Catalyst 4500 Series Switch Cisco IOS Command Reference, Release IOS XE 3.3(0)XO

interface

To select an interface to configure and to enter interface configuration mode, use the interface command.

interface type number

Syntax Description

Defaults

No interface types are configured.

Command Modes

Global configuration mode

Usage Guidelines

Table 2-6 lists the valid values for type.

Examples

This example shows how to enter the interface configuration mode on the Fast Ethernet interface 2/4:

Switch(config)# interface fastethernet2/4

Switch(config-if)# 

Related Commands

interface port-channel

To access or create a port-channel interface, use the interface port-channel command.

interface port-channel channel-group

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Usage Guidelines

You do not have to create a port-channel interface before assigning a physical interface to a channel group. A port-channel interface is created automatically when the channel group gets its first physical interface, if it is not already created.

You can also create the port channels by entering the interface port-channel command. This will create a Layer 3 port channel. To change the Layer 3 port channel into a Layer 2 port channel, use the switchport command before you assign the physical interfaces to the channel group. A port channel cannot be changed from Layer 3 to Layer 2 or vice versa when it contains member ports.

Only one port channel in a channel group is allowed.

Caution The Layer 3 port-channel interface is the routed interface. Do not enable Layer 3 addresses on the physical Fast Ethernet interfaces.

If you want to use CDP, you must configure it only on the physical Fast Ethernet interface and not on the port-channel interface.

Examples

This example creates a port-channel interface with a channel-group number of 64:

Switch(config)# interface port-channel 64

Switch(config)# 

Related Commands

interface range

To run a command on multiple ports at the same time, use the interface range command.

interface range {vlan vlan_id - vlan_id} {port-range | macro name}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Interface configuration mode

Usage Guidelines

You can use the interface range command on the existing VLAN SVIs only. To display the VLAN SVIs, enter the show running config command. The VLANs that are not displayed cannot be used in the interface range command.

The values that are entered with the interface range command are applied to all the existing VLAN SVIs.

Before you can use a macro, you must define a range using the define interface-range command.

All configuration changes that are made to a port range are saved to NVRAM, but the port ranges that are created with the interface range command do not get saved to NVRAM.

You can enter the port range in two ways:

•Specifying up to five port ranges

•Specifying a previously defined macro

You can either specify the ports or the name of a port-range macro. A port range must consist of the same port type, and the ports within a range cannot span the modules.

You can define up to five port ranges on a single command; separate each range with a comma.

When you define a range, you must enter a space between the first port and the hyphen (-):

interface range gigabitethernet 5/1 -20, gigabitethernet4/5 -20.

Use these formats when entering the port-range:

•interface-type {mod}/{first-port} - {last-port}

•interface-type {mod}/{first-port} - {last-port}

Valid values for interface-type are as follows:

•FastEthernet

•GigabitEthernet

•Vlan vlan_id

You cannot specify both a macro and an interface range in the same command. After creating a macro, you can enter additional ranges. If you have already entered an interface range, the CLI does not allow you to enter a macro.

You can specify a single interface in the port-range value. This makes the command similar to the interface interface-number command.

Examples

This example shows how to use the interface range command to interface to FE 5/18 - 20:

Switch(config)# interface range fastethernet 5/18 - 20

Switch(config-if)# 

This command shows how to run a port-range macro:

Switch(config)# interface range macro macro1

Switch(config-if)# 

Related Commands

interface vlan

To create or access a Layer 3 switch virtual interface (SVI), use the interface vlan command. To delete an SVI, use the no form of this command.

interface vlan vlan_id

no interface vlan vlan_id

Syntax Description

Defaults

Fast EtherChannel is not specified.

Command Modes

Global configuration mode

Usage Guidelines

The SVIs are created the first time that you enter the interface vlan vlan_id command for a particular VLAN. The vlan_id value corresponds to the VLAN tag that is associated with the data frames on an ISL or 802.1Q-encapsulated trunk or the VLAN ID that is configured for an access port. A message is displayed whenever a VLAN interface is newly created, so you can check that you entered the correct VLAN number.

If you delete an SVI by entering the no interface vlan vlan_id command, the associated interface is forced into an administrative down state and marked as deleted. The deleted interface will no longer be visible in a show interface command.

You can reinstate a deleted SVI by entering the interface vlan vlan_id command for the deleted interface. The interface comes back up, but much of the previous configuration will be gone.

Examples

This example shows the output when you enter the interface vlan vlan_id command for a new VLAN number:

Switch(config)# interface vlan 23

% Creating new VLAN interface.

Switch(config)# 

ip admission proxy http refresh-all

To ensure that you see a customized WebAuth login page with the same name in the switch system directory as a same-named prior login page, use the ip admission proxy http refresh-all command.

ip admission proxy http [success | failure | refresh-all | login [expired | page]]

Syntax Description

Defaults

If you do not enter this command, if any of the customized web-based authentication page files with the file of same name have been changed, you see the old login page rather than the new file.

Command Modes

Global configuration mode

Usage Guidelines

You should enter this command whenever the customized web-based authentication page has been changed in the system directory.

Examples

This example shows how to enter this command:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip admission proxy http [success | failure | refresh-all | login]

Switch(config)# end

Switch#

<The new html page is observed.>

ip arp inspection filter vlan

To permit ARPs from hosts that are configured for static IP when DAI is enabled and to define an ARP access list and apply it to a VLAN, use the ip arp inspection filter vlan command. To disable this application, use the no form of this command.

ip arp inspection filter arp-acl-name vlan vlan-range [static]

no ip arp inspection filter arp-acl-name vlan vlan-range [static]

Syntax Description

Defaults

No defined ARP ACLs are applied to any VLAN.

Command Modes

Global configuration mode

Usage Guidelines

When an ARP access control list is applied to a VLAN for dynamic ARP inspection, the ARP packets containing only the IP-to-Ethernet MAC bindings are compared against the ACLs. All other packet types are bridged in the incoming VLAN without validation.

This command specifies that the incoming ARP packets are compared against the ARP access control list, and the packets are permitted only if the access control list permits them.

If the access control lists deny the packets because of explicit denies, the packets are dropped. If the packets are denied because of an implicit deny, they are then matched against the list of DHCP bindings if the ACL is not applied statically.

Examples

This example shows how to apply the ARP ACL static hosts to VLAN 1 for DAI:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection filter static-hosts vlan 1

Switch(config)# end

Switch#

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active      static-hosts      No 

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Acl-Match        Deny  

Switch#

Related Commands

ip arp inspection limit (interface)

To limit the rate of incoming ARP requests and responses on an interface and prevent DAI from consuming all of the system's resources in the event of a DoS attack, use the ip arp inspection limit command. To release the limit, use the no form of this command.

ip arp inspection limit {rate pps | none} [burst interval seconds]

no ip arp inspection limit

Syntax Description

Defaults

The rate is set to 15 packets per second on the untrusted interfaces, assuming that the network is a switched network with a host connecting to as many as 15 new hosts per second.

