The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
To suppress routing updates on an interface, use the passive-interface command. To revert to the default settings, use the no form of this command.
passive-interface default
no passive-interface default
default |
Specifies interfaces that are passive by default. |
None
Router configuration
Release |
Modification |
---|---|
5.2(1) |
This command was introduced. |
This command does not require a license.
This example shows how to suppress routing updates on the interface:
switch# configure terminal switch(config)# interface ethernet 5/4 switch(config-if)# router ospf 2 switch(config-router)# passive-interface default switch(config-router)#
This example shows how to remove the configuration for the routing updates suppression:
switch# configure terminal switch(config)# interface ethernet 5/4 switch(config-if)# router ospf 2 switch(config-router)# no passive-interface default
Command |
Description |
---|---|
ip ospf passive-interface |
Suppresses (OSPF routing updates on an interface. |
To remove the passive-interface commands on the interface (if any) and return the interface to the default configuration, use the passive-interface default command.
passive-interface default { level-1 | level-1-2 | level-2 }
level-1 |
Suppresses level-1 PDU. |
level-1-2 |
Suppresses level-1 and level-2 PDU. |
level-2 |
Suppresses level-2 PDU. |
None
Router configuration (config-router) mode
Release |
Modification |
---|---|
6.2(2) |
This command was introduced. |
This command requires the Enterprise Services license.
This example shows how to remove the passive-interface commands on the interface and return the interface to the default configuration:
switch# configure terminal switch(config)# router isis 1 switch(config-router)# passive-interface default level-1 switch(config-router)# exit switch(config)#
Command |
Description |
---|---|
router isis |
Creates a new IS-IS instance and enters router configuration mode. |
To suppress Enhanced Interior Gateway Routing Protocol (EIGRP) hellos, use the passive-interface default command. To revert to the default, use the no form of this command.
passive-interface default
no passive-interface default
This command has no arguments or keywords.
None
config-router-mode
Release |
Modification |
---|---|
6.2(2) |
This command was introduced. |
Suppressing the EIGRP hellos prevents neighbors from forming and sending routing updates on all EIGRP interfaces.
This command requires the Enterprise Services license.
This example shows how to suppress EIGRP hellos:
switch# configure terminal switch(config)# router eigrp Test1 switch(config-router)# passive-interface default switch(config-router)#
Command |
Description |
---|---|
router isis |
Creates a new IS-IS instance and enters router configuration mode. |
ip passive-interface eigrp |
Suppresses all routing updates on EIGRP interface. |
To shut down an Open Shortest Path First version 3 (OSPFv3) instance, use the protocol shutdown command. To disable this function, use the no form of this command.
protocol shutdown
no protocol shutdown
This command has no keywords or arguments.
The OSPFv3 instance is enabled by default when configured.
Router configurationRouter VRF configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
Use the protocol shutdown command to configure disable an instance of OSPFv3 without removing the configuration.
This command requires the Enterprise Services license.
This example shows how to disable OSPFv3 209:
switch(config) router ospfv3 209 switch(config-router)# protocol shutdown
To exclude a VLAN from peer gateway, when a VLAN interface is used for Layer 3 backup routing on the virtual port-channel (vPC) peer devices and an F1 module is used as peer-link, use the vpc peer-gateway exclude-vlan command. To revert to the default settings, use the no form of this command.
peer-gateway exclude-vlan vlan-number
peer-gateway exclude-vlan vlan-number
vlan-number |
VLAN number. The range is from 1 to 2499 and from 2628 to 4093. |
None
vPC configuration (config-vpc-domain)
Release |
Modification |
---|---|
5.1(3) |
This command was introduced. |
Use the peer-gateway exclude-vlan command to configure a Layer 3 backup routing VLAN whenever you use the vPC peer-gateway feature.
If the vPC peer link is configured on a Cisco Nexus 32-port 1/10 Gigabit Ethernet (F1-Series) module (N7K-F132XP-15), then you must include the Layer 3 backup routing VLAN in the VLAN list specified by the vpc peer-gateway exclude command.
If the vPC peer link is configured on an M1 series module, then you should include the Layer 3 backup routing VLAN in the VLAN list specified by the vpc peer-gateway exclude command, but it is not required.
