Cisco Network Function Virtualization Infrastructure Software Configuration Guide, Release 26.2 and Later

PDF

Cisco Network Function Virtualization Infrastructure Software Configuration Guide, Release 26.2 and Later

Networking

Updated: June 29, 2026

Want to summarize with AI?

Describes the fundamental concepts and protocols used to connect devices and enable communication between computers, servers, and other networked equipment in local and wide area network environments.

Bridges

A bridge is a network connectivity component that

enables NFVIS connectivity through IPv4 or IPv6 configurations such as Static IP, DHCP, SLAAC, or VLAN
can have a port or port channel associated with it, and
provides default LAN and WAN connectivity on NFVIS installations.

Bridge configuration information

The IP configuration on bridges and the show bridge-settings command were added in NFVIS 3.10.1 release.

NFVIS is installed with LAN and WAN bridges by default. A service bridge can also be created. On all NFVIS systems, LAN-br and WAN-br are generated by default and populated with the appropriate ports for that system. On ENCS 5000 series platforms, wan2-br is also generated by default for the dual WAN initialization. The default LAN bridge is configured with a static IP address 192.168.1.1 and the WAN bridges uses DHCP for initial NFVIS connectivity.

IPv4 bridge configuration:

If the system has a DHCP server connected to a bridge with DHCP configured, the bridge receives the IP address from the server. You can use this IP address to connect to the system.
You can also connect to the server locally with an ethernet cable using a static IP address. To connect to the device remotely using a static IP address, you must configure the default gateway or setup an appropriate static route.
DHCP and a default gateway cannot be configured on NFVIS simultaneously. NFVIS only supports one system level default gateway. If DHCP is configured, the default gateway is assigned to the system through the DHCP server. Also, only one bridge can be configured with DHCP at any time.

IPv6 bridge configuration:

IPv6 can be configured in static, DHCP stateful, and Stateless Auto configuration (SLAAC) modes. By default, DHCP IPv6 stateful is configured on the WAN interface.
If DHCP stateful is not enabled on the network, the router advertisement (RA) flag decides which state the network stays in. If the RA shows the Managed (M) flag, then the network stays in DHCP mode, even if there is no DHCP server in the network. If the RA shows the Other (O) flag, then the network switches from DHCP server to SLAAC mode.
SLAAC provides IPv6 address and a default gateway. Stateless DHCP is enabled in the SLAAC mode. If the server has DNS and domain configured, then SLAAC also provides those values through stateless DHCP.
Similar to IPv4, IPv6 DHCP and IPv6 default gateway cannot be configured on the system simultaneously, nor can stateful and stateless IPv6 DHCP. Also, only one bridge can be configured with either stateful or stateless IPv6 DHCP at any time.

Create bridges

This task allows you to create and configure a new bridge in the system.

Use this procedure when you need to establish a new bridge configuration for network connectivity.

Procedure

	1.	Configure a new bridge. Example: `configure terminal bridges bridge my-br commit`
	2.	Verify the bridge generation using the show bridge-settings command. Example: `nfvis# show bridge-settings my-br ip-info interface ip-info interface my-br`

The bridge is successfully created and configured. The verification command displays the bridge settings and interface information.

Configure bridge port

Configure a bridge port to establish the connection between a bridge and a physical interface or port channel.

A bridge can be tied to a physical interface by applying the port configuration. A bridge can have as many ports as are available, however a port must be unique to at most one bridge. If a port channel is applied to a bridge, it must be the only port configuration on that bridge.

Procedure

	1.	Configure a port on a bridge. Example: `configure terminal bridges bridge my-br port eth3 commit`
	2.	Configure a port channel on a bridge. Example: `configure terminal bridges bridge my-br port pc1 commit`
	3.	Verify the port settings applied to a bridge using the support ovs vsctl command. Example: `nfvis# support ovs vsctl list-ports my-br eth3` The same command can be used to verify the port channel settings applied to a bridge: `nfvis# support ovs vsctl list-ports my-br bond-pc1`

The bridge port is configured and can be verified using the support ovs vsctl command to display the configured ports.

Configure bridge IP connectivity

This task enables you to establish network connectivity for bridges by configuring IP addressing methods, VLAN isolation, and MAC learning parameters on Cisco NFVIS systems.

Bridge IP connectivity configuration is essential for proper network operation in NFVIS environments. You can configure different connectivity options including DHCP for automatic IP assignment, static IP for fixed addressing, VLAN tagging for traffic isolation, and MAC aging time for optimal MAC address table management.

Before you begin

Follow these steps to configure bridge IP connectivity:

Procedure

	1.	Configure DHCP on the bridge if automatic IP assignment is required. DHCP configuration can be applied to any bridge if no other bridge on the system has DHCP configured, and default gateway is not applied under system settings. DHCP configuration on a bridge automatically triggers a DHCP renew request from the bridge. For an additional DHCP renew trigger, use the hostaction bridge-DHCP-renew command. Example: `configure terminal bridges bridge my-br dhcp commit` To verify the DHCP settings applied to a bridge, use the show bridge-settings <br_name> DHCP command. `nfvis# show bridge-settings my-br dhcp dhcp enabled dhcp offer true dhcp interface my-br dhcp fixed_address 10.10.10.14 dhcp subnet_mask 255.255.255.128 dhcp gateway 10.10.10.1 dhcp lease_time 7200 dhcp message_type 5 dhcp name_servers NA dhcp server_identifier 10.10.10.1 dhcp renewal_time 3600 dhcp rebinding_time 6300 dhcp vendor_encapsulated_options NA dhcp domain_name NA dhcp renew 2019-12-11T13:28:29-00:00 dhcp rebind 2019-12-11T14:17:12-00:00 dhcp expire 2019-12-11T14:32:12-00:00`
	2.	Configure a static IP address on the bridge if fixed IP assignment is required. An IPv4 address and subnet can be configured on any bridge which does not have DHCP configured. To enable routing outside of the subnet, apply the default gateway under system settings or confirgure system routes. Example: `configure terminal bridges bridge my-br ip address 172.25.220.124 255.255.255.0 commit` To verify the IPv4 settings applied to a bridge, use the show bridge-settings <br_name> ip_info command. `nfvis# show bridge-settings my-br ip_info ip-info interface my-br ip-info ipv4_address 172.25.220.124 ip-info netmask 255.255.255.0 ip-info link-local ipv6 address fe80::4e00:82ff:fead:e802 ip-info link-local ipv6 prefixlen 64 ip-info global ipv6 address:: ip-info global ipv6 prefix len0 ip-info mac_address 4c:00:82:ad:e8:02 ip-info mtu 9216 ip-info txqueuelen 1000`
	3.	Configure VLAN tagging on the bridge to isolate traffic. A VLAN is a method of creating independent logical networks within a physical network. VLAN tagging is the practice of inserting a VLAN ID into a packet header in order to identify which VLAN the packet belongs to. You can configure a VLAN tag on the WAN bridge (WAN-br) interface to isolate Cisco NFVIS management traffic from VM traffic. You can also configure VLAN on any bridge on the system (wan2-br for ENCS5400 or ENCS 5100, and user-br for all systems) By default, WAN bridge and LAN bridge are in trunk mode and allows all VLANs. When you configure native VLAN, you must also configure all the allowed VLANs at the same time. The native VLAN becomes the only allowed VLAN if you do not configure all the VLANs. If you want a network that allows only one VLAN, then create another network on top of WAN-net and LAN-net and make it access network. Note You cannot have the same VLAN configured for the NFVIS management and VM traffc. For more details on the VLAN configuration, see the Understanding and Configuring VLANs module in the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide. Example: `configure terminal bridges bridge wan-br vlan 120 commit` To verify the VLAN settings applied to a bridge, use the show bridge-settings my-br VLAN command. `nfvis# show bridge-settings my-br vlan vlan tag 10`
	4.	Configure MAC aging time on the bridge to optimize MAC address table management. MAC aging time specifies the time at which a MAC address entry ages out of the MAC address table. The max-aging-time specifies the maximum number of seconds to retain a MAC learning entry for which no packets have been seen. The default value is 300 seconds. Example: `configure terminal bridges bridge my-br mac-aging-time 600 commit` To verify the MAC aging time settings applied to a bridge, use the show bridge-settings <br_name> MAC-aging-time command. `nfvis# show bridge-settings my-br mac-aging-time mac-aging-time 600`

The bridge is configured with the appropriate IP connectivity settings including DHCP or static IP addressing, VLAN tagging for traffic isolation, and optimized MAC aging time for efficient network operation.

Physical network interface cards

Configure LLDP

LLDP enables network devices to advertise their identity, capabilities, and neighbors, allowing connected devices to see each other as neighbors.

LLDP is supported on NFVIS. The Link Layer Discovery Protocol (LLDP) is used by network devices for advertising their identity, capabilities, and neighbors. You can configure LLDP on a PNIC which is not a port channel or a DPDK port. By default, LLDP is disabled for all PNICs.

LLDP information is sent by devices from each of their interfaces at a fixed interval, in the form of an Ethernet frame. Each frame contains one LLDP Data Unit (LLDPDU). Each LLDPDU is a sequence of type-length-value (TLV) structures.

LLDP is enabled in transmit and receive mode. The LLDP agent can transmit the local system capabilities and status information and receive the remote system's capabilities and status information.

If LLDP is enabled on two connected devices, they can see each other as neighbors.

Note

LLDP packets are not propagated to VMs. LLDP cannot be enabled on port channel or DPDK ports.

Procedure

	1.	To enable LLDP on a PNIC: Example: `configure terminal pnic eth0 lldp enabled commit`
	2.	To disable LLDP on a PNIC: Example: `configure terminal pnic eth0 lldp disabled commit`
	3.	Use the show LLDP neighbors command to display the peer information: Example: `nfvis# show lldp neighbors eth0 -------------------------------------------------------------- DEVICE NAME ID HOLDTIME CAPS PLATFORM PORTID DESCRIPTION -------------------------------------------------------------- eth0 Switch1623 120 Bridge, Router Cisco IOS Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 15.0(1)EX3, RELEASE SOFTWARE (fc2)Ifname: Gi1/0/4GigabitEthernet1/0/4`
	4.	Use the show LLDP stats command to display the tx and rx information: Example: `nfvis# show lldp stats eth0 ------------------------------------------------------------------ TX DISCARD ERROR RX DISCARDED UNREC NAME FRAMES RX RX FRAMES TLVS TLVS AGEOUTS ------------------------------------------------------------------ eth0 23 0 0 19667 0 0 0`

LLDP is configured on the specified PNIC, enabling the device to exchange identity and capability information with connected neighbors.

Configure the administrative status of a port

Configure the administrative status of a port to control its operational state.

Administrative status provides a mechanism for configuring the administrative status of a port. It can be set to up or down and the default setting is on.

Note

Administrative status cannot be enabled on port channel.

Procedure

	1.	Configure the admin status on a pnic for a VM. Example: `configure terminal pnic GE0-1 admin status down commit`
	2.	Verify the admin status configuration. Use the show pnic command to verify the admin status configuration. Use the show pnic link_state command to verify the admin state configuration. Example: `nfvis# show pnic GE0-1 link_state link_state down` Note Speed and duplex values in show pnic and ethtool outputs may differ depending on the peer device's interface speed and duplex settings.

The administrative status of the port has been configured and verified. The port's operational state is now controlled according to the specified administrative setting.

Configure speed, duplex and autonegotiation

This task enables you to configure speed and duplex settings on Physical Network Interface Cards (PNICs) to control autonegotiation behavior and ensure optimal network connectivity.

NFVIS supports autonegotiation by default on all PNICs. Speed and duplex are set to auto mode to indicate autonegotiation is enabled.