The rate is unlimited on all the trusted interfaces.

The burst interval is set to 1 second by default.

Command Modes

Interface configuration mode

Usage Guidelines

The trunk ports should be configured with higher rates to reflect their aggregation. When the rate of the incoming packets exceeds the user-configured rate, the interface is placed into an error-disabled state. The error-disable timeout feature can be used to remove the port from the error-disabled state. The rate applies to both the trusted and nontrusted interfaces. Configure appropriate rates on trunks to handle the packets across multiple DAI-enabled VLANs or use the none keyword to make the rate unlimited.

The rate of the incoming ARP packets onthe channel ports is equal to the sum of the incoming rate of packets from all the channel members. Configure the rate limit for the channel ports only after examining the rate of the incoming ARP packets on the channel members.

After a switch receives more than the configured rate of packets every second consecutively over a period of burst seconds, the interface is placed into an error-disabled state.

Examples

This example shows how to limit the rate of the incoming ARP requests to 25 packets per second:

Switch# config terminal

Switch(config)# interface fa6/3

Switch(config-if)# ip arp inspection limit rate 25

Switch(config-if)# end

Switch# show ip arp inspection interfaces fastEthernet 6/3

Interface        Trust State     Rate (pps)

 ---------------  -----------     ----------

 Fa6/3            Trusted                 25

Switch#

This example shows how to limit the rate of the incoming ARP requests to 20 packets per second and to set the interface monitoring interval to 5 consecutive seconds:

Switch# config terminal

Switch(config)# interface fa6/1

Switch(config-if)# ip arp inspection limit rate 20 burst interval 5

Switch(config-if)# end

Related Commands

ip arp inspection log-buffer

To configure the parameters that are associated with the logging buffer, use the ip arp inspection log-buffer command. To disable the parameters, use the no form of this command.

ip arp inspection log-buffer {entries number | logs number interval seconds}

no ip arp inspection log-buffer {entries | logs}

Syntax Description

Defaults

When dynamic ARP inspection is enabled, denied, or dropped, the ARP packets are logged.

The number of entries is set to 32.

The number of logging entries is limited to 5 per second.

The interval is set to 1.

Command Modes

Global configuration mode

Usage Guidelines

The first dropped packet of a given flow is logged immediately. The subsequent packets for the same flow are registered but are not logged immediately. Registering these packets is done in a log buffer that is shared by all the VLANs. Entries from this buffer are logged on a rate-controlled basis.

Examples

This example shows how to configure the logging buffer to hold up to 45 entries:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection log-buffer entries 45

Switch(config)# end

Switch# show ip arp inspection log 

Total Log Buffer Size : 45

Syslog rate : 5 entries per 1 seconds.

No entries in log buffer.

Switch#

This example shows how to configure the logging rate to 10 logs per 3 seconds:

Switch(config)# ip arp inspection log-buffer logs 10 interval 3

Switch(config)# end

Switch# show ip arp inspection log

Total Log Buffer Size : 45

Syslog rate : 10 entries per 3 seconds.

No entries in log buffer.

Switch# 

Related Commands

ip arp inspection trust

To set a per-port configurable trust state that determines the set of interfaces where incoming ARP packets are inspected, use the ip arp inspection trust command. To make the interfaces untrusted, use the no form of this command.

ip arp inspection trust

no ip arp inspection trust

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Interface configuration mode

Examples

This example shows how to configure an interface to be trusted:

Switch# config terminal

Switch(config)# interface fastEthernet 6/3

Switch(config-if)# ip arp inspection trust 

Switch(config-if)# end

To verify the configuration, use the show form of this command:

Switch# show ip arp inspection interfaces fastEthernet 6/3

 Interface        Trust State     Rate (pps)     Burst Interval

 ---------------  -----------     ----------     --------------

 Fa6/3            Trusted               None                  1

Switch#

Related Commands

ip arp inspection validate

To perform specific checks for ARP inspection, use the ip arp inspection validate command. To disable checks, use the no form of this command.

ip arp inspection validate [src-mac] [dst-mac] [ip]

no ip arp inspection validate [src-mac] [dst-mac] [ip]

Syntax Description

Defaults

Checks are disabled.

Command Modes

Global configuration mode

Usage Guidelines

When enabling the checks, specify at least one of the keywords (src-mac, dst-mac, and ip) on the command line. Each command overrides the configuration of the previous command. If a command enables src and dst mac validations, and a second command enables IP validation only, the src and dst mac validations are disabled as a result of the second command.

The no form of this command disables only the specified checks. If none of the check options are enabled, all the checks are disabled.

Examples

This example show how to enable the source MAC validation:

Switch(config)# ip arp inspection validate src-mac 

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Deny             Deny 

Switch#

Related Commands

ip arp inspection vlan

To enable dynamic ARP inspection (DAI) on a per-VLAN basis, use the ip arp inspection vlan command. To disable DAI, use the no form of this command.

ip arp inspection vlan vlan-range

no ip arp inspection vlan vlan-range

Syntax Description

Defaults

ARP inspection is disabled on all VLANs.

Command Modes

Global configuration mode

Usage Guidelines

You must specify on which VLANs to enable DAI. DAI may not function on the configured VLANs if they have not been created or if they are private.

Examples

This example shows how to enable DAI on VLAN 1:

Switch# configure terminal

Switch(config)# ip arp inspection vlan 1

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Disabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Deny             Deny  

Switch# 

This example shows how to disable DAI on VLAN 1:

Switch# configure terminal

Switch(config)# no ip arp inspection vlan 1

Switch(config)# 

Related Commands

ip arp inspection vlan logging

To control the type of packets that are logged, use the ip arp inspection vlan logging command. To disable this logging control, use the no form of this command.

ip arp inspection vlan vlan-range logging {acl-match {matchlog | none} | dhcp-bindings {permit | all | none}}

no ip arp inspection vlan vlan-range logging {acl-match | dhcp-bindings}

Syntax Description

Defaults

All denied or dropped packets are logged.

Command Modes

Global configuration mode

Usage Guidelines

The acl-match and dhcp-bindings keywords merge with each other. When you set an ACL match configuration, the DHCP bindings configuration is not disabled. You can use the no form of this command to reset some of the logging criteria to their defaults. If you do not specify either option, all the logging types are reset to log on when the ARP packets are denied. The two options that are available to you are as follows:

•acl-match—Logging on ACL matches is reset to log on deny

•dhcp-bindings—Logging on DHCP binding compared is reset to log on deny

Examples

This example shows how to configure an ARP inspection on VLAN 1 to add packets to a log on matching against the ACLs with the logging keyword:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection vlan 1 logging acl-match matchlog 

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Acl-Match        Deny  

Switch#

Related Commands

ip cef load-sharing algorithm

To configure the load-sharing hash function so that the source TCP/UDP port, the destination TCP/UDP port, or both ports can be included in the hash in addition to the source and destination IP addresses, use the ip cef load-sharing algorithm command. To revert back to the default, which does not include the ports, use the no form of this command.

ip cef load-sharing algorithm {include-ports {source source | destination dest} | original | tunnel | universal}

no ip cef load-sharing algorithm {include-ports {source source | destination dest} | original | tunnel | universal}

Syntax Description

Defaults

Default load-sharing algorithm is disabled.

