVPN_Client_Default_IPv6_Route
 permit ipv6 any any
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 privilege level 15
 transport input all
 transport output all
!
ntp server 192.168.100.250
netconf max-sessions 16
netconf ssh
!
end
SOL-ASR-7#