Autonegotiation allows a PNIC to communicate with the device on the other end of the link to determine the optimal duplex mode and speed for the connection. Autonegotiation can be turned off by configuring speed and duplex. Supported Ethernet speed is 10 Mbps, 100 Mbps, and 1G and 10 G.

Duplex mode displays the data flow on the interface. Duplex mode on an interface can be full or half duplex. A half-duplex interface can only transmit or receive data at any given time and a full-duplex interface can send and receive data simultaneously.

When autonegotiation is enabled on a port, it does not automatically determine the configuration of the port on the other side of the ethernet cable to match it. Autonegotiation only works if it is enabled on both sides of the link. If one side of a link has auto-negotiation enabled, and the other side of the link does not, then autonegotiation cannot determine the speed and duplex configurations of the other side. If autonegotiation is enabled on the other side of the link, the two devices decide together on the best speed and duplex mode. Each interface advertises the speed and duplex mode at which it can operate, and the best match is selected. Higher speed and full duplex is the preferred mode.

If one side of a link does not have autonegotiation enabled, then the speed and duplex on both sides must match so that the data can transmit without collisions. Autonegotiation fails on 10/100 links, if one side of the link has been set to 100/full, and the other side has been set to autonegotiation which is 100/half.

Procedure

	1.	To disable autonegotiation on a PNIC, configure speed and duplex: Example: `configure terminal pnic GE0-0 speed 100 duplex full commit`
	2.	To enable autonegotiation on a PNIC: Example: `configure terminal pnic GE0-0 speed auto duplex auto commit`
	3.	To configure speed and duplex with non auto values: Example: `configure terminal pnic GE0-0 speed 100 duplex full commit`
	4.	Use the show PNIC GE0-0 operational-speed , show PNIC GE0-0 operational-duplex and show PNIC GE0-0 autoneg to verify the configurations. Example: `nfvis# show pnic GE0-0 operational-speed operational-speed 100` `nfvis# show pnic GE0-0 operational-duplex operational-duplex full` `nfvis# show pnic GE0-0 autoneg autoneg off`
	5.	To verify the PNIC speed and duplex configurations, use the show notification stream NFVIS Event command. Example: notification event Time 2019-12-16T22:52:49.238604+00:00 nfvisEvent user_id admin config_change true transaction_id 0 status FAILURE status_code 0 status_message Pnic GE0-1 speed did not update successfully details NA event_type PNIC_SPEED_UPDATE severity INFO host_name nfvis ! ! notification event Time 2019-12-16T22:53:05.01598+00:00 nfvisEvent user_id admin config_change true transaction_id 0 status SUCCESS status_code 0 status_message Pnic GE0-1 duplex updated successfully:full details NA event_type PNIC_DUPLEX_UPDATE severity INFO host_name nfvis ! !

The PNIC speed and duplex settings are configured according to your requirements, and autonegotiation is either enabled or disabled as specified.

Port channels

A port channel is a logical link that

combines individual links into a group to provide the aggregate bandwidth of up to eight physical links
increases bandwidth and redundancy and load balances traffic between the member ports, and
switches traffic from a failed port to the remaining member ports when a member port fails.

Port channel configuration requirements

Port channel configuration has these requirements:

Port channels must have at least two ports and can be configured using static mode or Link Access Control Protocol (LACP).
Configuration changes that are applied to the port channel are applied to each member port of the port channel.
A port channel can also be added to a bridge. When a port channel has two or more than two members and the port channel is added to a bridge, a bond is created.
A port can be a member of only one port channel and all the ports in a port channel must be compatible.
Each port must use the same speed and operate in full-duplex mode.

Note

The Physical Network Interface Controllers (PNICs) added to the port channel should be uniform. For example, all the PNICs associated with the port channel must have SRIOV VFs or they should not have SRIOV VFs.

The Data Plane Development Kit (DPDK) can be associated only with port channels that have no SRIOV VFs attached to them. When a port channel is attached to a bridge and if the port channel has SRIOV VFs attached, the bridge gets automatically downgraded to a non-DPDK bridge.