Note This option does not include the source or destination port in the load-balancing hash.

Command Modes

Global configuration mode

Usage Guidelines

The original algorithm, tunnel algorithm, and universal algorithm are routed through the hardware. For software-routed packets, the algorithms are handled by the software. The include-ports option does not apply to the software-switched traffic.

Examples

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 ports:

Switch(config)# ip cef load-sharing algorithm include-ports

Switch(config)# 

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 tunneling ports:

Switch(config)# ip cef load-sharing algorithm include-ports tunnel

Switch(config)# 

Related Commands

ip device tracking maximum

To enable IP port security binding tracking on a Layer 2 port, use the ip device tracking maximum command. To disable IP port security on untrusted Layer 2 interfaces, use the no form of this command.

ip device tracking maximum {number}

no ip device tracking maximum {number}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Interface configuration mode

Examples

This example shows how to enable IP port security with IP-MAC filters on a Layer 2 access port:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip device tracking

Switch(config)# interface fastethernet 4/3

Switch(config-if)# switchport mode access 

Switch(config-if)# switchport access vlan 1

Switch(config-if)# ip device tracking maximum 5

Switch(config-if)# switchport port-security 

Switch(config-if)# switchport port-security maximum 5

Switch(config-if)# ip verify source tracking port-security 

Switch(config-if)# end 

You can verify your settings by entering the show ip verify source privileged EXEC command.

Related Commands

ip dhcp snooping

To enable DHCP snooping globally, use the ip dhcp snooping command. To disable DHCP snooping, use the no form of this command.

ip dhcp snooping

no ip dhcp snooping

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP snooping is disabled.

Command Modes

Global configuration mode

Usage Guidelines

You must enable DHCP snooping globally before you can use DHCP snooping on a VLAN.

Examples

This example shows how to enable DHCP snooping:

Switch(config)# ip dhcp snooping

Switch(config)# 

This example shows how to disable DHCP snooping:

Switch(config)# no ip dhcp snooping 

Switch(config)# 

Related Commands

ip dhcp snooping binding

To set up and generate a DHCP binding configuration to restore bindings across reboots, use the ip dhcp snooping binding command. To disable the binding configuration, use the no form of this command.

ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface expiry seconds

no ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Usage Guidelines

Whenever a binding is added or removed using this command, the binding database is marked as changed and a write is initiated.

Examples

This example shows how to generate a DHCP binding configuration on interface gigabitethernet1/1 in VLAN 1 with an expiration time of 1000 seconds:

Switch# ip dhcp snooping binding 0001.1234.1234 vlan 1 172.20.50.5 interface gi1/1 expiry 1000

Switch#

Related Commands

ip dhcp snooping database

To store the bindings that are generated by DHCP snooping, use the ip dhcp snooping database command. To either reset the timeout, reset the write-delay, or delete the agent specified by the URL, use the no form of this command.

ip dhcp snooping database {url | timeout seconds | write-delay seconds}

no ip dhcp snooping database {timeout | write-delay}

Syntax Description

Defaults

The timeout value is set to 300 seconds (5 minutes).

The write-delay value is set to 300 seconds.

Command Modes

Interface configuration mode

Usage Guidelines

You need to create an empty file at the configured URL on network-based URLs (such as TFTP and FTP) before the switch can write the set of bindings for the first time at the URL.

Note Because both NVRAM and bootflash have limited storage capacity, using TFTP or network-based files is recommended . If you use flash to store the database file, new updates (by the agent) result in the creation of new files (flash fills quickly). In addition, due to the nature of the file system used on the flash, a large number of files causes access to be considerably slowed. When a file is stored in a remote location accessible through TFTP, an RPR/SSO standby supervisor engine can take over the binding list when a switchover occurs.

Examples

This example shows how to store a database file with the IP address 10.1.1.1 within a directory called directory. A file named file must be present on the TFTP server.

Switch# config terminal

Switch(config)# ip dhcp snooping database tftp://10.1.1.1/directory/file

Switch(config)# end

Switch# show ip dhcp snooping database 

Agent URL : tftp://10.1.1.1/directory/file

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : Yes

Delay Timer Expiry : Not Running

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : None

Last Failed Reason : No failure recorded.

Total Attempts       :        1   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :        0

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :        0

Media Failures       :        0

Switch#

Related Commands

ip dhcp snooping information option

To enable DHCP option 82 data insertion, use the ip dhcp snooping information option command. To disable DHCP option 82 data insertion, use the no form of this command.

ip dhcp snooping information option format remote-id {hostname | string {word}}

no ip dhcp snooping information option format remote-id {hostname | string {word}}

Syntax Description

Defaults

DHCP option 82 data insertion is enabled.

Command Modes

Global configuration mode

Usage Guidelines

If the hostname is longer than 63 characters it is truncated to 63 characters in the remote ID.

Examples

This example shows how to enable DHCP option 82 data insertion:

Switch(config)# ip dhcp snooping information option

Switch(config)# 

This example shows how to disable DHCP option 82 data insertion:

Switch(config)# no ip dhcp snooping information option

Switch(config)# 

This example shows how to configure the hostname as the remote ID:

Switch(config)# ip dhcp snooping information option format remote-id hostname

Switch(config)# 

The following example shows how to enable DHCP Snooping on VLAN 500 through 555 and option 82 remote ID:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 500 555

Switch(config)# ip dhcp snooping information option format remote-id string switch123

Switch(config)# interface GigabitEthernet 5/1

Switch(config-if)# ip dhcp snooping trust

Switch(config-if)# ip dhcp snooping limit rate 100

Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id 
string customer-555

Switch(config-if)# interface FastEthernet 2/1

Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id 
string customer-500

Switch(config)# end

Related Commands

ip dhcp snooping information option allow-untrusted

To allow DHCP packets with option 82 data inserted to be received from a snooping untrusted port, use the ip dhcp snooping information option allow-untrusted command. To disallow receipt of these DHCP packets, use the no form of this command.

ip dhcp snooping information option allow-untrusted

no ip dhcp snooping information option allow-untrusted

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP packets with option 82 are not allowed on snooping untrusted ports.

