The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter describes the Cisco Nexus 1000V commands that begin with the letter P.
To enable password-strength checking, use the password strength-check command. To disable the checking of password strength, use the no form of this command.
|
|
This example shows how to enable the checking of password strength:
This example shows how to disable the checking of password strength:
|
|
---|---|
Names a user role and places you in role configuration mode for that role. |
|
Displays the configuration for checking the password strength. |
|
To create an IPv4 access control list (ACL) rule that permits traffic matching its conditions, use the permit command. To remove a rule, use the no form of this command.
[ sequence-number ] permit protocol source destination [ dscp dscp | precedence precedence ]
no permit protocol source destination [ dscp dscp | precedence precedence ]
Internet Control Message Protocol (ICMP)
[ sequence-number ] permit icmp source destination [ icmp-message ] [ dscp dscp | precedence precedence ]
Internet Group Management Protocol (IGMP)
[ sequence-number ] permit igmp source destination [ igmp-message ] [ dscp dscp | precedence precedence ]
[ sequence-number ] permit ip source destination [ dscp dscp | precedence precedence ]
[ sequence-number ] permit tcp source [ operator port [ port ] | portgroup portgroup ] destination [ operator port [ port ] | portgroup portgroup ] [ dscp dscp | precedence precedence ]
[ sequence-number ] permit udp source [ operator port [ port ] | portgroup portgroup ] destination [ operator port [ port ] | portgroup portgroup ] [ dscp dscp | precedence precedence ]
A newly created IPv4 ACL contains no rules.
If you do not specify a sequence number, the device assigns to the rule a sequence number that is 10 greater than the last rule in the ACL.
IPv4 ACL configuration (config-acl)
|
|
When the device applies an IPv4 ACL to a packet, it evaluates the packet with every rule in the ACL. The device enforces the first rule that has conditions that are satisfied by the packet. When the conditions of more than one rule are satisfied, the device enforces the rule with the lowest sequence number.
You can specify the source and destination arguments in one of several ways. In each rule, the method you use to specify one of these arguments does not affect how you specify the other. When you configure a rule, use the following methods to specify the source and destination arguments:
This example shows how to specify the source argument with the IPv4 address and network wildcard for the 192.168.67.0 subnet:
This example shows how to specify the source argument with the IPv4 address and VLSM for the 192.168.67.0 subnet:
This syntax is equivalent to IPv4-address /32 and IPv4-address 0.0.0.0.
This example shows how to specify the source argument with the host keyword and the 192.168.67.132 IPv4 address:
The icmp-message argument can be the ICMP message number, which is an integer from 0 to 255. It can also be one of the following keywords:
When you specify the protocol argument as tcp, the port argument can be a TCP port number, which is an integer from 0 to 65535. It can also be one of the following keywords:
bgp —Border Gateway Protocol (179)
chargen —Character generator (19)
cmd —Remote commands (rcmd, 514)
domain —Domain Name Service (53)
drip —Dynamic Routing Information Protocol (3949)
ftp —File Transfer Protocol (21)
ftp-data —FTP data connections (2)
hostname —NIC hostname server (11)
irc —Internet Relay Chat (194)
nntp —Network News Transport Protocol (119)
pim-auto-rp —PIM Auto-RP (496)
pop2 —Post Office Protocol v2 (19)
pop3 —Post Office Protocol v3 (11)
smtp —Simple Mail Transport Protocol (25)
sunrpc —Sun Remote Procedure Call (111)
tacacs —TAC Access Control System (49)
uucp —UNIX-to-UNIX Copy Program (54)
When you specify the protocol argument as udp, the port argument can be a UDP port number, which is an integer from 0 to 65535. It can also be one of the following keywords:
biff —Biff (mail notification, comsat, 512)
bootpc —Bootstrap Protocol (BOOTP) client (68)
bootps —Bootstrap Protocol (BOOTP) server (67)
dnsix —DNSIX security protocol auditing (195)
domain —Domain Name Service (DNS, 53)
isakmp —Internet Security Association and Key Management Protocol (5)
mobile-ip —Mobile IP registration (434)
nameserver —IEN116 name service (obsolete, 42)
netbios-dgm —NetBIOS datagram service (138)
netbios-ns —NetBIOS name service (137)
netbios-ss —NetBIOS session service (139)
non500-isakmp —Internet Security Association and Key Management Protocol (45)
ntp —Network Time Protocol (123)
pim-auto-rp —PIM Auto-RP (496)
rip —Routing Information Protocol (router, in.routed, 52)
snmp —Simple Network Management Protocol (161)
sunrpc —Sun Remote Procedure Call (111)
tacacs —TAC Access Control System (49)
This example shows how to configure an IPv4 ACL named acl-lab-01 with rules permitting all TCP and UDP traffic from the 10.23.0.0 and 192.168.37.0 networks to the 10.176.0.0 network:
|
|
---|---|
To create a MAC access control list (ACL) rule that permits traffic matching its conditions, use the permit command. To remove a rule, use the no form of this command.
