- bypass asa-traffic
- capability l3-vn-service
- clear vservice connection
- clear vservice statistics
- copy running-config startup-config
- log-level
- org
- ping vservice
- policy-agent-image
- pop
- port-profile
- push
- registration-ip
- shared-secret
- show org port brief
- show running-config
- show running-config vservice node
- show running-config vservice path
- show nsc-pa status
- show vservice brief
- show vservice connection
- show vservice detail
- show vservice license brief
- show vservice license detail
- show vservice node mac brief
- show vservice node brief
- show vservice node detail
- show vservice path brief
- show vservice path detail
- show vservice port brief
- show vservice port detail
- show vservice port vethernet
- show vservice statistics
- tcp state-checks
- vn-service ip-address
- vservice
- vservice node
- vservice path
- vservice license
- nsc-policy-agent
- vservice global type vsg
vPath and vServices Commands
This chapter provides information about the vPath and vServices related commands on the Cisco Nexus 1000V Series switch and the Cisco Cloud Services Platform networking appliance.
bypass asa-traffic
To configure the traffic to bypass the Cisco VSG in a service chain, use the bypass asa-traffic command. To return to the default setting, use the no form of this command.
Syntax Description
Defaults
Command Modes
vservice global configuration (config-vservice-global)
Command History
|
|
---|---|
Usage Guidelines
In a service chain, you can configure the switch traffic to bypass the Cisco VSG nodes, so that only the Cisco ASA policies are lookedup for traffic traversing between the outside and inside networks. When enabled, this functionality is implemented globally, and not per interface.
Examples
This example shows how to configure the switch traffic to bypass the Cisco VSG nodes:
Related Commands
|
|
---|---|
capability l3-vn-service
To configure a port profile to be used with l3-vn-service, use the capability l3-vn-service command. To remove the capability from a port profile, use the no form of this command.
Syntax Description
Defaults
Command Modes
Port-profile configuration (config-port-prof)
Command History
|
|
---|---|
Usage Guidelines
If you are configuring a port profile for l3-vn-service, you must first configure the port profile in switchport mode.
The capability iscsi-multipath feature cannot be configured with the capability l3-vn-service feature.
Examples
This example shows how to configure a port profile to be used with l3-vn-service:
This example shows how to remove the l3-vn-service configuration from the port profile:
Related Commands
|
|
---|---|
clear vservice connection
To clear the Cisco vservice connections, use the clear vservice connection command.
clear vservice connection [ module module-num ]
Syntax Description
Defaults
Command Modes
Command History
|
|
---|---|
Examples
This example shows how to clear Cisco VSG connections:
Related Commands
|
|
---|---|
clear vservice statistics
To clear the Cisco vservice statistics, use the clear vservice statistics command.
clear vservice statistics [ module module-number | vlan vlan-number ]
Syntax Description
Defaults
Command Modes
Command History
|
|
---|---|
Examples
This example shows how to clear Cisco vservice statistics for existing modules:
Related Commands
|
|
---|---|
copy running-config startup-config
To copy the running configuration to the startup configuration, use the copy running-config startup-config command.
copy running-config startup-config
Syntax Description
Defaults
Command Modes
network-admin
network-operator
Command History
|
|
---|---|
Usage Guidelines
Use this command to save configuration changes in the running configuration to the startup configuration in persistent memory. When a device reload or switchover occurs, the saved configuration is applied.
Examples
This example shows how to save the running configuration to the startup configuration:
Related Commands
|
|
---|---|
Displays the differences between the running configuration and the startup configuration. |
|
log-level
To set logging severity levels for the Cisco Prime Network Services Controller (PNSC) policy agent, use the log-level command. To reset logging levels, use the no form of this command.
log-level {critical | debug0 | debug1 | debug2 | debug3 | debug4 | info | major | minor | warn}
no {critical | debug0 | debug1 | debug2 | debug3 | debug4 | info | major | minor | warn}
Syntax Description
Command Default
Command Modes
Cisco PNSC policy agent configuration (config-nsc-policy-agent)
Command History
|
|
---|---|
Examples
This example shows how to set the logging level to critical:
Related Commands
|
|
---|---|
org
To create a Cisco PNSC organization (domain), use the org command. To delete a Cisco PNSC organization, use the no form of the command.