Port channel bond modes include:

active-backup: In this mode, one of the ports in the aggregated link is active and all others ports are in the standby mode.
balance-slb: In this mode, load balancing of traffic is done based on the source MAC address and VLAN.
balance-tcp: In this mode, 5-tuple (source and destination IP, source and destination port, protocol) is used to balance traffic across the ports in an aggregated link.

Port channel LACP modes include:

off: Indicates that no mode is applicable.
active: Indicates that the port initiates transmission of LACP packets.
passive: Indicates that the port only responds to the LACP packets that it receives but does not initiate the LACP negotiation.

Configure a port channel

Port channels provide link aggregation to increase bandwidth and provide redundancy between network devices. This task allows you to create and manage port channels for optimal network performance.

Port channels combine multiple physical interfaces into a single logical interface. You can add ports to existing port channels and integrate them into bridge configurations for enhanced network connectivity.

Procedure

	1.	Create a port channel. Example: `configure terminal pnic egroup type port_channel lacp_type active bond_mode balance-tcp trunks 10,20 commit` Note Ensure to commit the changes.
	2.	Add ports to the port channel. You can add a port to a new port channel or a port channel that already contains ports. Adding GE0-0 and GE0-1 to egroup: Example: `configure terminal pnic GE0-0 member_of egroup commit` Note Ensure to commit the changes. Example: `configure terminal pnic GE0-1 member_of egroup commit` Note Ensure to commit the changes.
	3.	Add the port channel to a bridge. You can add a port channel to a new bridge or an existing bridge. When a port channel is added to a bridge, a bond is added for the port channel. Example: `configure terminal bridges bridge test-br port egroup commit` Note Ensure to commit the changes.
	4.	Verify port channel configurations using the show port-channel command. Example: nfvis# show port-channel ----bond-egroup---- bond_mode: balance-tcp bond may use recirculation: yes, Recirc-ID : 1 bond-hash-basis: 0 updelay: 0 ms downdelay: 0 ms next rebalance: 6921 ms lacp_status: negotiated >>>this should be negotiated to indicate port channel is active lacp_fallback_ab: false active slave mac: 38:90:a5:1b:fe:0d(GE0-1)>>should indicate active slave mac address slave GE0-0: enabled may_enable: true slave GE0-1: enabled active slave >>>active slaveport should show active may_enable: true

The port channel is successfully configured with the specified ports and added to the bridge. The verification output displays the port channel status, including LACP negotiation status and active slave information.

What to do next

Before deleting a port channel, you must remove all members assigned to the port channel. If the port channel is configured on the bridge, you must remove the port channel from the bridge.

Enable promiscuous mode

NFVIS allows enabling promiscuous mode on interfaces. Enabling promiscuous mode on an interface can be used to monitor all incoming packets on the interface.

When an interface is connected to a bridge, NFVIS enables promiscuous mode on the interface.

Procedure

	1.	Enable promiscuous mode on the interface. Example: `nfvis# config terminal nfvis(config)# pnic GE0-0 promiscuous enabled nfvis(config-pnic-GE0-0)# commit`
	2.	Verify that promiscuous mode has been enabled. Use the show pnic GE0-0 operational-promiscuous command to verify if promiscuous mode has been enabled.

Promiscuous mode is enabled on the interface, allowing monitoring of all incoming packets.

Configure dynamic SR-IOV

Configure dynamic SR-IOV to control SR-IOV functionality on Physical Network Interface Controllers, allowing you to enable or disable SR-IOV and manage SR-IOV networks based on virtual function requirements.