Command Modes

Global configuration mode

Examples

This example shows how to allow DHCP packets with option 82 data inserted to be received from a snooping untrusted port:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# ip dhcp snooping information option allow-untrusted

Switch(config)# end

Switch#

Related Commands

ip dhcp snooping limit rate

To configure the number of the DHCP messages that an interface can receive per second, use the ip dhcp snooping limit rate command. To disable the DHCP snooping rate limiting, use the no form of this command.

ip dhcp snooping limit rate rate

no ip dhcp snooping limit rate

Syntax Description

Defaults

DHCP snooping rate limiting is disabled.

Command Modes

Interface configuration mode

Usage Guidelines

Typically, the rate limit applies to the untrusted interfaces. If you want to set up rate limiting for the trusted interfaces, note that the trusted interfaces aggregate all DHCP traffic in the switch, and you will need to adjust the rate limit of the interfaces to a higher value.

Examples

This example shows how to enable the DHCP message rate limiting:

Switch(config-if)# ip dhcp snooping limit rate 150

Switch(config)# 

This example shows how to disable the DHCP message rate limiting:

Switch(config-if)# no ip dhcp snooping limit rate

Switch(config)# 

Related Commands

ip dhcp snooping trust

To configure an interface as trusted for DHCP snooping purposes, use the ip dhcp snooping trust command. To configure an interface as untrusted, use the no form of this command.

ip dhcp snooping trust

no ip dhcp snooping trust

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP snooping trust is disabled.

Command Modes

Interface configuration mode

This example shows how to enable DHCP snooping trust on an interface:

Switch(config-if)# ip dhcp snooping trust

Switch(config)# 

This example shows how to disable DHCP snooping trust on an interface:

Switch(config-if)# no ip dhcp snooping trust

Switch(config)# 

Related Commands

ip dhcp snooping vlan

Use the ip dhcp snooping vlan command to enable DHCP snooping on a VLAN. To disable DHCP snooping on a VLAN, use the no form of this command.

ip dhcp snooping [vlan number]

no ip dhcp snooping [vlan number]

Syntax Description

Defaults

DHCP snooping is disabled.

Command Modes

Global configuration mode

Usage Guidelines

DHCP snooping is enabled on a VLAN only if both global snooping and the VLAN snooping are enabled.

Examples

This example shows how to enable DHCP snooping on a VLAN:

Switch(config)# ip dhcp snooping vlan 10

Switch(config)# 

This example shows how to disable DHCP snooping on a VLAN:

Switch(config)# no ip dhcp snooping vlan 10

Switch(config)# 

This example shows how to enable DHCP snooping on a group of VLANs:

Switch(config)# ip dhcp snooping vlan 10 55

Switch(config)# 

This example shows how to disable DHCP snooping on a group of VLANs:

Switch(config)# no ip dhcp snooping vlan 10 55

Switch(config)# 

Related Commands

ip dhcp snooping vlan information option format-type circuit-id string

To enable circuit-id (a suboption of DHCP snooping option 82) on a VLAN, use the ip dhcp snooping vlan information option format-type circuit-id string command. To disable circuit-id on a VLAN, use the no form of this command.

ip dhcp snooping vlan number information option format-type circuit-id [override] string string

no ip dhcp snooping vlan number information option format-type circuit-id [override] string

Syntax Description

Defaults

VLAN-mod-port, if DHCP snooping option-82 is disabled.

Command Modes

Interface configuration

Usage Guidelines

The circuit-id suboption of DHCP option 82 is supported only when DHCP snooping is globally enabled and on VLANs using DHCP option 82.

This command allows you to configure a string of ASCII characters to be the circuit ID. When you want to override the vlan-mod-port format type and instead use the circuit-ID to define subscriber information, use the override keyword.

Examples

The following example shows how to enable DHCP snooping on VLAN 500 through 555 and option 82 circuit-id:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 500 555

Switch(config)# ip dhcp snooping information option format remote-id string switch123

Switch(config)# interface GigabitEthernet 5/1

Switch(config-if)# ip dhcp snooping trust

Switch(config-if)# ip dhcp snooping limit rate 100

Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id 
string customer-555

Switch(config-if)# interface FastEthernet 2/1

Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id 
string customer-500

Switch(config)# end

This example shows how to configure the option-82 circuit-ID override suboption:

Switch(config-if)# ip dhcp snooping vlan 250 information option format-type circuit-id 

override string testcustomer

You can verify your settings by entering the show ip dhcp snooping user EXEC command.

Note The show ip dhcp snooping user EXEC command only displays the global command output, including a remote-ID configuration. It does not display any per-interface, per-VLAN string that you have configured for the circuit ID.

Related Commands

ip igmp filter

To control whether all hosts on a Layer 2 interface can join one or more IP multicast groups by applying an IGMP profile to the interface, use the ip igmp filter command. To remove a profile from the interface, use the no form of this command.

ip igmp filter profile number

no ip igmp filter

Syntax Description

Defaults

Profiles are not applied.

Command Modes

Interface configuration mode

Usage Guidelines

You can apply IGMP filters only to Layer 2 physical interfaces; you cannot apply IGMP filters to routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group.

An IGMP profile can be applied to one or more switch port interfaces, but one port can have only one profile applied to it.

Examples

This example shows how to apply IGMP profile 22 to an interface:

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip igmp filter 22

Switch(config-if)# 

Related Commands

ip igmp max-groups

To set the maximum number of IGMP groups that a Layer 2 interface can join, use the ip igmp max-groups command. To set the maximum back to the default, use the no form of this command.

ip igmp max-groups number

no ip igmp max-groups

Syntax Description

Defaults

No maximum limit.

Command Modes

Interface configuration mode

Usage Guidelines

You can use the ip igmp max-groups command only on Layer 2 physical interfaces; you cannot set the IGMP maximum groups for the routed ports, the switch virtual interfaces (SVIs), or the ports that belong to an EtherChannel group.

Examples

This example shows how to limit the number of IGMP groups that an interface can join to 25:

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip igmp max-groups 25

Switch(config-if)

ip igmp profile

To create an IGMP profile, use the ip igmp profile command. To delete the IGMP profile, use the no form of this command.

ip igmp profile profile number

no ip igmp profile profile number

Syntax Description

Defaults

No profile created.

Command Modes

Global configuration mode

IGMP profile configuration

Usage Guidelines

When entering a range, enter the low IP multicast address, a space, and the high IP multicast address.

You can apply an IGMP profile to one or more Layer 2 interfaces, but each interface can have only one profile applied to it.

Examples

This example shows how to configure IGMP profile 40 that permits the specified range of IP multicast addresses:

Switch # config terminal

Switch(config)# ip igmp profile 40

Switch(config-igmp-profile)# permit

Switch(config-igmp-profile)# range 233.1.1.1 233.255.255.255

Switch(config-igmp-profile)# 

Related Commands

ip igmp query-interval

To configure the frequency that the switch sends the IGMP host-query messages, use the ip igmp query-interval command. To return to the default frequency, use the no form of this command.

ip igmp query-interval seconds

no ip igmp query-interval

Syntax Description

Defaults

The query interval is set to 60 seconds.