The peer-gateway functionality is not enabled for those VLANs specified in the exclude VLAN list. If no exclude VLAN list is specified, then this functionality is enabled for all VLANs.
The latest occurrence of this configuration overwrites all previous configurations.
The no vpc peer-gateway command also disables IP redirects on all VLANs.
This command does not require a license.
This example shows how to exclude a VLAN from peer gateway:
switch# configure terminal switch(config)# vpc domain 2 switch(config-vpc-domain)# peer-gateway exclude-vlan 1-34, 2700-2900 switch(config-vpc-domain)#
This example shows how to disable the peer-gateway functionality:
switch(config-vpc-domain)# no peer-gateway switch(config-vpc-domain)#
Command |
Description |
---|---|
vpc domain |
Creates a virtual port-channel (vPC) domain. |
To configure IP packet verification, use the platform ip verify command. To return to default, use the no form of this command.
platform ip verify { checksum | fragment | tcp tiny-frag | version }
no platform ip verify { checksum | fragment }
checksum |
Drops IPv4 or IPv6 packets if the checksum is invalid |
fragment |
Drops IPv4 or IPv6 packets if the packet fragment has a nonzero offset and the DF bit is active. |
tcp tiny-frag |
Drops IPv4 packets if the IP fragment offset is 1, or if the IP fragment offset is 0 and the IP payload length is less than 16. |
version |
Drops IPv4 packets if the Drops IPv6packets if the Ethertype is not set to 4 (IPv4). |
All address tests are enabled.
Global configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
4.1(3) |
This command was replaced by the hardware ip verify command. |
Use the platform ip verify command to configure packet verification tests on IPv4 and IPv6 packets based on checksum or fragments.
This command does not require a license.
This example shows how to drop fragmented IPv4 or IPv6 packets:
switch(config)# platform ip verify fragment
Command |
Description |
---|---|
platform ip verify address |
Configures IPv4 and IPv6 packet verification checks based on addresses. |
platform ip verify length |
Configures IPv4 packet verification checks based on length. |
platform ipv6 verify |
Configures IPv6 packet verification. |
show hardware forwarding ip verify |
Displays information about IP packet verification checks. |
To packet verification on IP addresses, use the platform ip verify address command. To return to default, use the no form of this command.
platform ip verify address { destination zero | identical | reserved | source { broadcast | multicast } }
no platform ip verify address { destination zero | identical | reserved | source { broadcast | multicast } }
destination zero |
Drops IP packets if the destination IPv4 address is 0.0.0.0 or if the IPv6 address is ::. |
identical |
Drops IP packets if the source IPv4 or IPv6 address is identical to the destination IPv4 or IPv6 address. |
reserved |
Drops IP packets if the IPv4 address is in the 127.x.x.x range or if the IPv6 address is in the ::1 range. |
source |
Drops IP packets based on the IP source address. |
broadcast |
Drops IP packets if the IP source address is 255.255.255.255. |
multicast |
Drops IP packets if the IPv4 source address is in the 224.x.x.x range or if the IPv6 source address is in the FF00::/8 range. |
All address tests are enabled.
Global configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
4.1(3) |
This command was replaced by the hardware ip verify address command. |
Use the platform ip verify address command to configure packet verification tests on IPv4 and IPv6 packets based on addresses.
This command does not require a license.
This example shows how to drop broadcast IPv4 packets:
switch(config)# platform ip verify address source broadcast
Command |
Description |
---|---|
platform ip verify |
Configures IPv4 and IPv6 packet verification checks based on checksum or fragments. |
platform ip verify length |
Configures IPv4 packet verification checks based on length. |
platform ipv6 verify |
Configures IPv6 packet verification. |
show hardware forwarding ip verify |
Displays information about IP packet verification checks. |
To configure IPv4 packet verification based on packet length, use the platform ip verify length command. To return to the default, use the no form of this command.
platform ip verify length { consistent | maximum { max-frag | max-tcp | udp } | minimum }
no platform ip verify length { consistent | maximum { max-frag | max-tcp | udp } | minimum }
consistent |
Drops IPv4 packets where the Ethernet frame size is greater than or equal to the IP packet length plus the Ethernet header. |
maximum |
Specifies maximum IP packets. |
max-frag |
Specifies the IP packets if the maximum fragment offset is greater than 65536. |
max-tcp |
Specifies the IP packets if the TCP length is greater than the IP payload length. |
udp |
Specifies the IP packets if the IP payload length is less than the UDP packet length. |
minimum |
Specifies the IP packets if the Ethernet frame length is less than the IP packet length plus four octets (the CRC length). |
All address tests are enabled.
Global configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
4.1(3) |
This command was replaced by the hardware ip verify length command. |
Use the platform ip verify length command to configure packet verification tests on IPv4 and IPv6 packets based on packet length
This command does not require a license.
This example shows how to drop minimum-length IPv4 packets:
switch(config)# platform ip verify length minimum
Command |
Description |
---|---|
platform ip verify |
Configures IPv4 packet verification checks based on checksum or fragments. |
platform ip verify address |
Configures IPv4 and IPv6 packet verification checks based on addresses. |
platform ipv6 verify |
Configures IPv6 packet verification. |
show hardware forwarding ip verify |
Displays information about IP packet verification checks. |
To configure IPv6 packet verification, use the platform ipv6 verify command. To return to default, use the no form of this command.
platform ipv6 verify length { consistent | maximum { max-frag | max-tcp | udp } | tcp tiny-frag | version }
no platform ip verify { checksum | fragment }
length |
Drops IPv6 packets based on length. |
consistent |
Drops IPv6 packets where the Ethernet frame size is greater than or equal to the IPv6 packet length plus the Ethernet header. |
maximum |
Specifies maximum IP packets. |
max-frag |
Specifies the IP packets if the maximum fragment offset is greater than 65536. |
max-tcp |
Specifies the IP packets if the TCP length is greater than the IP payload length. |
udp |
Specifies the IP packets if the IP payload length is less than the UDP packet length. |
tcp tiny-frag |
Drops IPv6 packets if the IP fragment offset is 1, or if the IPv6 fragment offset is 0 and the IPv6 payload length is less than 16. |
version |
Drops IPv6 packets if the EtherType is not set to 6 (IPv6). |
All address tests are enabled.
Global configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
4.1(3) |
This command was replaced by the hardware ipv6 verify command. |
Use the platform ipv6 verify command to configure packet verification tests on IPv6 packets.
This command does not require a license.
This example shows how to drop all IPv4 packets:
switch(config)# platform ipv6 verify version
Command |
Description |
---|---|
platform ip verify address |
Configures IPv4 and IPv6 packet verification checks based on addresses. |
platform ip verify length |
Configures IPv4 packet verification checks based on length. |
show hardware forwarding ip verify |
Displays information about IP packet verification checks. |
To configure the gateway to take over as active virtual gateway (AVG) for a Gateway Load Balancing Protocol (GLBP) group if it has a higher priority than the current AVG, use the glbp preempt command. To disable this feature, use the no form of this command.
Cisco NX-OS Release 4.1(3) and later syntax:preempt [ delay minimum seconds ]
no preempt [ delay minimum seconds ]
Cisco NX-OS Release 4.1(2) and earlier syntax:preempt [ delay minimum seconds ]
no preempt [ delay minimum seconds [ sync seconds ] ]
delay minimum seconds |
(Optional) Specifies a minimum number of seconds that the gateway delays before taking over the role of AVG. The range is from 0 to 3600 seconds with a default delay of 30 seconds. |
sync seconds |
(Optional) Specifies a number of seconds that the gateway waits for the synchronization to complete. The range is from 0 to 3600 seconds. |
A GLBP gateway with a higher priority than the current AVG cannot assume the role of AVG.The default delay value is 30 seconds.
GLBP configuration
Release |
Modification |
---|---|
4.1(3) |
Removed sync the keyword. |
4.0(1) |
This command was introduced. |
This command does not require a license.