[ sequence-number ] permit source destination [ protocol ] [ cos cos-value ] [ vlan vlan-id ]
no permit source destination [ protocol ] [ cos cos-value ] [ vlan vlan-id ]
MAC ACL configuration (config-acl)
|
|
A newly created MAC ACL contains no rules.
If you do not specify a sequence number, the device assigns a sequence number that is 10 greater than the last rule in the ACL.
When the device applies a MAC ACL to a packet, it evaluates the packet with every rule in the ACL. The device enforces the first rule that has conditions that are satisfied by the packet. When the conditions of more than one rule are satisfied, the device enforces the rule with the lowest sequence number.
You can specify the source and destination arguments in one of two ways. In each rule, the method you use to specify one of these arguments does not affect how you specify the other. When you configure a rule, use the following methods to specify the source and destination arguments:
This example specifies the source argument with the MAC address 00c0.4f03.0a72:
This example specifies the destination argument with a MAC address for all hosts with a MAC vendor code of 00603e:
The protocol argument can be the MAC protocol number or a keyword. The protocol number is a four-byte hexadecimal number prefixed with 0x. Valid protocol numbers are from 0x0 to 0xffff. Valid keywords are the following:
This example shows how to configure a MAC ACL named mac-ip-filter with a rule that permits all IPv4 traffic between two groups of MAC addresses:
|
|
---|---|
To specify the interfaces that users assigned to this role can access, use the permit interface command.
To remove the policy restrictions, use the no form of this command.
permit interface interface-list
no permit interface interface-list
Interface(s) that can be accessed by users with a specified role. The list name is alphanumeric, case-sensitive, and can be up to 16 characters long. |
Interface configuration (config-role-interface)
|
|
Repeat this command to specify all interface lists that users assigned to this role are permitted to access.
This example shows how to specify ethernet 2/1-4 as interfaces that users assigned to this role can access:
This example shows how to remove the policy restrictions for ethernet 2/1-4:
|
|
---|---|
Enters the interface configuration mode and denies all interface access for the role. |
|
Specifies a user role and enters role configuration mode for the named role. |
|
To determine the network connectivity to another device using IPv4 addressing, use the ping command.
ping [ dest_ipv4_address | hostname | multicast multicast_group_add interface [ ethernet slot/port | loopback number | mgmt0 | port-channel channel_number | vethernet veth_ number ]] [ count { number | unlimited }] [ df-bit ] [ interval seconds ] [ packet-size bytes ] [ source src_ipv4_address ] [ timeout seconds ] [ vrf vrf_name ]
For the default values, see the “Syntax Description” section for this command.
|
|
To determine the network connectivity to another device using IPv6 addressing, use the ping6 command.
This example shows how to determine connectivity to another device using IPv4 addressing:
|
|
---|---|
Determines connectivity to another device using IPv6 addressing. |
To pin virtual Ethernet traffic to a specific subgroup, use the pinning id command. To remove the configuration, use the no form of this command.