Command Modes

Interface configuration mode

Usage Guidelines

If you use the default IGMP snooping configuration, the valid query interval values are from 1 to 65535 seconds. If you have changed the default configuration to support CGMP as the IGMP snooping learning method, the valid query interval values are from 1 to 300 seconds.

The designated switch for a LAN is the only switch that sends the IGMP host-query messages. For IGMP version 1, the designated switch is elected according to the multicast routing protocol that runs on the LAN. For IGMP version 2, the designated querier is the lowest IP-addressed multicast switch on the subnet.

If no queries are heard for the timeout period (controlled by the ip igmp query-timeout command), the switch becomes the querier.

Note Changing the timeout period may severely impact multicast forwarding.

Examples

This example shows how to change the frequency at which the designated switch sends the IGMP host-query messages:

Switch(config-if)# ip igmp query-interval 120

Switch(config-if)# 

Related Commands

ip igmp snooping

To enable IGMP snooping, use the ip igmp snooping command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping [tcn {flood query count count | query solicit}]

no ip igmp snooping [tcn {flood query count count | query solicit}]

Syntax Description

Defaults

IGMP snooping is enabled.

Command Modes

Global configuration mode

Interface configuration mode

Usage Guidelines

The tcn flood option applies only to Layer 2 switch ports and EtherChannels; it does not apply to routed ports, VLAN interfaces, or Layer 3 channels.

The ip igmp snooping command is disabled by default on multicast routers.

Note You can use the tcn flood option in interface configuration mode.

Examples

This example shows how to enable IGMP snooping:

Switch(config)# ip igmp snooping

Switch(config)# 

This example shows how to disable IGMP snooping:

Switch(config)# no ip igmp snooping

Switch(config)# 

This example shows how to enable the flooding of the spanning tree table to the network after nine topology changes have occurred:

Switch(config)# ip igmp snooping tcn flood query count 9

Switch(config)# 

This example shows how to disable the flooding of the spanning tree table to the network:

Switch(config)# no ip igmp snooping tcn flood

Switch(config)# 

This example shows how to enable an IGMP general query:

Switch(config)# ip igmp snooping tcn query solicit

Switch(config)# 

This example shows how to disable an IGMP general query:

Switch(config)# no ip igmp snooping tcn query solicit

Switch(config)# 

Related Commands

ip igmp snooping report-suppression

To enable report suppression, use the ip igmp snooping report-suppression command. To disable report suppression and forward the reports to the multicast devices, use the no form of this command.

ip igmp snooping report-suppression

no igmp snooping report-suppression

Syntax Description

This command has no arguments or keywords.

Defaults

IGMP snooping report-suppression is enabled.

Command Modes

Global configuration mode

Usage Guidelines

If the ip igmp snooping report-suppression command is disabled, all the IGMP reports are forwarded to the multicast devices.

If the command is enabled, report suppression is done by IGMP snooping.

Examples

This example shows how to enable report suppression:

Switch(config)# ip igmp snooping report-suppression

Switch(config)# 

This example shows how to disable report suppression:

Switch(config)# no ip igmp snooping report-suppression

Switch(config)# 

This example shows how to display the system status for report suppression:

Switch# show ip igmp snoop

vlan 1

----------

 IGMP snooping is globally enabled

 IGMP snooping TCN solicit query is globally disabled

 IGMP snooping global TCN flood query count is 2

 IGMP snooping is enabled on this Vlan

 IGMP snooping immediate-leave is disabled on this Vlan

 IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan

 IGMP snooping is running in IGMP_ONLY mode on this Vlan

 IGMP snooping report suppression is enabled on this Vlan 

Switch#

Related Commands

ip igmp snooping vlan

To enable IGMP snooping for a VLAN, use the ip igmp snooping vlan command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping vlan vlan-id

no ip igmp snooping vlan vlan-id

Syntax Description

Defaults

IGMP snooping is disabled.

Command Modes

Global configuration mode

Usage Guidelines

This command is entered in VLAN interface configuration mode only.

The ip igmp snooping vlan command is disabled by default on multicast routers.

Examples

This example shows how to enable IGMP snooping on a VLAN:

Switch(config)# ip igmp snooping vlan 200

Switch(config)# 

This example shows how to disable IGMP snooping on a VLAN:

Switch(config)# no ip igmp snooping vlan 200

Switch(config)# 

Related Commands

ip igmp snooping vlan explicit-tracking

To enable per-VLAN explicit host tracking, use the ip igmp snooping vlan explicit-tracking command. To disable explicit host tracking, use the no form of this command.

ip igmp snooping vlan vlan-id explicit-tracking

no ip igmp snooping vlan vlan-id explicit-tracking

Syntax Description

Defaults

Explicit host tracking is enabled.

Command Modes

Global configuration mode

Examples

This example shows how to disable IGMP explicit host tracking on interface VLAN 200 and how to verify the configuration:

Switch(config)# no ip igmp snooping vlan 200 explicit-tracking 

Switch(config)# end 

Switch# show ip igmp snooping vlan 200 | include explicit tracking

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping             : Enabled

IGMPv3 snooping           : Enabled

Report suppression        : Enabled

TCN solicit query         : Disabled

TCN flood query count     : 2

Vlan 2:

--------

IGMP snooping                  : Enabled

IGMPv2 immediate leave         : Disabled

Explicit host tracking         : Disabled

Multicast router learning mode : pim-dvmrp

CGMP interoperability mode     : IGMP_ONLY

Explicit host tracking         : Disabled

Switch#

Related Commands

ip igmp snooping vlan immediate-leave

To enable IGMP immediate-leave processing, use the ip igmp snooping vlan immediate-leave command. To disable immediate-leave processing, use the no form of this command.

ip igmp snooping vlan vlan_num immediate-leave

no ip igmp snooping vlan vlan_num immediate-leave

Syntax Description

Defaults

Immediate leave processing is disabled.

Command Modes

Global configuration mode

Usage Guidelines

You enter this command in global configuration mode only.

Use the immediate-leave feature only when there is a single receiver for the MAC group for a specific VLAN.

The immediate-leave feature is supported only with IGMP version 2 hosts.

Examples

This example shows how to enable IGMP immediate-leave processing on VLAN 4:

Switch(config)# ip igmp snooping vlan 4 immediate-leave

Switch(config)# 

This example shows how to disable IGMP immediate-leave processing on VLAN 4:

Switch(config)# no ip igmp snooping vlan 4 immediate-leave

Switch(config)# 

Related Commands

ip igmp snooping vlan mrouter

To statically configure an Layer 2 interface as a multicast router interface for a VLAN, use the
ip igmp snooping vlan mrouter command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan-id mrouter {interface {{fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet slot/port} | {port-channel number}} |
{learn {cgmp | pim-dvmrp}}

no ip igmp snooping vlan vlan-id mrouter {interface {{fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet slot/port} | {port-channel number}} |
{learn {cgmp | pim-dvmrp}}

Syntax Description

Defaults

Multicast switch snooping PIM-DVMRP packets are specified.