This example shows how to configure a router to preempt the current AVG when its priority of 254 is higher than the current AVG. If the router preempts the current AVG, it waits 60 seconds before assuming the role of AVG.
switch(config-if)# glbp 10 switch(config-glbp)# preempt delay minimum 60 switch(config-glbp)# priority 254
Command |
Description |
---|---|
glbp |
Enters GLBP configuration mode and creates a GLBP group. |
priority |
Sets the priority level of the router within a GLBP group. |
To configure a preemption delay, use the preempt command. To disable this feature, use the no form of this command.
preempt [ delay { minimum min-delay | reload rel-delay | sync sync-delay } ]
no preempt [ delay { minimum min-delay | reload rel-delay | sync sync-delay } ]
delay minimum min-delay |
(Optional) Specifies the minimum number of seconds that preemption is delayed to allow routing tables to be updated before a router becomes active. The default value is 0. |
reloadrel-delay |
(Optional) Specifies the time delay after the router has reloaded. This period applies only to the first interface-up event after the router has reloaded. The default value is 0. |
sync sync-delay |
(Optional) Specifies the maximum number of seconds to allow IP redundancy clients to prevent preemption. When this period expires, preemption occurs regardless of the state of the IP redundancy clients. The default value is 0. |
The default delay time for all options is 0 seconds.
Interface configuration or HSRP template mode
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
This command does not require a license.
Specifying a minimum delay allows routing tables to be updated before a router becomes active. When a router first comes up, it does not have a complete routing table. A high-priority router will only delay preemption if it first receives a Hello packet from a low-priority active router. If the high-priority router does not receive a Hello packet from the low-priority active router when it is starting up, then it assumes there is no active router for the group and will become active as soon as possible.
This example shows how to configure a delay when a router becomes active when its priority is 110:
switch# configure terminal switch(config)# interface ethernet 0/1 switch(config-if)# ip address 10.0.0.1 255.255.255.0 switch(config-if)# hsrp 4 switch(config-if-hsrp)# priority 110 switch(config-if-hsrp)# preempt switch(config-if-hsrp)# authentication text sanjose switch(config-if-hsrp)# ip 10.0.0.3 switch(config-if-hsrp)# end
Command |
Description |
---|---|
feature hsrp |
Enables HSRP configuration. |
show hsrp |
Displays HSRP information. |
To enable a high-priority backup virtual router to preempt the low-priority master virtual router, use the preempt command. To disable a high-priority backup virtual router from preempting the low-priority master virtual router, use the no form of this command.
preempt
no preempt
This command has no arguments or keywords.
Enabled
VRRP configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
VRRP enables you to preempt a virtual router backup that has taken over for a failing virtual router master with a high-priority virtual router backup that has become available.
By default, a preemptive scheme is enabled. A backup high-priority virtual router that becomes available takes over for the backup virtual router that was elected to become the virtual router master. If you disable preemption, then the backup virtual router that is elected to become the virtual router master remains the master until the original virtual router master recovers and becomes the master again.
If the virtual IP address is also the IP address for the interface, then preemption is applied.
No license is required to use this command.
This example shows how to enable the backup high-priority virtual router to preempt the low-priority master virtual router:
Note | This preemption does not apply to the primary IP address. |
switch# config t switch(config)# interface ethernet 2/1 switch(config-if)# vrrp 250 switch(config-if-vrrp)# preempt
Command |
Description |
---|---|
show vrrp |
Displays VRRP configuration information. |
clear vrrp |
Clears all the software counters for the specified virtual router. |
To set the priority level of the gateway within a Gateway Load Balancing Protocol (GLBP) group, use the priority command. To remove the priority level of the gateway, use the no form of this command.
priority level
no priority
level |
Priority of the gateway within the GLBP group. The range is from 1 to 255. The default is 100. |
level: 100
GLBP configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
Use the priority command to control which virtual gateway becomes the active virtual gateway (AVG). GLBP compares the priorities of all virtual gateways in the GLBP group and selects the gateway with the numerically highest priority as the AVG. If two virtual gateways have equal priority, GLBP selects the gateway with the highest IP address.
This command does not require a license.
This example shows how to configure a virtual gateway with a priority of 254:
switch(config-if)# glbp 10 switch(config-glbp)# priority 254
Command |
Description |
---|---|
glbp |
Enters GLBP configuration mode and creates a GLBP group. |
preempt |
Configures a gateway to take over as the AVG for a GLBP group if it has a higher priority than the current AVG. |
To set the priority level within a Hot Standby Router Protocol (HSRP) group, use the priority command. To remove the priority level, use the no form of this command.
priority level [ forwarding-threshold lower lower-value upper upper-value ]
no priority level [ forwarding-threshold lower lower-value upper upper-value ]
level |
Interface priority for a virtual router. The range of values is from 1 to 255. If this router is the owner of the IP addresses, then the value is automatically set to 255. The default is 100. |
forwarding-threshold |
(Optional) Sets the threshold used by a virtual port channel (vPC) to determine when to fail over to the vPC trunk. |
lower lower-value |
(Optional) Sets the low threshold value. The lower-value range is from 1 to 255. The default is 1. |
upper upper-value |
(Optional) Sets the upper threshold value. The upper-value range is from 1 to 255. The default is 255. |
level: 100lower-value : 1upper-value : 255
HSRP configuration or HSRP template mode
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
4.1(3) |
Added support for forwarding-threshold, lower, and upper keywords. |
Use the priority command to control which virtual router becomes the active router. HSRP compares the priorities of all virtual routers in the HSRP group and selects the router with the numerically highest priority. If two virtual routers have equal priority, HSRP selects the router with the highest IP address.
This command does not require a license.
This example shows how to configure a virtual router with a priority of 254:
switch# configure terminal switch(config)# interface ethernet 0/1 switch(config-if)# ip address 10.0.0.1 255.255.255.0 switch(config-if)# hsrp 4 switch(config-if-hsrp)# priority 254
Command |
Description |
---|---|
feature hsrp |
Enables the HSRP configuration. |
show hsrp |
Displays HSRP information. |
To set the priority for the Virtual Router Redundancy Protocol (VRRP), use the priority command. To revert to the default value, use the no form of this command.
priority level [ forwarding-threshold lower lower-value upper upper-value ]
no priority level [ forwarding-threshold lower lower-value upper upper-value ]
level |
Interface priority for a virtual router. The range of values is from 1 to 255. If this router is the owner of the IP addresses, then the value is automatically set to 255. The default is 100. |
forwarding-threshold |
(Optional) Sets the threshold used by a virtual port channel (vPC) to determine when to fail over to the vPC trunk. |
lower lower-value |
(Optional) Sets the low threshold value. The lower-value range is from 1 to 255. The default is 1. |
upper upper-value |
(Optional) Sets the upper threshold value. The upper-value range is from 1 to 255. The default is 255. |
The default value is 100. For switches whose interface IP address is the same as the primary virtual IP address, the default value is 255.
VRRP configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
4.2(1) |
Added support for forwarding-threshold, lower, and upper keywords. |
The priority determines whether or not a VRRP router functions as a virtual router backup, the order of ascendancy for the VRRP router to become a virtual router master if the virtual router master fails, the role that each VRRP router plays, and what happens if the virtual router master fails.
If a VRRP router owns the IP address of the virtual router and the IP address of the physical interface, then this router will function as a virtual router master.
By default, a preemptive scheme is enabled. A backup high-priority virtual router that becomes available takes over for the backup virtual router that was elected to become the virtual router master. If you disable preemption, then the backup virtual router that is elected to become the virtual router master remains the master until the original virtual router master recovers and becomes the master again.
No license is required to use this command.
This example shows how to specify the priority for a virtual router:
switch# config t switch(config)# interface ethernet 2/1 switch(config-if)# vrrp 250 switch(config-if-vrrp)# priority 2
Command |
Description |
---|---|
feature vrrp |
Enables VRRP. |
show vrrp |
Displays VRRP configuration information. |
To shut down an Open Shortest Path First (OSPF) instance, use the protocol shutdown command. To disable this function, use the no form of this command.
protocol shutdown
no protocol shutdown
This command has no keywords or arguments.
The OSPF instance is enabled by default when configured.
Router configurationRouter VRF configuration
Release |
Modification |
---|---|
4.0(1) |
This command was introduced. |
Use the protocol shutdown command to configure disable an instance of OSPF without removing the configuration.
This command requires the Enterprise Services license.
This example shows how to disable OSPF 209:
switch(config) router ospf 209 switch(config-router)# protocol shutdown