Dynamic Single-root input/output virtualization (SR-IOV) allows you to enable or disable SR-IOV on a Physical Network Interface Controller (PNIC). To disable SR-IOV on a PNIC, set the SR-IOV value to 0. To enable SR-IOV on a PNIC, set the SR-IOV value between 1 and the maximum number of virtual functions (maxvfs) supported on that PNIC. You can also create and delete SR-IOV networks based on the number of virtual functions (numvfs) set on that PNIC while enabling SR-IOV. The existing fresh installation behavior has not changed. Each PNIC has a number of VFs and SR-IOV networks created by default. You can use CLI, API, or the GUI to enable and disable SR-IOV on a PNIC and to create and delete SR-IOV networks.

Note

The number of SR-IOV networks, numvfs or inusevfs, created per PNIC on fresh installation of NFVIS depends on the link speed of that particular PNIC.

Procedure

	1.	Disable SR-IOV on a PNIC by ensuring all SR-IOV networks on the PNIC are deleted and the PNIC is not attached to a bridge. Example: `configure terminal no pnic eth0-1 sriov commit`
	2.	Enable SR-IOV on a PNIC by ensuring the PNIC supports SR-IOV, the numvfs field is populated with a value less than the maximum number of virtual functions supported, and the PNIC is not attached to a bridge. Example: `configure terminal pnic eth0-1 sriov numvfs 20 commit` To display the SR-IOV status of all PNICs, use the show PNIC SRIOV command. To display the SR-IOV state of an individual PNIC use the show PNIC eth0-1 SRIOV command.
	3.	Create SR-IOV networks when the PNIC has SR-IOV enabled and configured with numvfs, using the format <pnic_name>-SRIOV-<num> where <num> is greater than 0 and less than the number of VFs. To create an SR-IOV network in trunk mode: Example: `configure terminal networks network eth0-1-SRIOV-1 sriov true commit` To create an SR-IOV network in access mode: Example: `configure terminal networks network eth0-1-SRIOV-1 sriov true trunk false vlan 30 commit`
	4.	Delete SR-IOV networks by ensuring no VMs are attached to the network. Example: `configure terminal no networks network eth0-1-SRIOV-1 commit` To verify the system networks, use the show system networks command.

SR-IOV is successfully configured on the PNIC with the appropriate virtual functions and networks created or deleted as specified.

System routes

A system route is a static routing configuration that

directs traffic that should not go through the default gateway
provides connectivity when certain destinations are not reachable through the default routes, and
updates the system routing table when configured.

System route configuration requirements

You can create a route by providing the destination and prefix length, but a valid route requires a specified device, a gateway or both. The gateway input represents the address of the nexthop router in the address family. The dev input is the name of the outbound interface for the static route.

Configure system routes

Configure additional static routes to enable network connectivity to specific destinations through designated gateways or devices.

System routes define how network traffic is directed to different destinations. Static routes provide explicit control over routing decisions for specific network segments.

Procedure

Configure the system routes using the following commands:

Example:


configure terminal
system routes route 172.25.222.024 gateway 172.25.221.1
system routes route 172.25.223.024 dev wan-br
commit

Verify the system routes configuration using the show system routes command.

Example:


nfvis# show system routes

DESTINATION    PREFIXLEN       STATUS
----------------------------------------
172.25.222.0      24           Success
172.25.223.0      24           Success

The system routes are configured and verified. The output displays the configured destinations with their prefix lengths and successful status.

Troubleshoot system route configuration errors

To troubleshoot errors in configured routes, use the show system routes command to identify the failed route. This example shows common failures with system routes:


nfvis# show system routes

DESTINATION      PREFIXLEN       STATUS
-------------------------------------------
172.25.222.0        24          Failure(1)
172.25.223.1        24          Failure(2)

You can find the cause for each error in the nfvos-confd log.

Network unreachable error:


Failure 1) result=RTNETLINK answers: Network is unreachable

This example indicates that the failure is caused because the network is unreachable. To resolve this issue you can either reconfigure the route with a reachable gateway or identify network connectivity issue.

Invalid argument error:


Failure 2)result=RTNETLINK answers: Invalid argument

This failure is caused due to a mismatch between the subnet address and the prefix length. To resolve this issue you can reconfigure the route with the correct subnet address (in this case 172.25.223.0 for prefix length of 24).

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.