Command Modes

Interface configuration mode

Usage Guidelines

You enter this command in VLAN interface configuration mode only.

The interface to the switch must be in the VLAN where you are entering the command. It must be both administratively up and line protocol up.

The CGMP learning method can decrease control traffic.

The learning method that you configure is saved in NVRAM.

The static connections to multicast interfaces are supported only on switch interfaces.

Examples

This example shows how to specify the next-hop interface to a multicast switch:

Switch(config-if)# ip igmp snooping 400 mrouter interface fastethernet 5/6

Switch(config-if)# 

This example shows how to specify the multicast switch learning method:

Switch(config-if)# ip igmp snooping 400 mrouter learn cgmp

Switch(config-if)# 

Related Commands

ip igmp snooping vlan static

To configure a Layer 2 interface as a member of a group, use the ip igmp snooping vlan static command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan_num static mac-address {interface {fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet slot/port} | {port-channel number}}

no ip igmp snooping vlan vlan_num static mac-address {interface {fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet mod/interface-number} | {port-channel number}}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Examples

This example shows how to configure a host statically on an interface:

Switch(config)# ip igmp snooping vlan 4 static 0100.5e02.0203 interface fastethernet 5/11

Configuring port FastEthernet5/11 on group 0100.5e02.0203 vlan 4

Switch(config)# 

Related Commands

ip local-proxy-arp

To enable the local proxy ARP feature, use the ip local-proxy-arp command. To disable the local proxy ARP feature, use the no form of this command.

ip local-proxy-arp

no ip local-proxy-arp

Syntax Description

This command has no arguments or keywords.

Defaults

Local proxy ARP is disabled.

Command Modes

Interface configuration mode

Usage Guidelines

Use this feature only on subnets where hosts are intentionally prevented from communicating directly to the switch on which they are connected.

ICMP redirect is disabled on interfaces where the local proxy ARP feature is enabled.

Examples

This example shows how to enable the local proxy ARP feature:

Switch(config-if)# ip local-proxy-arp

Switch(config-if)# 

ip mfib fastdrop

To enable MFIB fast drop, use the ip mfib fastdrop command. To disable MFIB fast drop, use the no form of this command.

ip mfib fastdrop

no ip mfib fastdrop

Syntax Description

This command has no arguments or keywords.

Defaults

MFIB fast drop is enabled.

Command Modes

Privileged EXEC mode

Examples

This example shows how to enable MFIB fast drops:

Switch# ip mfib fastdrop

Switch#

Related Commands

ip multicast multipath

To enable load splitting of IP multicast traffic over Equal Cost Multipath (ECMP), use the
ip multicast multipath command in global configuration mode. To disable this functionality, use the no form of this command.

ip multicast [vrf vrf-name] multipath [s-g-hash {basic | next-hop-based}]

no ip multicast [vrf vrf-name] multipath [s-g-hash {basic | next-hop-based}]

Syntax Description

Command Default

If multiple equal-cost paths exist, multicast traffic will not be load-split across those paths.

Command Modes

Global configuration (config)

Usage Guidelines

The ip multicast multipath command does not work with bidirectional Protocol Independent Multicast (PIM).

Use the ip multicast multipath command to enable load splitting of IP multicast traffic across multiple equal-cost paths.

If two or more equal-cost paths from a source are available, unicast traffic will be load-split across those paths. However, by default, multicast traffic is not load-split across multiple equal-cost paths. In general, multicast traffic flows down from the reverse path forwarding (RPF) neighbor. According to the PIM specifications, this neighbor must have the highest IP address if more than one neighbor has the same metric.

When you configue load splitting with the ip multicast multipath command, the system splits multicast traffic across multiple equal-cost paths based on source address using the S-hash algorithm. When the ip multicast multipath command is configured and multiple equal-cost paths exist, the path in which multicast traffic will travel is selected based on the source IP address. Multicast traffic from different sources will be load-split across the different equal-cost paths. Load splitting will not occur across equal-cost paths for multicast traffic from the same source sent to different multicast groups.

Note The ip multicast multipath command load splits the traffic but does not load balance the traffic. Traffic from a source will use only one path, even if the traffic greatly exceeds traffic from other sources.

If the ip multicast multipath command is configured with the s-g-hash keyword and multiple equal-cost paths exist, load splitting will occur across equal-cost paths based on source and group address or on source, group, and next-hop address. If you specify the optional s-g-hash keyword for load splitting IP multicast traffic, you must select the algorithm used to calculate the equal-cost paths by specifying one of the following keywords:

•basic—The basic S-G-hash algorithm is predictable because no randomization is used in calculating the hash value. The basic S-G-hash algorithm, however, is subject to polarization because for a given source and group the same hash is always chosen irrespective of the router that the hash is being calculated on.

•next-hop-based—The next-hop-based S-G-hash algorithm is predictable because no randomization is used to determine the hash value. Unlike the S-hash and basic S-G-hash algorithms, the next-hop-based hash mechanism is not subject to polarization.

Examples

The following example shows how to enable ECMP multicast load splitting on a router based on source address using the S-hash algorithm:

Switch(config)# ip multicast multipath

The following example shows how to enable ECMP multicast load splitting on a router based on source and group address using the basic S-G-hash algorithm:

Switch(config)# ip multicast multipath s-g-hash basic

The following example shows how to enable ECMP multicast load splitting on a router based on source, group, and next-hop address using the next-hop-based S-G-hash algorithm:

Switch(config)# ip multicast multipath s-g-hash next-hop-based

ip source binding

To add or delete a static IP source binding entry, use the ip source binding command. To delete the corresponding IP source binding entry, use the no form of this command.

ip source binding ip-address mac-address vlan vlan-id interface interface-name

no ip source binding ip-address mac-address vlan vlan-id interface interface-name

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Usage Guidelines

The ip source binding command is used to add a static IP source binding entry only.

The no form of this command deletes the corresponding IP source binding entry. For the deletion to succeed, all required parameters must match.

Each static IP binding entry is keyed by a MAC address and VLAN number. If the CLI contains an existing MAC and VLAN, the existing binding entry will be updated with the new parameters; a separate binding entry will not be created.

Examples

This example shows how to configure the static IP source binding:

Switch# config terminal

Switch(config)# ip source binding 11.0.0.1 0000.000A.000B vlan 10 interface 
fastethernet6/10

Switch(config)#

Related Commands

ip sticky-arp

To enable sticky ARP, use the ip sticky-arp command. Use the no form of this command to disable sticky ARP.

ip sticky-arp

no ip sticky-arp

Syntax Description

This command has no arguments or keywords.

Defaults

Enabled

Command Modes

Global configuration mode

Usage Guidelines

This command is supported on PVLANs only.

ARP entries that are learned on Layer 3 PVLAN interfaces are sticky ARP entries. (You should display and verify ARP entries on the PVLAN interface using the show arp command).

For security reasons, sticky ARP entries on the PVLAN interface do not age out. Connecting new equipment with the same IP address generates a message and the ARP entry is not created.

Because the ARP entries on the PVLAN interface do not age out, you must manually remove ARP entries on the PVLAN interface if a MAC address changes.

Unlike static entries, sticky-ARP entries are not stored and restored when you enter the reboot and restart commands.

Examples

This example shows how to enable sticky ARP:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config) ip sticky-arp

Switch(config)# end

Switch#

This example shows how to disable sticky ARP:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config) no ip sticky-arp

Switch(config)# end

Switch#

Related Commands

ip verify header vlan all

To enable IP header validation for Layer 2-switched IPv4 packets, use the ip verify header vlan all command. To disable the IP header validation, use the no form of this command.

ip verify header vlan all

no ip verify header vlan all

Syntax Description

This command has no default settings.

Defaults

The IP header is validated for bridged and routed IPv4 packets.

Command Modes

Global configuration mode

Usage Guidelines

This command does not apply to Layer 3-switched (routed) packets.

The Catalyst 4500 series switch checks the validity of the following fields in the IPv4 header for all switched IPv4 packets:

•The version must be 4.

•The header length must be greater than or equal to 20 bytes.

•The total length must be greater than or equal to four times the header length and greater than the Layer 2 packet size minus the Layer 2 encapsulation size.

If an IPv4 packet fails the IP header validation, the packet is dropped. If you disable the header validation, the packets with the invalid IP headers are bridged but are not routed even if routing was intended. The IPv4 access lists also are not applied to the IP headers.

Examples

This example shows how to disable the IP header validation for the Layer 2-switched IPv4 packets:

Switch# config terminal

Switch(config)# no ip verify header vlan all

Switch(config)# end

Switch#

ip verify source

To enable IP source guard on untrusted Layer 2 interfaces, use the ip verify source command. To disable IP source guard on untrusted Layer 2 interfaces, use the no form of this command.

ip verify source {vlan dhcp-snooping | tracking} [port-security]

no ip verify source {vlan dhcp-snooping | tracking} [port-security]

Syntax Description

Defaults

IP source guard is disabled.

Command Modes

Global configuration mode

Examples

This example shows how to enable IP source guard on VLANs 10 through 20 on a per-port basis:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 10 20

Switch(config)# interface fastethernet6/1

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk native vlan 10

Switch(config-if)# switchport trunk allowed vlan 11-20

Switch(config-if)# no ip dhcp snooping trust

Switch(config-if)# ip verify source vlan dhcp-snooping

Switch(config)# end

Switch# show ip verify source interface f6/1

Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan

---------  -----------  -----------  ---------------  -----------------  ----------

Fa6/1      ip-mac       active       10.0.0.1                            10  

Fa6/1      ip-mac       active       deny-all                            11-20  

Switch#

This example shows how to enable IP port security with IP-MAC filters on a Layer 2 access port:

Switch# configure terminal 

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip device tracking

Switch(config)# interface fastEthernet 4/3

Switch(config-if)# switchport mode access 

Switch(config-if)# switchport access vlan 1

Switch(config-if)# ip device tracking maximum 5

Switch(config-if)# switchport port-security 

Switch(config-if)# switchport port-security maximum 5

Switch(config-if)# ip verify source tracking port-security 

Switch(config-if)# end

You can verify your settings by entering the show ip verify source privileged EXEC command.

Related Commands

ip verify unicast source reachable-via

To enable and configure unicast RPF checks on a IPv4 interface, use the ip verify unicast source reachable-via command. To disable unicast RPF, use the no form of this command.

ip verify unicast source reachable-via rx allow-default

no ip verify unicast source reachable-via

Syntax Description

Defaults

Disabled

Command Modes

Interface configuration mode

Usage Guidelines

Note Unicast RPF is an input function and is applied only on the input interface of a router at the upstream end of a connection.

Do not use unicast RPF on internal network interfaces. Internal interfaces might have routing asymmetry, which means that there are multiple routes to the source of a packet. Apply unicast RPF only where there is natural or configured symmetry.

Examples

This example shows how to enable unicast RPF exist-only checking mode:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip verify unicast source reachable-via rx allow-default

Switch(config-if)# end

Switch#

Related Commands

ip wccp

To enable support of the specified Web Cache Communication Protocol (WCCP) service for participation in a service group, use the ip wccp command in global configuration mode. To disable the service group, use the no form of this command.

ip wccp {web-cache | service-number} [accelerated] [group-address multicast-address] [redirect-list access-list] [group-list access-list] [password [0 | 7] password]

no ip wccp {web-cache | service-number}[accelerated] [group-address multicast-address] [redirect-list access-list] [group-list access-list] [password [0 | 7] password]

Syntax Description

Command Default

WCCP services are not enabled on the router.

Command Modes

Global configuration (config)

Usage Guidelines

This command instructs a router to enable or disable the support for the specified service number or the web-cache service name. A service number can be from 0 to 254. Once the service number or name is enabled, the router can participate in the establishment of a service group.

When the no ip wccp command is entered, the router terminates participation in the service group, deallocates space if none of the interfaces still has the service configured, and terminates the WCCP task if no other services are configured.

The keywords following the web-cache keyword and the service-number argument are optional and may be specified in any order, but only may be specified once. The following sections outline the specific usage of each of the optional forms of this command.

ip wccp {web-cache | service-number} group-address multicast-address

A WCCP group address can be configured to set up a multicast address that cooperating routers and web caches can use to exchange WCCP protocol messages. If such an address is used, IP multicast routing must be enabled so that the messages that use the configured group (multicast) addresses are received correctly.

This option instructs the router to use the specified multicast IP address to coalesce the "I See You" responses for the "Here I Am" messages that it has received on this group address. The response is sent to the group address as well. The default is for no group address to be configured, in which case all "Here I Am" messages are responded to with a unicast reply.

ip wccp {web-cache | service-number} redirect-list access-list

This option instructs the router to use an access list to control the traffic that is redirected to the web caches of the service group specified by the service name given. The access-list argument specifies either the number or the name of a standard or extended access list. The access list itself specifies which traffic is permitted to be redirected. The default is for no redirect list to be configured (all traffic is redirected).

WCCP requires that the following protocol and ports not be filtered by any access lists:

•User Datagram Protocol (UDP) (protocol type 17) port 2048. This port is used for control signaling. Blocking this type of traffic will prevent WCCP from establishing a connection between the router and cache engines.

ip wccp {web-cache | service-number} group-list access-list

This option instructs the router to use an access list to control the cache engines that are allowed to participate in the specified service group. The access-list argument specifies either the number of a standard or extended access list or the name of any type of named access list. The access list itself specifies which cache engines are permitted to participate in the service group. The default is for no group list to be configured, in which case all cache engines may participate in the service group.