Interface configuration mode (config-if)
Port profile configuration (config-port-prof)
|
|
This example shows how to pin virtual Ethernet interfaces to subgroup 3:
To configure Ethernet port channel load balance, use the port-channel load-balance ethernet command. To restore the default value, use the no form of this command.
port-channel load-balance ethernet { dest-ip-port | dest-ip-port-vlan | destination-ip-vlan | destination-mac | destination-port | source-dest-ip-port | source-dest-ip-port
-vlan | source-dest-ip-vlan | source-dest-mac | source-dest-port | source-ip-port | source-ip-port-vlan | source-ip-vlan | source-mac | source-port | source-virtual-port-id | vlan-only } [ module module ]
no port-channel load-balance ethernet { dest-ip-port | dest-ip-port-vlan | destination-ip-vlan | destination-mac | destination-port | source-dest-ip-port | source-dest-ip-port
-vlan | source-dest-ip-vlan | source-dest-mac | source-dest-port | source-ip-port | source-ip-port-vlan | source-ip-vlan | source-mac | source-port | source-virtual-port-id | vlan-only } [ module module ]
(Optional) Specifies a module to load balance independently. If you do not specify a module, the specified algorithm is applied to all device modules. |
|
|
If you do not specify a module, the algorithm is applied globally to all port channels.
If you specify a module, the algorithm is applied to all port channels in the specified module.
The per module configuration takes precedence over the algorithm configured globally.
If the traffic on a port channel is going only to a single MAC address and you load balance on a destination MAC address, the port channel always chooses the same link in that port channel. In this case, using source addresses or IP addresses might result in better load balancing.
This example shows how to specify the source port as the global algorithm for balancing loads on the interfaces in channel-groups:
n1000v(config)#
port-channel load-balance ethernet src-port
n1000v(config)#
This example shows how to configure the source IP load-balancing algorithm for port channels on module 5:
|
|
---|---|
To create a port profile and enter port profile configuration mode, use the port-profile command. To remove the port profile configuration, use the no form of this command.
port-profile { profile_name | type { ethernet | vethernet } [ profile_name ]}
no port-profile { profile_name | type { ethernet | vethernet } [ profile_name ]}
Port profile name. The name can be up to 80 characters in length, alphanumeric, and case-sensitive. |
|
(Optional) Specifies an interface of type Ethernet or virtual Ethernet. |
|
Configure port profile (config-net-seg).
|
|
The port profile name must be unique for each port profile on the Cisco Nexus 1000V.
The port profile type can be Ethernet or virtual Ethernet. Once configured, the type cannot be changed.
Defining a port profile type as Ethernet allows the port profile to be used for physical (Ethernet) ports. In the Microsoft System Center Virtual Machine Manager (SCVMM) server, the corresponding uplink port profile can be selected and assigned to physical ports (PNICs).
If a port profile is configured as an Ethernet type, it cannot be used to configure a vNIC or Microsoft Hyper-V virtual port.
Classification profiles carry the feature configuration for Ethernet and virtual Ethernet interfaces. The classification profile type determines which type of interfaces can inherit them. virtual Ethernet classification profiles are published to the SCVMM server while Ethernet profiles are inherited by uplink networks.
To configure a virtual Ethernet profile with features:
1. Create network-segments with VLANs to be assigned for virtual Ethernet interfaces.
2. Create classification profile of type “vethernet” with required features.
3. Publish classification profile to the SCVMM server.
4. On the SCVMM server attach both nsm network segment and the classification profile to the virtual Ethernet interface.
To configure a virtual Ethernet profile with port binding:
1. Once a virtual Ethernet port profile has been created as a port group on the SCVMM server, you cannot change its port binding type.
2. You cannot configure maximum port limits for virtual Ethernet port profiles with ephemeral port binding.
3. You cannot configure port binding for Ethernet type port profiles. Port binding is available only for virtual Ethernet port profiles.
4. Manual configurations on an interface are purged when the system administrator changes its port profile if either port profile is configured with ephemeral port binding regardless of the auto purge setting.
This example shows how to create an Ethernet type port profile with the name PortChannelProfile:
This example shows how to remove the port profile with the name PortChannelProfile:
This example shows how to configure a classification profile:
This example shows how to create an Ethernet profile carrying a port channel configuration:
This example shows how to configure a virtual Ethernet profile with features:
|
|
---|---|
Displays the port profile configuration, including assigned roles. |
|
Designates whether the interfaces in the port profile are to be used as access or trunking ports. |
To view the current directory, use the pwd command.
network-admin
network-operator
|
|
This example shows how to view the current directory: