Вы находитесь на странице: 1из 564

Switch 7700

Command Reference Guide - Version 3.0

http://www.3com.com/ Part number: 10014297 Published: November 2004

3Com Corporation 350 Campus Drive Marlborough, MA USA 01752-3064


Copyright 2004, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation. 3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notification of such revision or change. 3Com Corporation provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms or conditions of merchantability, satisfactory quality, and fitness for a particular purpose. 3Com may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time. If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hard copy documentation, or on the removable media in a directory file named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy, please contact 3Com and a copy will be provided to you. UNITED STATES GOVERNMENT LEGEND If you are a United States government agency, then this documentation and the software described herein are provided to you subject to the following: All technical data and computer software are commercial in nature and developed solely at private expense. Software is delivered as Commercial Computer Software as defined in DFARS 252.227-7014 (June 1995) or as a commercial item as defined in FAR 2.101(a) and as such is provided with only such rights as are provided in 3Coms standard commercial license for the Software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015 (Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable. You agree not to remove or deface any portion of any legend provided on any licensed program or documentation contained in, or delivered to you in conjunction with, this User Guide. Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries. 3Com and the 3Com logo are registered trademarks of 3Com Corporation. ntel and Pentium are registered trademarks of Intel Corporation. Microsoft, MS-DOS, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Novell and NetWare are registered trademarks of Novell, Inc. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. IEEE and 802 are registered trademarks of the Institute of Electrical and Electronics Engineers, Inc. All other company and product names may be trademarks of the respective companies with which they are associated. ENVIRONMENTAL STATEMENT It is the policy of 3Com Corporation to be environmentally-friendly in all operations. To uphold our policy, we are committed to: Establishing environmental performance standards that comply with national legislation and regulations. Conserving energy, materials and natural resources in all operations. Reducing the waste generated by all operations. Ensuring that all waste conforms to recognized environmental standards. Maximizing the recyclable and reusable content of all products. Ensuring that all products can be recycled, reused and disposed of safely. Ensuring that all products are labelled according to recognized environmental standards. Improving our environmental record on a continual basis. End of Life Statement 3Com processes allow for the recovery, reclamation and safe disposal of all end-of-life electronic components. Regulated Materials Statement 3Com products do not contain any hazardous or ozone-depleting material. Environmental Statement about the Documentation The documentation for this product is printed on paper that comes from sustainable, managed forests; it is fully biodegradable and recyclable, and is completely chlorine-free. The varnish is environmentally-friendly, and the inks are vegetable-based with a low heavy-metal content.

CONTENTS

ABOUT THIS GUIDE


About This Software Version Organization of this Manual Intended Readership 22 Conventions 22 Related Manuals 23 21 21

USING SYSTEM ACCESS COMMANDS


Logging in Commands 26 authentication-mode 26 auto-execute command 26 command-privilege level 27 databits 28 display history-command 29 display user-interface 29 display users 31 flow-control 31 free user-interface 32 header 32 history-command max-size 33 idle-timeout 34 lock 35 modem 35 modem auto-answer 35 modem timer answer 36 parity 36 protocol inbound 37 quit 38 return 38 screen-length 38 send 39 service-type 39 set authentication password 41 shell 41 speed 42 stopbits 42 super 43 super password 44

sysname 44 system-view 45 telnet 45 user-interface 46 user privilege level

46

USING PORT COMMANDS


Ethernet Port Configuration Commands 50 broadcast-suppression 50 copy configuration 50 description 51 display interface 52 display mirroring-group 54 display port 55 duplex 55 flow-control 56 interface 56 jumboframe enable 57 mac-address max-mac-count 58 mdi 58 port access vlan 59 port hybrid pvid vlan 59 port hybrid vlan 60 port link-type 61 port trunk permit vlan 62 port trunk pvid vlan 62 reset counters interface 63 shutdown 64 speed 64 vlan-vpn 65 Ethernet Port Link Aggregation Commands 65 display link-aggregation 66 link-aggregation 66

USING VLAN COMMANDS


VLAN Configuration Commands 69 broadcast-suppression 70 description 70 display interface VLAN-interface 71 display vlan 71 interface VLAN-interface 73 shutdown 73 vlan 74 Port-Based Configuration Commands 74 port 74 Protocol-Based VLAN Configuration Commands

75

display vlan-protocol interface 75 display protocol-vlan 76 port hybrid protocol-vlan 77 protocol-vlan 78 GARP Configuration Commands 78 display garp statistics 78 display garp timer 80 garp timer 81 garp timer leaveall 81 reset garp statistics 82 GVRP Configuration Commands 83 display gvrp statistics 83 display gvrp status 84 gvrp 84 gvrp registration 85

USING NETWORK PROTOCOL COMMANDS


IP Address Configuration Commands 89 display ip host 89 display ip interface vlan-interface 89 ip address 90 ip host 91 ARP Configuration Commands 91 arp check enable 92 arp static 92 arp timer aging 93 debugging arp 93 display arp 94 display arp timer aging 95 gratuitous-arp-learning enable 95 reset arp 96 DHCP Relay Configuration Commands 98 address-check disable 98 address-check enable 98 debugging dhcp-relay 98 dhcp-security static 99 dhcp-server 100 dhcp-server ip 100 display dhcp-security 101 display dhcp-server 102 display dhcp-server interface vlan-interface 102 IP Performance Configuration Commands 103 display fib 103 display icmp statistics 104 display ip socket 105 display ip statistics 106 display tcp statistics 107

display tcp status 108 display udp statistics 109 ip 109 ip forward-broadcast 110 reset ip statistics 110 reset tcp statistics 111 reset udp statistics 111 tcp timer fin-timeout 112 tcp timer syn-timeout 112 tcp window 113 IPX Configuration Commands 113 display ipx interface 113 display ipx routing-table 114 display ipx service table 117 display ipx statistics 118 ipx enable 119 ipx encapsulation 120 ipx netbios-propagation 120 ipx network 121 ipx rip import-route static 121 ipx rip mtu 122 ipx rip multiplier 122 ipx rip timer update 123 ipx route-static 123 ipx route load-balance-path 124 ipx route max-reserve-path 125 ipx sap disable 125 ipx sap gns-disable-reply 126 ipx sap gns-load-balance 126 ipx sap max-reserve-servers 127 ipx sap mtu 127 ipx sap multiplier 128 ipx sap timer update 128 ipx service 129 ipx split-horizon 129 ipx tick 130 ipx update-change-only 130 reset ipx statistics 131 reset ipx routing-table statistics protocol

131

USING ROUTING PROTOCOL COMMANDS


Routing Table Display Commands 139 display ip routing-table 139 display ip routing-table acl 139 display ip routing-table ip_address 141 display ip routing-table ip_address1 ip_address2 display ip routing-table ip-prefix 143

142

display ip routing-table protocol 144 display ip routing-table radix 146 display ip routing-table statistics 146 display ip routing-table verbose 147 Static Route Configuration Command 148 delete static-routes all 148 ip route-static 149 RIP Configuration Commands 150 checkzero 151 default cost 151 display rip 152 filter-policy export 152 filter-policy import 153 host-route 154 import-route 154 network 155 peer 156 preference 157 reset 157 rip 157 rip authentication-mode 158 rip input 159 rip metricin 160 rip metricout 161 rip output 161 rip split-horizon 162 rip version 162 rip work 163 summary 164 timers 164 OSPF Configuration Commands 165 abr-summary 165 area 166 asbr-summary 166 authentication-mode 167 default cost 168 default interval 168 default limit 169 default tag 169 default type 170 default-cost 171 default-route-advertise 171 display debugging ospf 172 display ospf abr-asbr 173 display ospf asbr-summary 173 display ospf brief 174 display ospf cumulative 175 display ospf error 176

display ospf interface 176 display ospf lsdb 177 display ospf nexthop 178 display ospf peer 179 display ospf request-queue 180 display ospf retrans-queue 181 display ospf routing 181 display ospf vlink 182 filter-policy export 183 filter-policy import 183 import-route 184 network 185 nssa 185 ospf 186 ospf authentication-mode 187 ospf cost 188 ospf dr-priority 188 ospf mib-binding 189 ospf mtu-enable 189 ospf network-type 190 ospf timer dead 191 ospf timer hello 192 ospf timer poll 192 ospf timer retransmit 193 ospf trans-delay 193 peer 194 preference 195 reset ospf all 195 router id 196 silent-interface 197 snmp-agent trap enable ospf 197 spf-schedule-interval 198 stub 199 vlink-peer 199 Integrated IS-IS Configuration Commands area-authenticationmode 200 cost-style 201 default-route-advertise 202 display isis interface 203 display isis lsdb 204 display isis mesh-group 204 display isis peer 205 display isis route 206 display isis spf-log 206 domain-authentication-mode 207 filter-policy export 208 filter-policy import 208

200

ignore-lsp-checksumerror 209 import-route 210 isis 211 isis authentication-mode 211 isis circuit-level 212 isis cost 213 isis dis-priority 214 isis enable 214 isis mesh-group 215 isis timer csnp 216 isis timer dead 217 isis timer hello 218 isis timer lsp 218 isis timer retransmit 219 is-level 219 log-peer-change 220 md5-compatible 221 network-entity 221 preference 222 reset isis all 222 reset isis peer 223 set-overload 223 silent-interface 224 spf-delay-interval 224 spf-slice-size 225 summary 226 timer lsp-max-age 227 timer lsp-refresh 227 timer spf 228 BGP Configuration Commands 228 aggregate 229 bgp 229 compare-different-asmed 230 confederation id 230 confederation nonstandard 231 confederation peer-as 232 dampening 232 debugging bgp 233 default local-preference 234 default med 235 display bgp group 235 display bgp network 236 display bgp paths 237 display bgp peer 238 display bgp routing-table 239 display bgp routing-table as-path-acl

240

display bgp routing-table cidr 241 display bgp routing-table community 241 display bgp routing-table community-list 242 display bgp routing-table dampened 243 display bgp routing-table different-origin-as 244 display bgp routing-table flap-info 244 display bgp routing-table peer 246 display bgp routing-table regular-expression 247 filter-policy export 248 filter-policy import 248 group 249 import-route 250 ip as-path acl 250 ip community-list 251 network 252 peer advertise-community 252 peer allow-as-loop 253 peer as-number 253 peer as-path-acl export 254 peer as-path-acl import 254 peer connect-interface 255 peer default-route-advertise 256 peer description 256 peer ebgp-max-hop 257 peer enable 257 peer filter-policy export 258 peer filter-policy import 259 peer group 259 peer ip-prefix export 260 peer ip-prefix import 260 peer next-hop-local 261 peer password 262 peer public-as-only 262 peer reflect-client 263 peer route-policy export 264 peer route-policy import 264 peer route-update-interval 265 peer timer 265 preference 266 reflect between-clients 267 reflector cluster-id 267 refresh bgp 268 reset bgp 268 reset bgp flap-info 269 reset bgp group 269 reset dampening 270 summary automatic 270 timer 271

undo synchronization 271 IP Routing Policy Configuration Commands 272 apply as-path 272 apply community 272 apply cost 273 apply cost-type 274 apply ip next-hop 274 apply isis 275 apply local-preference 275 apply origin 276 apply tag 277 display ip ip-prefix 277 display route-policy 278 filter-policy export 278 filter-policy import 279 if-match 280 if-match as-path 280 if-match community 281 if-match cost 282 if-match interface 282 if-match ip next-hop 283 if-match tag 284 ip ip-prefix 284 route-policy 286 Route Capacity Configuration Commands 287 display memory limit 287 memory auto-establish disable 288 memory auto-establish enable 288 memory 289

USING MULTICAST PROTOCOL COMMANDS


GMRP Configuration Commands 292 debugging gmrp 292 display gmrp statistics 293 display gmrp status 294 gmrp 294 IGMP Snooping Configuration Commands 295 display igmp-snooping configuration 295 display igmp-snooping group 295 display igmp-snooping statistics 296 igmp-snooping 297 igmp-snooping host-aging-time 297 igmp-snooping max-response-time 298 igmp-snooping router-aging-time 299 reset igmp-snooping statistics 299 Multicast Common Configuration Commands 300 debugging multicast forwarding 300

debugging multicast kernel-routing 300 debugging multicast status-forwarding 300 display multicast forwarding-table 301 display multicast routing-table 301 multicast route-limit 302 multicast routing-enable 303 reset multicast forwarding-table 303 reset multicast routing-table 304 IGMP Configuration Commands 305 debugging igmp 305 display igmp group 306 display igmp interface 306 igmp enable 307 igmp group-limit 308 igmp group-policy 308 igmp host-join 309 igmp lastmember-query interval 310 igmp max-response-time 311 igmp robust-count 311 igmp timer other-querier-present 312 igmp timer query 313 igmp version 313 reset igmp group 314 PIM Configuration Commands 315 bsr-policy 315 c-bsr 316 c-rp 316 crp-policy 317 debugging pim common 318 debugging pim dm 319 debugging pim sm 319 display pim bsr 320 display pim interface 320 display pim neighbor 321 display pim routing-table 322 display pim rp-info 322 pim 323 pim bsr-boundary 323 pim dm 324 pim neighbor-limit 325 pim neighbor-policy 325 pim sm 326 pim timer hello 326 reset pim neighbor 327 reset pim routing-table 327 source-policy 328 static-rp 329

USING QOS/ACL COMMANDS


ACL Configuration Command List 332 acl 332 acl mode 333 display acl config 334 display acl mode 335 display acl running-packet-filter 335 display time-range 336 packet-filter 336 reset acl counter 338 rule 338 time-range 342 QoS Configuration Commands List 343 display mirroring-group 343 display priority-trust 343 display qos cos-local-precedencemap 343 display qos-interface all 344 display qos-interface line-rate 344 display qos-interface traffic-bandwidth 345 display qos-interface traffic-limit 346 display qos-interface traffic-priority 346 display qos-interface traffic-red 347 display qos-interface traffic-redirect 347 display qos-interface traffic-statistic 348 line-rate 349 mirroring-group 349 priority 350 priority trust 351 qos 352 qos cos-local-precedencemap 353 reset traffic-statistic 354 traffic-bandwidth 355 traffic-limit 357 traffic-priority 358 traffic-red 360 traffic-redirect 361 traffic-statistic 362 Logon Users ACL Control Command 363 acl 363 snmp-agent community 364 snmp-agent group 364 snmp-agent usm-user 366

USING STP COMMANDS


MSTP Configuration Commands 370

active region-configuration 370 check region-configuration 371 display stp 371 display stp region-configuration 373 instance 374 region-name 375 reset stp 375 revision-level 376 stp 376 stp bpdu-protection 377 stp bridge-diameter 378 stp edged-port 379 stp instance cost 380 stp instance port priority 380 stp instance root primary 381 stp instance root secondary 382 stp interface 383 stp interface edged-port 384 stp interface instance cost 385 stp interface instance port priority 386 stp interface loop-protection 387 stp interface mcheck 387 stp interface point-to-point 388 stp interface root-protection 389 stp interface transit-limit 390 stp loop-protection 390 stp max-hops 391 stp mcheck 392 stp mode 392 stp pathcost-standard 393 stp point-to-point 393 stp priority 394 stp region-configuration 395 stp root-protection 395 stp tc-protection 396 stp timer forward-delay 396 stp timer hello 397 stp timer max-age 398 stp transit-limit 399 vlan-mapping modulo 400

USING AAA AND RADIUS COMMANDS


802.1x Configuration Commands display dot1x 402 dot1x 404 dot1x authentication-method dot1x dhcp-launch 406 402

405

dot1x max-user 406 dot1x port-control 407 dot1x port-method 408 dot1x quiet-period 409 dot1x retry 410 dot1x supp-proxy-check 411 dot1x timer 412 dot1x timer handshake-period 413 reset dot1x statistics 413 AAA Configuration Commands 414 access-limit 414 attribute 415 cut connection 416 display connection 417 display domain 418 display local-user 419 domain 420 idle-cut 421 local-user 422 local-user password-display-mode 422 password 423 radius-scheme 424 service-type 424 state 425 RADIUS Protocol Configuration Commands 426 accounting optional 426 data-flow-format 427 display local-server statistics 427 display radius 428 display radius statistics 429 display stop-accounting-buffer 430 key 431 local-server 432 primary accounting 433 primary authentication 434 radius scheme 434 reset stop-accounting-buffer 435 retry 436 retry realtime-accounting 437 retry stop-accounting 438 secondary accounting 439 secondary authentication 439 server-type 440 state 441 stop-accounting-buffer enable 442 timer 442 timer realtime-accounting 443 user-name-format 444

10

USING RELIABILITY COMMANDS


VRRP Configuration Commands 447 debugging vrrp 447 display vrrp 448 vrrp authentication-mode 448 vrrp method 449 vrrp ping-enable 450 vrrp vrid preempt-mode 451 vrrp vrid priority 451 vrrp vrid timer 452 vrrp vrid track 452 vrrp vrid virtual-ip 453 Redundant Fabric Configuration Commands display switch state 454 slave restart 454 slave switchover 455 slave update config 455

454

11

USING SYSTEM MANAGEMENT COMMANDS


File System Management Commands 461 cd 461 copy 462 delete 463 dir 463 file prompt 464 format 465 mkdir 465 more 465 move 466 pwd 467 rename 467 reset recycle-bin 468 rmdir 468 undelete 469 Configuration File Management Commands display this 470 display startup 470 reset saved-configuration 471 save 472 startup saved configuration 472 FTP Server Configuration Commands 473 display ftp-server 473 display ftp-user 473 ftp server 474 ftp timeout 474 local-user 475 password 476

470

service-type 476 FTP Client Commands 477 ascii 477 binary 477 bye 478 cd 478 cdup 479 close 479 delete 479 dir 480 disconnect 480 ftp 481 get 481 lcd 481 ls 482 mkdir 482 passive 483 put 483 pwd 483 quit 484 remotehelp 484 rmdir 485 user 485 verbose 485 TFTP Configuration Commands 486 tftp get 486 tftp put 486 MAC Address Table Management Commands 487 display mac-address aging-time 487 display mac-address 488 mac-address 488 mac-address max-mac-count 489 mac-address timer 490 Device Management Commands 491 boot bootloader 491 bootrom-update security-check enable 491 boot bootrom 492 display backboard view 492 display bootloader 493 display cpu 493 display device 494 display environment 495 display fan 495 display memory 495 display power 496 display schedule reboot 496 schedule reboot at 497 schedule reboot delay 498

reboot 499 reboot slot 499 temperature-limit 500 Basic System Configuration and Management Commands clock datetime 501 clock summer-time 501 clock timezone 502 sysname 503 System Status and System Information Display Commands display clock 504 display current-configuration 504 display debugging 506 display saved-configuration 507 display users 509 display version 509 System Debug Commands 510 debugging 510 display diagnostic-information 511 Network Connection Test Commands 511 ping 511 tracert 513 Log Commands 515 display channel 515 display info-center 516 info-center channel name 516 info-center console channel 517 info-center enable 517 info-center logbuffer 518 info-center loghost 519 info-center loghost source 519 info-center monitor channel 520 info-center snmp channel 521 info-center source 521 info-center timestamp 523 info-center trapbuffer 523 reset logbuffer 524 reset trapbuffer 525 terminal debugging 525 terminal logging 525 terminal monitor 526 terminal trapping 527 SNMP Configuration Commands 527 display snmp-agent community 527 display snmp-agent 528 display snmp-agent group 528 display snmp-agent mib-view 529 display snmp-agent statistics 530 display snmp-agent sys-info 531

501

504

display snmp-agent usm-user 532 enable snmp trap 532 snmp-agent community 533 snmp-agent group 534 snmp-agent local-engineid 535 snmp-agent mib-view 535 snmp-agent packet max-size 536 snmp-agent sys-info 536 snmp-agent target-host 537 snmp-agent trap enable 538 snmp-agent trap life 539 snmp-agent trap queue-size 540 snmp-agent trap source 540 snmp-agent usm-user 540 undo snmp-agent 542 RMON Configuration Commands 542 display rmon alarm 542 display rmon event 543 display rmon eventlog 544 display rmon history 545 display rmon prialarm 546 display rmon statistics 546 rmon alarm 547 rmon event 548 rmon history 549 rmon prialarm 549 rmon statistics 551 NTP Configuration Commands 551 debugging ntp-service 551 display ntp-service sessions 552 display ntp-service status 553 display ntp-service trace 554 ntp-service access 554 ntp-service authentication enable 555 ntp-service authentication-keyid 555 ntp-service broadcast-client 556 ntp-service broadcast-server 556 ntp-service max-dynamic sessions 557 ntp-service multicast-client 558 ntp-service multicast-server 558 ntp-service refclock-master 559 ntp-service reliable authentication-keyid ntp-service source-interface 560 ntp-service in-interface disable 561 ntp-service unicast-peer 561 ntp-service unicast-server 562

560

ABOUT THIS GUIDE

This guide provides all the information you need to use the configuration commands supported by version 2.0 software on the 3Com Switch 7700.

About This Software Version

The software in the 3Com Switch 7700 is a subset of that used in other 3Com products. Depending on the capabilities of your hardware platform, some commands described in this guide may not be available on your Switch, although the unavailable commands may still display on the command line interface (CLI). If you try to use an unavailable command, an error message displays. CAUTION: Any command that displays on the CLI, but is not described in this guide, is not supported in version 2.0 software. 3Com only supports the commands described in this guide. Other commands may result in the loss of data, and are entered at the users risk.

Organization of this Manual

The 3Com Switch 7700 Command Reference Guide consists of the following chapters:

Using System Access Commands Introduces the commands used for accessing the Switch 7700. Using Port Commands Introduces the commands used for configuring Ethernet port and link aggregation. Using VLAN Commands Introduces the commands used for configuring VLANs. Using Network Protocol Commands Introduces the commands used for configuring network protocols. Using Routing Protocol Commands Introduces the commands used for configuring routing protocols. Using Multicast Protocol Commands Introduces the commands used for configuring multicast protocols. Using QoS and ACL Commands Introduces the commands used for configuring QoS/ACL. Using STP Commands Introduces the commands used for configuring STP. Using AAA and RADIUS Commands Introduces the commands used for configuring 802.1x, AAA and RADIUS. Using Reliability Commands Introduces the commands used for configuring VRRP. Using System Management Commands Introduces the commands used for system management and maintenance.

22

ABOUT THIS GUIDE

Intended Readership

The manual is intended for the following readers:


Network administrators Network engineers Users who are familiar with the basics of networking

Conventions

This manual uses the following conventions:


Table 1 Icons
Icon Notice Type Information note Caution Warning Description Information that describes important features or instructions. Information that alerts you to potential loss of data or potential damage to an application, system, or device. Information that alerts you to potential personal injury.

Table 2 Text conventions


Convention Description

Screen displays This typeface represents text as it appears on the screen. Keyboard key names If you must press two or more keys simultaneously, the key names are linked with a plus sign (+), for example: Press Ctrl+Alt+Del The words enter and type Fixed command text When you see the word enter in this guide, you must type something, and then press Return or Enter. Do not press Return or Enter when an instruction simply says type. This typeface indicates the fixed part of a command text. You must type the command, or this part of the command, exactly as shown, and press Return or Enter when you are ready to enter the command. Example: The command display history-command must be entered exactly as shown. Variable command text This typeface indicates the variable part of a command text. You must type a value here, and press Return or Enter when you are ready to enter the command. Example: in the command super level, a value in the range 0 to 3 must be entered in the position indicated by level { x | y | ... } Alternative items, one of which must be entered, are grouped in braces and separated by vertical bars. You must select and enter one of the items. Example: in the command flow-control {hardware | none | software}, the braces and the vertical bars combined indicate that you must enter one of the parameters. Enter either hardware, or none, or software.

Related Manuals

23

Table 2 Text conventions


[] Items shown in square brackets [ ] are optional. Example 1: in the command display users [all], the square brackets indicate that the parameter all is optional. You can enter the command with or without this parameter. Example 2: in the command user-interface [type] first-number [last-number] the square brackets indicate that the parameters [type] and [last-number] are both optional. You can enter a value in place of one, both or neither of these parameters. Alternative items, one of which can optionally be entered, are grouped in square brackets and separated by vertical bars. Example 3: in the command header [shell | incoming | login] text, the square brackets indicate that the parameters shell, incoming and login are all optional. The vertical bars indicate that only one of the parameters is allowed.

Related Manuals

The Switch 7700 Installation Guide provides information about system installation and maintenance. The Switch 7700 Configuration Guide provides information about configuring your network using the commands described in this guide.

24

ABOUT THIS GUIDE

USING SYSTEM ACCESS COMMANDS

This chapter describes how to use the following commands: Logging in Commands

authentication-mode auto-execute command command-privilege level databits display history-command display user-interface display users flow-control free user-interface header history-command max-size idle-timeout lock modem modem auto-answer modem timer answer parity protocol inbound quit return screen-length send service-type set authentication password shell speed stopbits super super password

26

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

sysname system-view telnet user-interface user privilege level

Logging in Commands

This section describes the commands that you can use to configure system access and system security. Syntax
authentication-mode { password | scheme | none }

authentication-mode

View User interface view Parameter


password: Requires local authentication of password at log in. scheme: Requires local or remote authentication of username and password at

log in.
none: Allows users to log in without username or password.

Description This command configures the authentication method for a user at log in.

Use the command authentication-mode password to prompt a user for local password authentication at login. To set the password, use set authentication password. Use the command authentication-mode scheme to prompt a user to provide local or remote user name and password authentication at login. The type of the authentication depends on your network configuration. For further information, see AAA and RADIUS. Use the command authentication-mode none to allow a user to log in without username or password authentication.

By default, users logging in using the console port do not need to pass any terminal authentication. Users logging in via modem or Telnet are required to provide password authentication when they log in. Example To configure local password authentication, enter the following command:
[SW7700-ui-aux0]authentication-mode password

auto-execute command

Syntax
auto-execute command text undo auto-execute command

Logging in Commands

27

View User interface view Parameter


command: Enter the command you want to run automatically at user login.

Description Enter auto-execute command command to configure the Switch 7700 to automatically run a specified command. When the user logs in, the command will be executed automatically, after which the user will be disconnected. This command is usually used to connect the user to a specified device using Telnet. See the example below. CAUTION: If you execute this command, the user-interface can no longer be used to perform routine configurations on the local system. Ensure that you can log in to the system in another way to cancel the configuration, before you configure the auto-execute command.

Enter undo auto-execute command to cancel the auto-execute command, and return the Switch 7700 to its default settings.

By default, auto-execute is disabled. Example To configure the Switch 7700 to automatically Telnet to device 10.110.100.1 after the user logs in via VTY 0, enter the following command:
[SW7700]auto-execute command telnet 10.110.100.1

command-privilege level

Syntax
command-privilege level level view view command undo command-privilege view view command

View System view Parameter


level: Enter the command level you want to assign to this command, ranging from 0 to 3. view: Enter the name of the view that contains the command. This can be any of

the views supported by the Switch.


command: Enter the command to be configured.

Description Use the command-privilege level command to configure the priority level assigned to any command within a selected view. The command levels are, from lowest to highest:

0 Visit

28

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

1 Monitoring 2 Configuration 3 Management

You can assign a priority level depending on user requirements. The commands that a user can access depend first on the access level assigned to the command and second on the access level assigned to the user interface. If the two levels are different, the access level assigned to the command has priority. For example, if the access level of a user interface is 1, but a specific user can access commands at level 3, the user can log in from this user interface, but can access commands up to and including level 3. By default:

ping, tracert, and telnet are at level 0 display and debugging are at level 1 all configuration commands are at level 2 FTP, XMODEM, TFTP and commands for file system operations are at level 3

Use the undo command-privilege view command to restore the default priority to a command. Example To assign a command level of 0 to the interface command in system view, enter the following:
[SW7700]command-privilege level 0 view system interface

databits

Syntax
databits { 7 | 8 } undo databits

View User interface view Parameter


7 Sets the data bits to 7. 8 Sets the data bits to 8.

Description Use the databits command to configure the data bits for the AUX (Console) port to either 7 or 8. By default, the value is 8. Use the undo databits command to restore the default value (8). This command can only be performed in the AUX user interface view. Example To configure the data bits of the AUX (Console) port to 7 bits, enter the following:
[SW7700-ui-aux0]databits 7

Logging in Commands

29

display history-command

Syntax
display history-command

View All views Parameter None Description Use the display history-command command to view the commands previously entered during this login session, up to a specified maximum. To set the maximum number of commands to display, see history-command max-size. Example To display previously entered commands, enter the following.
<SW7700>display history-command

The commands display on screen. display user-interface Syntax


display user-interface [ type number | index_number ] [summary]

View All views Parameter


type number: Enter the type and number of the user interface you want to display details on, for example VTY 3. index_number: Enter the index number of the user interface you want to display

details on.
summary: Display the summary of a user interface.

Description Use the display user-interface command to view information on a user interface. You can choose to access this information by user interface type and type number, or by user interface index number. The information displayed is the same whichever access method you use. This command without the summary parameter displays user interface type, absolute/relative index, transmission speed, priority, authentication methods, and physical location. This command with the summary parameter displays one user interface in use with user interface name and other user interface information. Example To display information on a user interface with an index number of 0, enter the following.

30

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

<SW7700>display user-interface 0 summary

The information is displayed in the following format:


Idx Type Tx/Rx Modem Privi Auth I 0 AUX 0 9600 3 N + : Current user-interface is active. I : Current user-interface is active and work in async mode. Idx : Absolute index of user-interface. Type : Type and relative index of user-interface. Privi: The privilege of user-interface. Auth : The authentication mode of user-interface. A: Authenticate use AAA. L: Authenticate use local database. N: Current user-interface need not authentication. P: Authenticate use current UI's password.

The categories of information displayed are as follows:


Table 1 Output description of the display user-interface command
Field + F Idx Type Tx/Rx Modem Privi Auth Int Description Indicates that the user interface is in use Current user interface is in use and working in asynchronous mode Displays the index number of the user interface Displays the type and type number of the user interface Displays the user interface speed Displays the modem operation mode Indicates the command level that can be accessed from this user interface Indicates the user interface authentication method Indicates the physical location of the user interface

Display the summary information of user interface 0.


<SW7700> display user-interface 0 summary 0: U 1 character mode users. 1 total UIs in use. UI's name: aux0 (U)

Table 2 Output Description of the Display User-Interface Summary Command


Field 0: U 1 character mode users 1 total UIs in use UIs name Description Indicates the user interface type Indicates the number of a type of user interface Indicates the total number of user interfaces in use Name of the user interface

Logging in Commands

31

display users

Syntax
display users [ all ]

View All views Parameter


all: Enter to display information on all user interfaces.

Description

Use the display users command to view information on the current user interface. Use the display users all command to view the information on all user interfaces.

Example To display information on the current user interface, enter the following
[SW7700]display users

The information displays in the following format:


UI Delay F 0 AUX 0 Type IPaddress 192.168.1.250 Username

The categories of information displayed are as follows:


Table 3 Output description of the display users command
Field F UI Description Indicates that the user interface is in use and is working in asynchronous mode. The first number in the column is the Index number of the interface. The three letter identifier and the number that follows are the type and type number of the user interface. Delay Type IPaddress Username Indicates the interval from the latest input until now, in minutes. Indicates the user interface type. Displays the host IP address of the incoming connection. Display the login name of the user who is using this interface

flow-control

Syntax
flow-control { hardware | none | software } undo flow-control

View User interface view Parameter


hardware: Enter to set hardware flow control.

32

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

none: Enter to set no flow control. software: Enter to set software flow control.

Description

Use the flow-control command to configure the flow control mode on the AUX (Console) port to hardware, software or none. Use the undo flow-control command to restore the default flow control mode (no flow control).

This command can only be performed in the AUX user interface view. Example To configure software flow control on the AUX (Console) port, enter the following:
[SW7700-ui-aux0]flow-control software

free user-interface

Syntax
free user-interface { type number | index_number }

View User view Parameter


type number: Enter the type and type number of the user interface to be reset. index_number: Enter the index number of the user interface to be reset.

Description Using this command to reset a specified user interface to its default settings. The user interface will be disconnected after the reset.

Use free user-interface type number to reset the interface with the specified type and type number to its default settings. Use free user-interface index_number to reset the interface with the specified index number to its default settings.

You cannot use this command on the current user interface. Example To reset user interface AUX 1 from another user interface on the Switch 7700, enter the following:
<SW7700>free user-interface aux 1

After the command is executed, user interface AUX 1 is disconnected. When you next log in using user interface AUX 1, it opens using the default settings . header Syntax
header { shell | incoming | login } text undo header { shell | incoming | login }

Logging in Commands

33

View System view Parameter


shell: Configures the system to display a header on setting up a session for the

user.
incoming: Configures the system to display a login header. login: Configures the system to display login information. text: Enter the text that you want to appear in the header.

Description

Use the header command to configure the system to display a header during user log in. Use the undo header { shell | incoming | login } command to delete the specified header.

When the user logs in, and a connection is activated, the login header displays. After the user successfully logs in, the shell header displays. The first English characters in the text is regarded as the start and stop characters. After you type in the stop character, the system will exit the header command automatically. If you do not want to use the control characters, you can type in text with the same English characters at the beginning and end, and press Enter. Example To configure a header to display after connection using the control character method, enter the following.
[SW7700]header shell % Enter TEXT message. End with the character '%'. SHELL : Hello! Welcome %

The header text displays on the terminal when a user next logs in. To test this, quit from the session, and press Enter to restart.
[SW7700]quit <SW7700>quit Press ENTER to get started SHELL : Hello! Welcome <SW7700>

history-command max-size

Syntax
history-command max-size value undo history-command max-size

View User interface view

34

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

Parameter
value: Enter the number of previously entered commands that you want the

Switch to save. Description

Use the command history-command max-size to specify the amount of previously entered commands that you want the Switch to save. Enter any value between 0 and 256. The default is 10, that is, the 10 most recently entered commands are saved. Use the undo history-command max-size command to restore the default value.

To display the most recently-entered commands, up to the specified maximum, use the command display history-command. Example To set the history buffer to 20, that is to save the 20 most recently-entered commands, enter the following:
[SW7700]history-command max-size 20

idle-timeout

Syntax
idle-timeout minutes [ seconds ] undo idle-timeout

View User interface view Parameter


minutes: Enter the number of minutes you want to allow a user interface to

remain idle before it is disconnected. This can be in the range 0 to 35791.


seconds: Enter the number of seconds in addition to the number of minutes.

Optional. Description

Use the idle-timeout command to configure the amount of time you want to allow a user interface to remain idle before it is disconnected. Use the undo idle-timeout command to restore the default idle-timeout. By default, idle-timeout is set to 10 minutes.

To disable idle timeout, set the idle-timeout value to 0. Example To configure the timeout value to 1 minute on the AUX user interface, enter the following:
[SW7700-ui-aux0]idle-timeout 1

Logging in Commands

35

lock

Syntax
lock

View User View Parameter None Description Use the lock command to lock the current user interface and prevent unauthorized users from accessing it. An authorized user must enter a valid password to access the interface. Example To lock the current user interface, enter the following:
<SW7700>lock Password: xxxx Again: xxxx

modem

Syntax
modem { call-in | both } undo modem { call-in | both }

View AUX user interface view Parameter


call-in: Enter to enable (or disable) modem call-in. both: Enter to enable (or disable) modem call-in and call-out.

Description Using this command to configure the call-in and call-out attributes of the modem.

The modem call-in command allows modem call-in only. The modem both command allows both modem call-in and call-out The undo modem call-in command denies modem call-in. The undo modem both command denies both modem call-in and call-out

Example To allow call-in and call-out of the modem on the AUX (Console) port, enter the following:
[SW7700-ui-aux0]modem both

modem auto-answer

Syntax
modem auto-answer

36

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

undo modem auto-answer

View AUX user interface view Parameter None Description

Use the modem auto-answer command to configure the modem to auto-answer. Use the undo modem auto-answer command to configure the modem to manual answer

By default, the answer mode is set to manual. Example To configure the answer mode of the Modem on the AUX (Console) port as auto-answer, enter the following:
[SW7700-ui-aux0]modem auto-answer

modem timer answer

Syntax
modem timer answer seconds undo modem timer answer

View AUX user interface view Parameter


seconds: Specifies the time between lifting the receiver and detecting the carrier,

in the range 1 second to 60 seconds. The default value is 30. Description

Use the modem timer answer seconds command to configure the timer answer period, in seconds, from off-hook to carrier detected when establishing a call-in connection. Use the undo modem timer answer command to restore the default timeout value (30 seconds).

Example To set the timer answer of AUX 0 to 45 seconds, enter the following:
[SW7700-ui-aux0]modem timer answer 45

parity

Syntax
parity { even | mark | none | odd | space } undo parity

Logging in Commands

37

View User interface view Parameter


even: Sets the Switch to even parity. mark: Sets the Switch to mark parity (1) none: Sets the Switch to perform no parity checking. odd: Sets the Switch to odd parity. space: Sets the Switch to zero parity (0)

Description

Use the parity command to configure the parity mode on the AUX (Console) port. Use the undo parity command to restore the default parity mode (no parity checking).

This command can only be performed in the AUX user interface view. Example To set mark parity on the AUX (Console) port, enter the following:
[SW7700-ui-aux0]parity mark

protocol inbound

Syntax
protocol inbound { all| ssh | telnet }

View VTY user interface view Parameter all: Supports both Telnet and SSH protocols. ssh: Supports only SSH protocol. telnet: Supports only Telnet protocol. Description

Use the protocol inbound command to configure the protocols supported by a designated user interface.

By default, the user interface only supports Telnet protocol. For the related commands, see user-interface vty. Example Configure SSH protocol supported by VTY0 user interface.
[SW7700-ui-vty0] protocol inbound ssh

38

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

quit

Syntax
quit

View All views Parameter None Description Use the quit command to exit from the current view to the next highest view. If the current view is user view, this command quits the system. There are three levels of view, which are, from high to low:

user view system view menu views, for example VLAN view, Ethernet port view, and so on.

Related commands: return, system-view. Example To return to user view from system view, enter the following:
[SW7700]quit <SW7700>

return

Syntax
return

View System view or higher Parameter None Description Use the return command to return to user view from any other view. Ctrl+Z performs the same function as the return command. To return to the next highest level of view, use quit. Example To return to user view from any other view (the example below shows the command entered from the system view), enter the following.
[SW7700]return <SW7700>

screen-length

Syntax
screen-length screen-length

Logging in Commands

39

undo screen-length

View User interface view Parameter


screen-length: Enter the maximum number of information lines that you want to display on a terminal screen, ranging from 0 to 512. The default is 24.

Description

Use the command screen-length to configure how many information lines (maximum) will be displayed on the screen of a terminal. Use the command undo screen-length to restore the default of 24 lines.

To disable this function, that is to allow an unlimited number of information lines, enter the parameter as 0. Example To configure a terminal to display 20 lines of information, enter the following:
[SW7700-ui-aux0]screen-length 20

send

Syntax
send { all | number | index }

View User view Parameter


all: Sends a message to all user interfaces. type number: Enter the type and type number of the user interface that you

want to send a message to.


index: Enter the index number of the interface that you want to send a message

to. Description Use the send command to send messages to other user interfaces. Example To send a message to all the user interfaces, enter the following:
<SW7700>send all

service-type

Syntax
service-type { telnet [ level level ] | telnet [ level level ] } undo service-type { telnet [ level ] ] | telnet [ level ] }

40

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

View Local-user view Parameter


telnet: Specifies user type as Telnet. level level: Enter the command level that a user can enter after Telnet login, in

the range 0 to 3. The default is level 1. Description

Use the command service-type to configure which level of command a user can access after login. Use the command undo service-type to restore the default level of command (level 1).

Commands are classified into four levels, as follows:

0 - Visit level. Users at this level have access to network diagnosis tools (such as ping and tracert), and the Telnet commands. A user at this level cannot save the configuration file. 1 - Monitoring level. Users at this level can perform system maintenance, service fault diagnosis, and so on. A user at this level cannot save the configuration file. 2 - Configuration level. Users at this level can perform service configuration operations, including routing, and can enter commands that affect each network layer. Configuration level commands are used to provide direct network service to the user. 3 - Management level. Users at this level can perform basic system operations, and can use file system commands, FTP commands, TFTP commands, XModem downloading commands, user management commands and level setting commands.

Example To allow a user zbr to configure commands a level 0 after login, enter the following:
[SW7700]local-user zbr [SW7700-luser-zbr]service-type telnet level 0

To activate these settings, quit the system and login with the username zbr. Now only the commands at level 0 are listed on the terminal.
[SW7700]quit <SW7700>? User view commands: ping Ping function quit Exit from current command view super Privilege specified user priority level telnet Establish one TELNET connection tracert Trace route function

Logging in Commands

41

set authentication password

Syntax
set authentication password { cipher | simple } password undo set authentication password

View User interface view Parameter


cipher: Sets the authentication mode to cipher text. The password displays as encrypted text if you use this option. simple: Sets the authentication mode to plain text. The password must be in plain text. A plain text password is a sequential character string of no more than 16 digits, for example, 3Com918 password: Enter the required password text.

Description

Use the set authentication password command to configure the password for local authentication. Use the undo set authentication password command to cancel local authentication password.

The password in plain text is required when performing authentication, regardless of whether the configuration is plain text or cipher text. By default, a password is required for users connecting over Modem or Telnet. If a password has not been set, the following prompt is displayed: password
required, but none set.

Example To configure the local authentication password on VTY 0 to 3Com, enter the following:
[SW7700-ui-vty0]set authentication password simple 3com

shell

Syntax
shell undo shell

View User interface view Parameter None Description Use the shell command to enable the terminal service for a user interface. The terminal service is enabled by default. Use the undo shell command to disable the terminal service for a user interface.

42

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

When using the undo shell command, note the following points.

For reasons of security, the undo shell command can only be used on user interfaces other than the AUX user interface. You cannot use this command on the current user interface. You are asked to confirm the command.

Example To disable the terminal service on the VTY user interfaces 0 to 4, enter the following from another user interface:
[SW7700]user-interface vty 0 4 [SW7700-ui-vty0-4]undo shell

The following message will be displayed on the Telnet terminal after login:
Connection to host lost.

speed

Syntax
speed speed-value undo speed

View User interface view Parameter


speed-value: Specify the transmission rate on the AUX (Console) port in bits per second (b/s). This can be any of the following values: 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 or 4096000.

The default rate is 9600 b/s. Description Use the speed command to configure the transmission rate on the AUX (Console) port. Use the undo speed command to restore the default rate. This command can only be performed in AUX user interface view. Example To configure the transmission speed on the AUX (Console) port as 9600 b/s, enter the following:
[SW7700]speed 9600

stopbits

Syntax
stopbits { 1 | 1.5 | 2 } undo stopbits

Logging in Commands

43

View User interface view Parameter


1: Sets the stop bits to 1. 1.5: Sets the stop bits to 1.5. 2: Sets the stop bits to 2.

Description

Use the stopbits command to configure the stop bits on the AUX (Console) port. Use the undo stopbits command to restore the default stop bits (the default is 1).

This command can only be performed in AUX user interface view. Example To configure the stop bits to 2, enter the following from the AUX (Console) port:
[SW7700]stopbits 2

super

Syntax
super [ level ]

View All views Parameter


level: Enter a user level in the range 0 to 3. The default is 3.

Description The super command gives a user access to a higher level than their currently assigned user level. To ensure that only an authorized user can access the higher level, use the super password command to set a password for the higher level. If the user does not enter a valid password, the user level does not change. Login users are classified into four levels that correspond to the four command levels. A user can only use commands at the levels that are equal to or lower than their user level. Related commands: super password, quit. Example To change to user level 3 from the current user level.
<SW7700>super 3 Password:

44

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

The password prompt displays only if you set a password using the super
password command.

super password

Syntax
super password level level { simple | cipher } password undo super password level level

View System view Parameter


level: Enter a user level in the range 1 to 3. The default is 3. The password you

enter is set for the specified level.


simple: Sets the password to plain text. A plain text password is a sequential

character string of no more than 16 characters, for example, 3Com918.


cipher: Sets the password to cipher text. The password displays as encrypted text

if you use this option.


password: Enter the required password.

Description

Use the super password command to set the password that a user must enter before changing to a higher access level. A user must input the correct password three times before they can access the required level. Use the undo super password command to cancel the password settings.

The password in plain text is required when performing authentication, regardless of whether the configuration is plain text or encrypted text. Example To set the password for level 3 to zbr, type the following:.
[SW7700]super password level 3 simple zbr

sysname

Syntax
sysname text undo sysname

View System view Parameter


text: Enter the host name of the Switch 7700. The host name must be no more than 30 characters long. The default is SW7700.

Description

Use the sysname command to configure the host name of the Switch 7700.

Logging in Commands

45

Use the undo sysname command to restore the host name to the default of SW7700.

Changing the hostname of the Ethernet switch will affect the prompt of command line interface. For example, if the hostname of the Ethernet switch is MyHost, the prompt in user view will be <MyHost>. Example To configure the hostname of the Switch 7700 to 3Com, enter the following:
[SW7700]sysname 3Com [3Com]

system-view

Syntax
system-view

View User view Parameter None Description Enter system-view to enter the system view from the user view. Related commands: quit, return. Example To enter system view from user view, enter the following:
<SW7700>system-view Enter system view, return user view with Ctrl+Z. [SW7700]

telnet

Syntax
telnet host_ip_address [ service_port ]

View User view Parameter


host_ip_address: Enter the IP address or the host name of the remote Switch. If

you enter the host name, the Switch must be set to static resolution.
service_port: Designates the management port on the remote switch, in the range 0 to 65535. Optional.

Description Use the telnet command to log in to another Ethernet switch from the current switch via Telnet for remote management. To terminate the Telnet logon, press Ctrl+].

46

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

If you do not specify a service_port, the default Telnet port number of 23 is used. Related command: display tcp status. Example To log in to the Ethernet switch Switch32 at IP address 129.102.0.1 from the current Switch (Switch01), enter the following:
<Switch01>telnet 129.102.0.1 Trying 129.102.0.1 Connected to 129.102.0.1 <Switch32>

user-interface

Syntax
user-interface [ type ] first_number [ last_number ]

View System view Parameter


type: Enter the user interface type, which can be AUX or VTY. Optional. first_number: Enter the number of the first (or only) user interface view to be

configured. If you enter a type, this is the type number of the interface. If you do not enter a type, this is the index number of the interface.
last_number: Enter the number of the last user interface view to be configured, if you want to configure a range of interfaces. Optional.

Description Use the user-interface command to select a single user interface view or a range of user interface views. After you have selected the user interface views to configure, use the user privilege level command to assign access levels to the selected interface(s). Example To configure the user interfaces with index numbers 0 to 3, enter the following
[SW7700]user-interface 0 3 [SW7700]

This example command selects one AUX (Console) port user interface and three VTY user interfaces (VTY 1, VTY 2, VTY 3). You can now assign access levels to these interfaces using the user privilege level command. user privilege level Syntax
user privilege level level undo user privilege level

View User interface view

Logging in Commands

47

Parameter
level: Enter the level of command that a user can access, in the range 0 to 3.

Description

Use the user privilege level level command to configure the command level that a user can access from the specified user interface. The user can use all the available commands at this command level. Use the undo user privilege level command to restore the default command level. By default, a user can access all commands at Level 3 after logging in through the AUX user interface, and all commands at Level 0 after logging in through a VTY user interface.

Example To configure a user to access command level 0 after logging in from the VTY 0 user interface, enter the following:
[SW7700]user privilege level 0

When the user Telnets from the VTY 0 user interface to the switch, the terminal displays commands at level 0, as shown below:
<SW7700>? User view commands: ping Ping function quit Exit from current command view super Enter the command workspace with specified user priority level telnet Establish one TELNET connection tracert Trace route function

48

CHAPTER 1: USING SYSTEM ACCESS COMMANDS

USING PORT COMMANDS

This chapter describes how to use the following commands: Ethernet Port Configuration Commands

broadcast-suppression copy configuration description display interface display mirroring-group display port duplex flow-control interface jumboframe enable mac-address max-mac-count mdi port access vlan port hybrid pvid vlan port hybrid vlan port link-type port trunk permit vlan port trunk pvid vlan reset counters interface shutdown speed vlan-vpn

Ethernet Port Link Aggregation Commands


display link-aggregation link-aggregation

50

CHAPTER 2: USING PORT COMMANDS

Ethernet Port Configuration Commands


broadcast-suppression

This section describes the commands you can use to configure and manage the ports on your Switch 7700.

Syntax
broadcast-suppression pct undo broadcast-suppression

View Ethernet port view Parameter


pct: Specifies the maximum wire speed ratio of the broadcast traffic allowed on

the port. The value ranges from 5 to 100. The step is 5. By default, the value is 100. The smaller the ratio is, the smaller the broadcast traffic is allowed. Description

Use broadcast-suppression command to configure the broadcast traffic size enabled on port. Once the broadcast traffic exceeds the value set by the user, the system will discard some broadcast to ensure network service so that the traffic ratio of broadcast is maintained in a proper range. Use the undo broadcast-suppression command to restore the default broadcast traffic enabled on port as 100 so that 100% broadcast traffic is allowed to pass through.

Note that in the Switch 7700, you can only use the command at the port on 20-port 10/100/1000Base-T Gigabit Ethernet card or 20-port 1000Base-X Gigabit Ethernet card. Example Enable 20% broadcast cast to pass so that 80% broadcast storm suppression is made on broadcast traffic of port.
[SW7700-Ethernet1/0/1] broadcast-suppression 20

copy configuration

Syntax
copy configuration source { interface-type interface-number | interface-name | aggregation-group agg-id } destination { interface_list [ aggregation-group agg-id ] | aggregation-group agg-id }

View System view Parameter


interface_type: Source port type. interface_num: Source port number.

Ethernet Port Configuration Commands

51

interface_name: Source port name, in the format of interface_name = interface_type interface_num. For more information, see the parameter item for the interface command. interface_list: Destination port list, interface_list1 = { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] &<1-10>. &<1-10> indicates that the former parameter can

be input 10 times repeatedly at most.


agg-id: Source or destination aggregation group ID. If it is a source aggregation

group, the port with the smallest port number is the source port; if it is a destination aggregation group, the configurations of all its member ports changes to be consistent with that of the source. Description

Use the copy configuration command to copy the VLAN, STP, speed, and duplex configuration of a specific port to other ports, to ensure consistent configuration. For greatest success, copy between ports of the same type. However, you can copy between different port types if the port speeds are the same.

Example Copy the configuration of aggregation group 1 to aggregation group 2.


[SW7700] copy configuration source aggregation-group 1 destination aggregation-group 2

Copy the configuration of aggregation group 1 to interface group 1.


[SW7700] copy configuration source aggregation-group 1 destination gig 2/0/1 to gig 2/0/4

description

Syntax
description text undo description

View Ethernet port view Parameter


text: Enter a description of the Ethernet port. This can be a maximum of 80

characters. Description

Use the description command to enter a description of an Ethernet port. Use the undo description command to cancel the description.

By default, an Ethernet port does not have a description.

52

CHAPTER 2: USING PORT COMMANDS

Example To give the Ethernet port Ethernet0/0/1 a description of switch-interface enter the following:
[SW7700-Ethernet0/0/1]description switch-interface

display interface

Syntax
display interface [ interface_type|interface_type interface_number ]

View All views Parameter


interface_type: Enter the interface type. This can be either Ethernet, GigabitEthernet or M-Ethernet. M-Ethernet describes the out-of-band

Ethernet Management port located on the Fabric module. Other interface types are covered in the appropriate interface section.
interface_number: Enter the interface number, in the format slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis:

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module). The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1. Description

Use display interface command to view the configuration information on the selected interface. Use the command display interface to display information on all ports. Use the command display interface interface_type to display information on all ports of the specified type. Use the command display interface interface_type interface_number to display information on a specific port.

Example To display configuration information on Ethernet port 1/0/1, enter the following:
<SW7700>display interface Ethernet 1/0/1

The information displays in the following format:


Ethernet1/0/1 current state : UP

Ethernet Port Configuration Commands

53

IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fc00-0010 The Maximum Transmit Unit is 1500 Media type is twisted pair, loopback not set Port hardware type is 100_BASE_TX 100Mbps-speed mode, full-duplex mode Link speed type is autonegotiation, link duplex type is autonegotiation Flow-control is not enabled The Maximum Frame Length is 1536 Broadcast MAX-ratio: 100% Allow jumbo frame to pass PVID: 1 Mdi type: auto Port link-type: access Tagged VLAN ID : none Untagged VLAN ID : 1 Last 300 seconds input: 0 packets/sec 0 bytes/sec Last 300 seconds output: 0 packets/sec 0 bytes/sec Input(total): 0 packets, 0 bytes - broadcasts, - multicasts Input(normal): 0 packets, 0 bytes 0 broadcasts, 0 multicasts Input: 0 input errors, 0 runts, 0 giants, 0 throttles, 0 CRC 0 frame, - overruns, - aborts, - ignored, - parity errors Output(total): 0 packets, 0 bytes - broadcasts, - multicasts, - pauses Output(normal): 0 packets, 0 bytes 0 broadcasts, 0 multicasts, 0 pauses Output: 0 output errors, - underruns, - buffer failures - aborts, 0 deferred, 0 collisions, 0 late collisions - lost carrier, - no carrier

Table 4 Output Description of the Display Interface Command


Field Ethernet1/0/1 current state IP Sending frames format Hardware address Description The Maximum Transmit Unit Media type loopback not set Port hardware type Description Indicates the current state of the Ethernet port (enabled or disabled) Displays the Ethernet frame format Displays the port hardware address Displays the port description Indicates the maximum transmit unit Indicates the type of media Displays the port loopback test state Displays the port hardware type

100Mbps-speed mode, full-duplex mode, Indicates that the duplex mode and the rate have link speed type is autonegotiation, link been auto-negotiated with the connected device, duplex type is autonegotiation and have been set to 100Mbps full-duplex. Flow control is not enabled The Maximum Frame Length Broadcast MAX ratio Allow jumbo frame to pass Port flow control state Indicates the maximum length of the Ethernet frames that can pass through the port Port broadcast storm suppression ratio Indicates that jumbo frame are allowed to pass through the port

54

CHAPTER 2: USING PORT COMMANDS

Table 4 Output Description of the Display Interface Command


PVID Mdi type Port link-type Tagged VLAN ID Untagged VLAN ID Last 300 minutes input rate: 0 packets/sec, 0 bytes/sec Last 300 minutes output rate: 0 packets/sec, 0 bytes/sec Input(total): 0 packets, 0 bytes - broadcasts, - multicasts Input(normal): 0 packets, 0 bytes 0 broadcasts, 0 multicasts Input: 0 input errors, 0 runts, 0 giants, 0 throttles, 0 CRC 0 frame, - overruns, - aborts, ignored, - parity errors Output(total): 0 packets, 0 bytes - broadcasts, - multicasts, - pauses Output(normal): 0 packets, 0 bytes 0 broadcasts, 0 multicasts, 0 pauses Output: 0 output errors, - underruns, buffer failures - aborts, 0 deferred, 0 collisions, 0 late collisions - lost carrier, - no carrier Indicates the port default VLAN ID. Indicates the cable type Indicates the port link type Indicates the VLANs with packets tagged Indicates the VLANs with packets untagged Displays the input/output rate and the number of packets that were passed on this port in the last 300 seconds The statistics information of input/output packets and errors on this port. A - indicates that the item isn't supported by the switch.

display mirroring-group

Syntax
display mirroring-group [ mirror_group_number ]

View System view Parameter None Description Use the display mirroring-group command to display the ports assigned to a specific mirror group. Example To display information on mirroring group 1 enter the following:
[SW7700]display mirroring-group 1

Ethernet Port Configuration Commands

55

The information displays in the following format:


mirroring-group 1 inbound Ethernet3/0/47 mirrored-to Ethernet3/0/48

This indicates that mirror-group 1 is only capturing incoming packets to port Ethernet3/0/47 and mirroring these packet to the egress port Ethernet3/0/48 display port Syntax
display port { hybrid | trunk }

View All Views Parameter


hybrid: Enter to display the hybrid ports. trunk: Enter to display the trunk ports.

Description

Use the display port hybrid command to view the ports with the hybrid link type. Use the display port trunk command to view the ports with the trunk link type.

Example To display the currently configured hybrid ports, enter the following:
<SW7700>display port hybrid

The details display in the following format:


The following hybrid ports exist: Ethernet1/0/1 Ethernet1/0/2

This example indicates that the current configuration has two hybrid ports, Ethernet1/0/1 and Ethernet1/0/2. duplex Syntax
duplex { auto | full | half } undo duplex

View Ethernet port view Parameters


auto: Enter to set the port to auto-negotiation. full: Enter to set the port to full-duplex. half: Enter to set the port to half-duplex.

56

CHAPTER 2: USING PORT COMMANDS

Description Use the duplex command to configure the duplex mode of an Ethernet port to auto-negotiation, full duplex or half-duplex. Use the undo duplex command to restore the duplex mode of a port to the default mode (auto-negotiation). Related command: speed. Example To configure the Ethernet port Ethernet1/0/1 to auto-negotiation, enter the following:
[SW7700-Ethernet1/0/1]duplex auto

flow-control

Syntax
flow-control undo flow-control

View Ethernet port view Parameters None Description

Use the flow-control command to enable flow control on an Ethernet port. This avoids discarding data packets due to congestion. Use the undo flow-control command to disable flow control.