Note The ip wccp {web-cache | service-number} group-list command syntax resembles the ip wccp {web-cache | service-number} group-listen command, but these are entirely different commands. The ip wccp group-listen command is an interface configuration command used to configure an interface to listen for multicast notifications from a cache cluster. Refer to the description of the ip wccp group-listen command in the Cisco IOS IP Application Services Command Reference.

ip wccp {web-cache | service-number} password password

This option instructs the router to use MD5 authentication on the messages received from the service group specified by the service name given. Use this form of the command to set the password on the router. You must also configure the same password separately on each web cache. The password can be up to a maximum of eight characters. Messages that do not authenticate when authentication is enabled on the router are discarded. The default is for no authentication password to be configured and for authentication to be disabled.

Examples

The following example shows how to configure a router to run WCCP reverse-proxy service, using the multicast address of 239.0.0.0:

Router(config)# ip multicast-routing

Router(config)# ip wccp 99 group-address 239.0.0.0

Router(config)# interface gigabitethernet 3/1

Router(config-if)# ip wccp 99 group-listen

The following example shows how to configure a router to redirect web-related packets without a destination of 10.168.196.51 to the web cache:

Router(config)# access-list 100 deny ip any host 10.168.196.51

Router(config)# access-list 100 permit ip any any

Router(config)# ip wccp web-cache redirect-list 100

Router(config)# interface gigabitethernet 3/2

Router(config-if)# ip wccp web-cache redirect out

Related Commands

ip wccp check services all

To enable all Web Cache Communication Protocol (WCCP) services, use the ip wccp check services all command in global configuration mode. To disable all services, use the no form of this command.

ip wccp check services all

no ip wccp check services all

Syntax Description

This command has no arguments or keywords.

Defaults

WCCP services are not enabled on the router.

Command Modes

Global configuration (config)

Usage Guidelines

With the ip wccp check services all command, WCCP can be configured to check all configured services for a match and perform redirection for those services if appropriate. The caches to which packets are redirected can be controlled by a redirect ACL access control list (ACL) as well as by the priority value of the service.

It is possible to configure an interface with more than one WCCP service. When more than one WCCP service is configured on an interface, the precedence of a service depends on the relative priority of the service compared to the priority of the other configured services. Each WCCP service has a priority value as part of its definition.

If no WCCP services are configured with a redirect ACL, the services are considered in priority order until a service is found which matches the IP packet. If no services match the packet, the packet is not redirected. If a service matches the packet and the service has a redirect ACL configured, then the IP packet will be checked against the ACL. If the packet is rejected by the ACL, the packet will not be passed down to lower priority services unless the ip wccp check services all command is configured. When the ip wccp check services all command is configured, WCCP will continue to attempt to match the packet against any remaining lower priority services configured on the interface.

Note The priority of a WCCP service group is determined by the web cache appliance. The priority of a WCCP service group cannot be configured via Cisco IOS software.

Note The ip wccp check services all command is a global WCCP command that applies to all services and is not associated with a single service.

Examples

The following example shows how to configure all WCCP services:

Router(config)# ip wccp check services all

Related Commands

ip wccp group-listen

To configure an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP), use the ip wccp group-listen command in interface configuration mode. To disable the reception of IP multicast packets for WCCP, use the no form of this command.

ip wccp {web-cache | service-number} group-listen

no ip wccp {web-cache | service-number} group-listen

Syntax Description

Defaults

This command is disabled by default.

Command Modes

Interface configuration (config-if)

Usage Guidelines

On routers that are to be members of a Service Group when IP multicast is used, the following configuration is required:

•Configure the IP multicast address for use by the WCCP Service Group.

•Configure the interfaces on which the router wishes to receive the IP multicast address with the ip wccp {web-cache | service-number} group-listen interface configuration command.

Examples

The following example shows how to enable the multicast packets for a web cache with a multicast address of 224.1.1.100:

Switch# configure terminal

Switch(config)# ip wccp web-cache group-address 224.1.1.100

Switch(config)# interface gigabitethernet 3/1

Switch(config-if)# ip wccp web-cache group-listen

Related Commands

ip wccp redirect

To enable packet redirection on an inbound or outbound interface using Web Cache Communication Protocol (WCCP), use the ip wccp redirect command in interface configuration mode. To disable WCCP redirection, use the no form of this command.

ip wccp {web-cache | service-number} redirect {in | out}

no ip wccp {web-cache | service-number} redirect {in | out}

Syntax Description

Command Default

Redirection checking on the interface is disabled.

Command Modes

Interface configuration (config-if)

Usage Guidelines

The ip wccp {web-cache | service-number} redirect in command allows you to configure WCCP redirection on an interface receiving inbound network traffic. When the command is applied to an interface, all packets arriving at that interface will be compared against the criteria defined by the specified WCCP service. If the packets match the criteria, they will be redirected.

Likewise, the ip wccp {web-cache | service-number} redirect out command allows you to configure the WCCP redirection check at an outbound interface.

Tips Be careful not to confuse the ip wccp {web-cache | service-number} redirect {out | in} interface configuration command with the ip wccp redirect exclude in interface configuration command.

Examples

The following example shows how to configure a session in which reverse proxy packets on Ethernet interface 3/1 are being checked for redirection and redirected to a Cisco Cache Engine:

Switch(config)# ip wccp 99

Switch(config)# interface gigabitethernet 3/1

Switch(config-if)# ip wccp 99 redirect out

The following example shows how to configure a session in which HTTP traffic arriving on GigabitEthernet interface 3/1 is redirected to a Cache Engine:

Switch(config)# ip wccp web-cache

Switch(config)# interface gigabitethernet 3/1

Switch(config-if)# ip wccp web-cache redirect in

Related Commands

p wccp redirect exclude in

To configure an interface to exclude packets received on an interface from being checked for redirection, use the ip wccp redirect exclude in command in interface configuration mode. To disable the ability of a router to exclude packets from redirection checks, use the no form of this command.

ip wccp redirect exclude in

no ip wccp redirect exclude in

Syntax Description

This command has no arguments or keywords.

Command Default

Redirection exclusion is disabled.

Command Modes

Interface configuration (config-if)

Usage Guidelines

This configuration command instructs the interface to exclude inbound packets from any redirection check. Note that the command is global to all the services and should be applied to any inbound interface that will be excluded from redirection.

This command is intended to be used to accelerate the flow of packets from a cache engine to the Internet as well as allow for the use of the Web Cache Communication Protocol (WCCP) v2 packet return feature.

Examples

In the following example, packets arriving on GigabitEthernet interface 3/1 are excluded from WCCP output redirection checks:

Router (config)# interface gigabitethernet 3/1

Router (config-if)# ip wccp redirect exclude in

Related Commands