Syntax Description
Command Default
Command Modes
Port profile configuration (config-port-prof)
Command History
|
|
---|---|
Usage Guidelines
Cisco PNSC organizations are Cisco PNSC domains.
You can hierarchically manage Cisco PNSC organizations. A user that is assigned at a top level organization has automatic access to all organizations under it. For example, an engineering organization can contain a software engineering organization and a hardware engineering organization. A locale containing only the software engineering organization has access to system resources only within that organization. However, a locale that contains the engineering organization has access to the resources for both the software engineering and hardware engineering organizations.
Examples
This example shows how to create an organization:
Related Commands
|
|
---|---|
ping vservice
To ping the vservice from the vPath, use the ping vservice command. There is no no form of this command.
ping vservice [ip vservice-ip-addr {[vlan vservice-vlan-num ] | [vxlan bridge-domain bridge-domain-name ] | all} {src-module { module-num | all | vpath-all}] [timeout secs] [count count ]
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
Examples
This example shows how to ping a Cisco VSG:
Specify both the IP address and VLAN if the vservice to be pinged is not associated to any VMs yet.
In the output, the status of the ping request for each vservice for each module is shown. On a successful ping, the round-trip-time of ping request/response for a vservice is shown in microseconds next to the module number. On a failure, the failure message is shown next to the module number.
The options timeout and count apply to all of the above commands:
These examples show how to display all of the source module traffic:
vsm# ping vservice ip 10.1.1.40 src-module vpath-all
ping vservice 10.1.1.40 vlan 0 from module 9 11 12, seq=0 timeout=1-sec
module(usec) : 9(698) 11(701) 12(826)
ping vservice 10.1.1.40 vlan 0 from module 9 11 12, seq=1 timeout=1-sec
module(usec) : 9(461) 11(573) 12(714)
ping vservice 10.1.1.40 vlan 0 from module 9 11 12, seq=2 timeout=1-sec
module(usec) : 9(447) 11(569) 12(598)
ping vservice 10.1.1.40 vlan 0 from module 9 11 12, seq=3 timeout=1-sec
module(usec) : 9(334) 11(702) 12(559)
ping vservice 10.1.1.40 vlan 0 from module 9 11 12, seq=4 timeout=1-sec
Related Commands
|
|
---|---|
Activates a signal to verify connections with other devices on a path. |
policy-agent-image
To designate the policy agent image local URL as bootflash, use the policy-agent-image command. To remove the designation, use the no form of the command.
no policy-agent-image bootflash:
Syntax Description
Command Default
Command Modes
PNSC policy agent configuration (config-nsc-policy-agent)
Command History
|
|
---|---|
Examples
This example shows how to designate the local URL that contains the policy agent image:
Related Commands
|
|
---|---|
pop
To pop a mode off the stack or to restore a mode, use the pop command.
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Examples
This example shows how to restore from a file called file1:
Related Commands
|
|
---|---|
port-profile
To create a port profile and enter port profile configuration mode, use the port-profile command. To remove the port profile configuration, use the no form of this command.
Syntax Description
Port profile name. The range of valid values is from 1 to 80. |
Defaults
Command Modes
Command History
|
|
---|---|
Usage Guidelines
Examples
This example shows how to create a port profile called AccessProf:
This example shows how to remove the port profile called AccessProf:
Related Commands
|
|
---|---|
push
To push the current mode onto stack or to save it, use the push command.
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Examples
This example shows how to push file1 onto the stack:
Related Commands
|
|
---|---|
registration-ip
To set the service registry IP address, use the registration-ip command. To discard the service registry IP address, use the no form of this command.
Command Default
Command Modes
Cisco PNSC policy agent configuration mode (config-nsc-policy-agent)
Command History
|
|
---|---|
Examples
This example shows how to set the service registry IP address:
Related Commands
|
|
---|---|
shared-secret
To set the shared secret password for communication between the Cisco Virtual Security Gateway (VSG), the Virtual Supervisor Module (VSM), and the Cisco Prime Network Services Controller (PNSC), use the shared-secret command. To discard the shared secret password, use the no form of this command.
shared-secret shared-secret-password
Syntax Description
Shared secret password. The range of valid values is from 1 to 64. You must use at least one uppercase character. |
Command Default
Command Modes
Cisco PNSC policy agent configuration mode (config-nsc-policy-agent)
Command History
|
|
---|---|
Examples
This example shows how to set the shared secret password:
Related Commands
|
|
---|---|
show org port brief
To display the ports attached to the port profile where org is configured, use the show org port brief command.
s how org port brief [ port-profile pp_name | vethernet veth_num ] [ module module_num ]
Syntax Description
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show vservice port brief command:
Examples
This example shows how to display the port profile information:
show running-config
To display the running configuration, use the show running-config command.
show running-config [ aaa | aclmgr | all | am | arp | cdp | diff | exclude | expand-port-profile | icmpv6 | igmp | interface | ip | ipqos | ipv6 | l3vm | license | monitor | ntp | port-profile | port-security | radius | rpm | security | snmp | vdc-all | vlan | vshd | acllog | dhcp | vservices [ node node-name | path path-name ]]
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show running-config command:
Examples
This example shows how to display the running configuration:
Related Commands
|
|
---|---|
show running-config vservice node
To display the configuration details of the virtual service nodes in the network, use the show running-config vservice node command.
show running-config vservice node (optional) [node-name]
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show running-config vservice node command:
Examples
This example shows how to display the information of the configured vservice nodes:
Related Commands
|
|
---|---|
show running-config vservice path
To display the configuration details of the vservice paths, use the show running-config vservice path command.
show running-config vservice path (optional) [node-name]
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show running-config vservice path command:
Examples
This example shows how to display the information of the configured vservice nodes:
Related Commands
|
|
---|---|
show nsc-pa status
To display the installation status of a policy agent, use the show nsc-pa status command.
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show nsc-pa status command:
Examples
This example shows how to display the installation status of the policy agent:
Related Commands
|
|
---|---|
show vservice brief
To display only a brief summary about the Virtual Service (vservice), use the show vservice brief command.
show vservice brief [ node-l3 node-ipaddr ip-addr | node-l3 module module-num ] [ node-vxlan bridge-domain bridge-domain-name ] | node-vlan vlan-id| node-name node name | module module-num
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
The output of the show vservice brief was changed to show the information about the Cisco VSG sin L2 and L3 mode. |
|
Usage Guidelines
You can use the following operators with the show vservice brief command:
Examples
This example shows how to display brief information about the Cisco VSGs:
Related Commands
|
|
---|---|
show vservice connection
To display vservice connections, use the show vservice connection command.
show vservice connection [ node-name node-name ] [ node-vxlan bridge-domain bdname | node-vlan vlan-num | node-l3 [ node-ipaddr ip-addr | module module-num] | node-ipaddr ip-addr ] | path-name path-name | port-profile port-profile-name | service-profile service-profile-name ]
Syntax Description
Command Default
Command Modes
Command History
Usage Guidelines
You can use the following operators with the show vservice connection command:
Examples
This example shows how to display Cisco VSG connections:
Related Commands
|
|
---|---|
show vservice detail
To display detailed information about the Virtual Service (vservice), use the show vservice detail command.
show vservice detail {module module_num | node_ipaddr ip_addr | node_l3 node_l3 | node_name node_name | node_vxlan vxlan_num | node_vlan vlane_num | path_name path_name port-profile port_profile| service-profile sevice_profile}
Syntax Description
Specifies the module number to see the vservice connections on the module. |
|
Filters the display by node associated with the Layer 3 mode |
|
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
The output of the show vservice detail command was changed to show the detailed information about Cisco VSGs. |
|
Usage Guidelines
You can use the following operators with the show vservice detail command:
Examples
This example shows how to display detailed information about Cisco VSGs:
Related Commands8
|
|
---|---|
show vservice license brief
To display only a brief summary about the virtual service node license information, use the s how vservice license brief command.
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show nsc-pa status command:
Examples
This example shows how to display the brief information about the license:
Related Commands
|
|
---|---|
show vservice license detail
To display the detail about the virtual service node license information, use the show vservice license detail command.
show vservice license detail {module module_num }
Syntax Description
Specifies the module number to see all the vservice connections on the module. The range is from 3 to 258. |
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show nsc-pa status command:
Examples
This example shows how to display the brief information about the license:
Related Commands
|
|
---|---|
show vservice node mac brief
To display only summary about the MAC address of the virtual service node, use the show vservice node mac brief command.
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show vservice node brief command:
Examples
This example shows how to display the MAC address of the Cisco virtual service node
Related Commands
|
|
---|---|
show vservice node brief
To display only the summary about the Cisco virtual service node, use the show vservice node brief command.
show vservice node brief [ name node-name | vxlan bridge-domain bdname | vlan vlan_num | l3 ip-addr ip-addr | l3 module module-num ] | ipaddr ip-addr | module module-num ]
Syntax Description
Specifies Layer 3 mode (using IP address) for the service node. |
|
Specifies the module number to see all the vservice connections on the module. |
Command Default
Command Modes
Command History
Usage Guidelines
You can use the following operators with the show vservice node brief command:
Examples
This example shows how to display summary information about Cisco vservice.
Related Commands
|
|
---|---|
show vservice node detail
To display the detail about the Cisco virtual service node, use the show vservice node detail command.
show vservice node detail [ name node-name | vxlan bridge-domain bdname | vlan vlan_num | l3 ip-addr ip-addr | l3 module module-num] | ipaddr ip-addr | module module-num]
Syntax Description
Filters the display by the Layer 3 mode (using the IP address) for the service node. |
|
Specifies the module number to see all the vservice connections on the module. |
Command Default
Command Modes
Command History
Usage Guidelines
You can use the following operators with the show vservice connection command:
Examples
This example shows how to display Cisco VSG service node?
Related Commands
|
|
---|---|
show vservice path brief
To only display the summary of the vservice path, use the show vservice path brief command.
show vservice path brief [ module module-number | name name ]
Syntax Description
Defaults
Command Modes
Command History
|
|
---|---|
Examples
This example shows how to show the vservice path:
Related Commands
|
|
---|---|
show vservice path detail
To only display the details of the vservice path, use the show vservice path detail command.
show vservice path detail [ module module-number | name name ]
Syntax Description
Specifies the module number to see all the vservice connections on the module. |
|
Defaults
Command Modes
Command History
|
|
---|---|
Examples
This example shows how to show the vservice path:
Related Commands
|
|
---|---|
show vservice port brief
To display a brief summary of the configured ports in the network, use the show vservice port brief command.
show vservice port brief {module module_num | node-ipaddr ip_addr | node-l3 [ node-ipaddr ip-addr | module module-num] | node-name node_name | node-vlan vlan-num | node-vxlan bridge-domain bdname| path-name path_name | port-profile port_profile | service-profile service_profile | vethernet vethernet_num}
Syntax Description
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show vservice port brief command:
Examples
This example shows how to display the brief summary information of the vservice ports per module number 4:
Related Commands
|
|
---|---|
show vservice port detail
To display details of the configured ports in the network, use the show vservice port detail command.
show vservice port detail {module module_num | node-ipaddr ip_addr | node-l3 [ node-ipaddr ip-addr | module module-num] | node-name node_name | node-vlan vlan_num | node-vxlan bridge-domain bdname| path-name path_name | port-profile port_profile | service-profile service_profile | vethernet vethernet_num}
Syntax Description
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show vservice port detail command:
Examples
This example shows how to display the detailed information of the vservice ports per module number 4:
Related Commands
|
|
---|---|
Displays a brief summary of the configured ports in the network. |
show vservice port vethernet
To display information about virtual Ethernet (vEth) ports, use the show vservice port vethernet command.
show vservice port vethernet port-number
Syntax Description
Command Default
Command Modes
network-admin
network-operator
Command History
|
|
---|---|
Usage Guidelines
You can use the following operators with the show vservice port vethernet command:
Examples
This example shows how to display information about vEth port 2:
Related Commands
|
|
---|---|
show vservice statistics
To display the information about the configuration, MAC address, state of associated Cisco VSG and Virtual Ethernet Module (VEM), Veths to which Cisco VSGs are bound, and Virtual Service (vservice) statistics for all VEM modules associated with Cisco VSGs, use show vservice statistics command.
show vservice statistics [ ip ip-addr | module module-num | vlan vlan-num ]
Syntax Description
Specifies the VLAN number associated with the node in l2 mode. |
Command Default
Command Modes
network-admin
network-operator
Command History
|
|
---|---|
The name of the command is changed and the command uses the variables. |
|
This command is changed to show the vservice statistic details |
|
Usage Guidelines
You can use the following operators with the show vservice statistics command:
Examples
This example shows how to display statistics for a module:
Related Commands
|
|
---|---|
tcp state-checks
To configure the Cisco Nexus 1000V switch to perform TCP state checks, use the tcp state-checks command. To disable TCP state checks functionality, use the no form of the command.
tcp state-checks [invalid-ack | seq-past-window | window-variation]
no tcp state-checks [invalid-ack | seq-past-window | window-variation]
Syntax Description
Defaults
Command Modes
vservice global configuration (config-vservice-global)
Command History
|
|
---|---|
This command was modified to add the invalid-ack, seq-past-window, and window-variation TCP state checks. |
|
Usage Guidelines
Use the tcp state-checks command to enable TCP state checks. By default, TCP state checks are disabled.
Examples
This example shows how to configure the switch to perform the default TCP state checks:
Related Commands
|
|
---|---|
Configures the switch traffic to bypass the Cisco VSG nodes in a service chain. |
vn-service ip-address
To assign a data IP address, a VLAN number, and a profile to a Cisco VSG L2 mode, use the vn-service ip-address command. To disable the data IP address, use the no form of the command.
vn-service ip-address ip-address vlan vlan-number [ fail { close | open } | security-profile profile-name ]
no vn-service ip-address ip-address vlan vlan-number [ fail { close | open } | security-profile profile-name ]
To assign a data IP address and a profile to a Cisco VSG L3 mode, use the vn-service ip-address command. To disable the data IP address, use the no form of the command.
vn-service ip-address ip-address l3-mode [ fail { close | open } | security-profile profile-name ]
no vn-service ip-address ip-address l3-mode [ fail { close | open } | security-profile profile-name ]
Syntax Description
Specifies the service VLAN number. The range of values is from 1 to 3967 and 4048 to 4093. |
|
(Optional) Sets state to be in either fail close or fail open. |
|
Command Default
Command Modes
Port profile configuration (config-port-prof)
Command History
|
|
---|---|
This command was changed to include the command syntax and description for the L3 mode. |
|
Usage Guidelines
Use the vn-servic e ip-address command to configure the IP address, VLAN, and security profile for the Cisco VSG, and optionally to allow for a fail-safe configuration.
The fail mode specifies what the behavior is when the Virtual Ethernet Module (VEM) does not have connectivity to the Cisco VSG. The default fail mode is close, which means that the packets are dropped. The open fail mode means that packets are passed.
The security profile name must match one of the security profiles created on the Cisco VSG.
The IP address must match the data interface IP address on the Cisco VSG.
Examples
This example shows how to assign the IP address and VLAN number and how to specify that packets are to be passed when the Cisco VSG fails:
Related Commands
|
|
---|---|
vservice
To associate a port-profile with a service node or path, use the vservice command from the config-port-profile mode of the port-profile. To delete a port-profile configuration, use the no form of this command.
vservice {node node_name [profile profile_name] | path svc_path_name}
Syntax Description
Defaults
Command Modes
Port-profile configuration (config-port-prof)
Command History
|
|
---|---|
Usage Guidelines
You can associate either the service node or path to the chosen port-profile entity. Both, the node as well as the path need to be pre-defined. If the node is of type VSG or ASA, then specifying a profile is mandatory. However, it is optional in case of a vWAAS or ACE nodes.
Examples
This example shows how to configure a port-profile with a node and service profile:
This example shows how to configure a port-profile entity with a service path:
Related Commands
|
|
---|---|
vservice node
To configure a service node, use the vservice node command. To disable a service node, use the no form of the command.
vservice node node_name type {vsg | asa | adc | vwaas}
ip address ip-address | no ip address
adjacency {l2 {vlan vlan-number} | {vxlan bridge-domain bd-name} | l3} | no adjacency failmode {close | open} | no failmode
no vservice node node_name
no ip address
no adjacenc
no failmode
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
Use the vservice node command to configure a service node with an existing Cisco VSG, ASA, or ACE. That node in turn is associated with either a port profile or a vservice path.
You can only delete inactive vservice nodes. The inactive nodes are not configured with any virtual machines or service paths.

Note vPath 1.0 service nodes do not support ping vsn from a host that does not have any vServices enabled.
Examples
This example shows how to enter the vservice-node mode, and configure the IP address of a vservice node, adjacency, and fail-mode settings:
Related Commands
|
|
---|---|
vservice path
To configure a path for service chaining, use the vservice path command. To disable a service path, use the no form of the command.
vservice path svc_path_name
node node_name [profile prof_name] order order_num
no vservice path svc_path_name
no node node_name
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You can configure up to 3 service nodes in one vservice path. The supported nodes are the Cisco VSG, vWAAS, and ASA. The specified node_name has to be pre-defined. Specifying a profile is mandatory for VSG and ASA, but not for vWAAS. For a given path, the ASA node must be configured last. At the end, you can disable a vservice-path from within its mode as well as at the global configuration level.
Examples
This example shows how to enter the vservice-path mode, and specify the name of a vservice node, port profile, and the order number:
This example shows how to disable a vservice-path:
Related Commands
|
|
---|---|
vservice license
To assign ASA licenses to specific modules, use the vservice license command. You can transfer the licenses within the modules and license pool. This command also enables (activate) the volatile licenses. To disable volatile licenses, use the no form of the command.
vservice license type {asa} {transfer | volatile} {src-module mod_no | license-pool} {dst-module mod_no | license-pool}
[no] vservice license type {asa} volatile
Syntax Description
Defaults
Command Modes
Command History
|
|
---|---|
Usage Guidelines
You cannot transfer volatile licenses to the license-pool. Thus, you cannot specify any keyword after you type “volatile” at the command line.
Examples
This example shows how to transfer an ASA license from one module to another:
This example shows how to disable volatile ASA licenses:
Related Commands
|
|
---|---|
nsc-policy-agent
To enter Cisco Prime Network Services Controller (PNSC) policy agent mode, use the nsc-policy-agent command.
Syntax Description
Command Default
Command Modes
Command History
|
|
---|---|
Usage Guidelines
Use the Cisco PNSC policy agent configuration mode to configure policy agents.
Examples
This example shows how enter policy agent mode:
Related Commands
|
|
---|---|
vservice global type vsg
To enter the vservice global configuration mode, use the vservice global type vsg command.
Syntax Description
Command Default
Command Modes
vservice global configration (config-vservice-global)
Command History
|
|
---|---|
Examples
This example shows how to enter the vservice global configuration mode:
This example shows how to enable L3 fragmentation:
Related Commands
|
|
---|---|
Configures the switch traffic to bypass the Cisco VSG nodes in a service chain. |
|
Configures selective TCP state checks on the switch traffic. |