By default, flow control is disabled. Example To enable flow control on port Ethernet1/0/1, enter the following.
[SW7700-Ethernet1/0/1]flow-control

interface

Syntax
interface interface_type interface_number

View System view Parameter


interface_type: Enter the port type. This can be either Ethernet, GigabitEthernet or M-Ethernet. M-Ethernet describes the out-of-band

Ethernet Management port located on the Fabric module. Other interface types are covered in the appropriate interface section.
interface_number: Enter the interface number, in the format slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis:

Ethernet Port Configuration Commands

57

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module). The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1. Description Use the command interface interface_type interface_number to enter the interface of the specified port. If you want to configure the parameters of an Ethernet port, you must first use this command to enter the Ethernet port view. Example To enter the interface for port Ethernet1/0/1, enter the following:
[SW7700]interface ethernet1/0/1 [SW7700 ethernet1/0/1]

jumboframe enable

Syntax
jumboframe enable [ jumboframe-value ] undo jumboframe enable

View Ethernet port view Parameter


jumboframe-value: The size, in bytes, of the jumbo frames that are allowed to

pass through the current Ethernet port. The value ranges from 1523 bytes to 9216 bytes. Description

Use the jumboframe enable jumboframe_value command to allow jumbo frames, of the specified size, to pass through the specified Ethernet port. Use the undo jumboframe enable command to prevent jumbo frames from passing through an Ethernet port. By default, jumbo frames are disabled.

Jumbo frames are only allowed for packets with an ether type field set to Ethernet Type II. Caution should be used when using jumbo frames in a network because any device that does not support these packets will automatically filter these packets.

58

CHAPTER 2: USING PORT COMMANDS

Packets up to 1522 bytes, including the IEEE 802.1Q tagging are always allowed to pass through Ethernet ports. Example Allow jumbo frames of up to 9216 bytes to pass through GigabitEthernet port 2/0/1.
[SW7700-GigabitEthernet2/0/1]jumboframe enable 9216

mac-address max-mac-count

Syntax
mac-address max-mac-count count undo mac-address max-mac-count

View Ethernet port view Parameter


count: Enter to specify how many MAC addresses a port can learn. This can be in

the range 0 to 32768 on the Fabric 64 and 0 to 16384 on the Fabric 32. 0 means that the port is not allowed to learn MAC addresses. Description

Use the mac-address max-mac-count command to configure the maximum number of MAC addresses that can be learned by a specified Ethernet port. The port stops learning MAC addresses when the specified limit is reached. Use the undo mac-address-table max-mac-count command to cancel the maximum limit on the number of MAC addresses learned by an Ethernet port. This is the default. If you set no maximum limit, the MAC address table controls the number of MAC addresses a port can learn.

Related commands: mac-address, mac-address timer, mac-address


mac-learning disable

Examples To configure the port Ethernet 1/0/3 to learn at most 600 MAC addresses, enter the following:
[SW7700-Ethernet1/0/3]mac-address max-mac-count 600

To cancel the maximum limit on the number of MAC addresses learned by the port Ethernet1/0/3, enter the following:
[SW7700-Ethernet1/0/3]undo mac-address max-mac-count

mdi

Syntax
mdi { across | auto | normal } undo mdi

View Ethernet port view

Ethernet Port Configuration Commands

59

Parameter
across: Enter to configure the network cable type to cross-over cable. Not available on the Switch 7700. auto: Enter to configure the use of either straight-through cable or cross-over

cable.
normal: Enter to configure the network cable type to straight-through cable. Not available on the Switch 7700.

Description

Use the mdi command to configure the network cable type for an Ethernet port. Use the undo mdi command to restore the default type. By default, the network cable type is recognized automatically (the mdi auto command).

Note that this command only has effect on 10/100BASE-T and 10/100/1000BASE-T ports. The Switch 7700 only supports auto (auto-sensing). If you enter another type, an error message displays. Example To configure the network cable type of port Ethernet1/0/1 as cross-over cable, enter the following:
[SW7700-Ethernet1/0/1]mdi across

port access vlan

Syntax
port access vlan vlan_id undo port access vlan

View Ethernet port view Parameter


vlan_id: Enter a VLAN ID in the range 2 to 4094, as defined in IEEE 802.1Q.

Description

Use the port access vlan command to assign the access port to a specified VLAN. Use the undo port access vlan command to remove the access port from the VLAN.

Example To assign Ethernet port 1/0/1 to VLAN3, enter the following.


[SW7700-Ethernet1/0/1]port access vlan 3

port hybrid pvid vlan

Syntax
port hybrid pvid vlan vlan_id

60

CHAPTER 2: USING PORT COMMANDS

undo port hybrid pvid

View Ethernet port view Parameter


vlan_id: Enter a VLAN ID in the range 2 to 4094, as defined in IEEE 802.1Q. The default is 1.

Description

Use the port hybrid pvid vlan command to configure the default VLAN ID of the hybrid port. Use the undo port hybrid pvid command to restore the default VLAN ID of the hybrid port.

Hybrid port can be configured together with the isolate-user-vlan. But if the default VLAN has set mapping in the isolate-user-vlan, the default VLAN ID cannot be modified. If you want to modify it, cancel the mapping first. The default VLAN ID of local hybrid port must be consistent with that of the peer one, otherwise, the packets cannot be properly transmitted. Related command: port link-type. Example To configure the default VLAN of the hybrid port Ethernet1/0/1 to VLAN100, enter the following.
[SW7700-Ethernet1/0/1]port hybrid pvid vlan 100

port hybrid vlan

Syntax
port hybrid vlan vlan_id [ to last_vlan_id ]] { tagged | untagged } undo port hybrid vlan [ vlan_id_1 ] [ to vlan_id_2 ]

View Ethernet port view Parameter


vlan_id: Enter a VLAN ID, or more than one VLAN ID, in the range 2 to 4094. The hybrid port will be added to the specified VLANs. This can be a single VLAN, a series of individual VLANs separated by a space, or the the first VLAN in a range of VLANs. If this is the first VLAN in a range use the last_ vlan_id parameter to indicate the last VLAN in the range. to last_vlan_id: Enter a VLAN ID in the range 2 to 4094. If you want to add

the hybrid port to a range of VLANs, use this parameter to indicate the last VLAN in the range. Optional. You can enter up to ten vlan_id parameters at one port hybrid vlan command.

Ethernet Port Configuration Commands

61

tagged: Enter to tag the packets of the specified VLAN(s). untagged: Enter to leave the packets of the specified VLAN(s) untagged.

Description

Use the command port hybrid vlan to add the hybrid port to a single VLAN, a series of individual VLANs or a range of VLANs. Use the port hybrid vlan vlan_id command to join the hybrid port to a single VLAN. Use the port hybrid vlan vlan_id vlan_id command to join the hybrid port to two or more individual VLANs. Separate the number of each VLAN ID with a space. Use the port hybrid vlan vlan_id to last_vlan_id command to join the hybrid port to a range of VLANs.

You can use the above parameters in any combination, for example a single VLAN followed by a range of VLANs. See the Example below.

Use the undo port hybrid vlan command to remove the hybrid port from the specified VLAN(s).

Related command: port link-type. Example To add the hybrid port Ethernet1/0/1 to VLAN2, VLAN4 and all VLANs in the range 50 to 100, and to tag the VLAN packets, enter the following:
[SW7700-Ethernet1/0/1]port hybrid vlan 2 4 50 to 100 tagged

port link-type

Syntax
port link-type { access | hybrid | trunk } undo port link-type

View Ethernet port view Parameter


access: Enter to configure the port as an access port. hybrid: Enter to configure the port as a hybrid port trunk: Enter to configure the port as a trunk port.

Description

Use the port link-type command to configure the link type of the Ethernet port. Use the undo port link-type command to restore the port as default status. By default, a port is an access port.

62

CHAPTER 2: USING PORT COMMANDS

A port on a switch can be configured as an access port, a hybrid port, or a trunk port. However, to reconfigure between hybrid and trunk link types, you must first restore the default, or access, link type. Example To configure the Ethernet port Ethernet1/0/1 as a trunk port, enter the following:
[SW7700-Ethernet1/0/1]port link-type trunk

port trunk permit vlan

Syntax
port trunk permit vlan { vlan_id [to last_vlan_id ] | all} undo port trunk permit vlan { vlan_id [ to last_vlan_id ] | all }

View Ethernet port view Parameter


vlan_id: Enter a VLAN ID, or more than one VLAN ID, in the range 2 to 4094. The trunk port will be added to the specified VLANs. This can be a single VLAN, a series of individual VLANs separated by a space, or the first VLAN in a range of VLANs. If this is the first VLAN in a range use the last_vlan_id parameter to indicate the last VLAN in the range. to last_vlan_id: Enter a VLAN ID in the range 2 to 4094. If you want to add

the trunk port to a range of VLANs, use this parameter to indicate the last VLAN in the range. Optional. You can enter up to ten vlan_id parameters at one port trunk permit vlan command.
all: Enter to add the trunk port to all VLANs.

Description

Use the port trunk permit vlan command to add a trunk port to one VLAN, a selection of VLANs or all VLANs. Use the undo port trunk permit vlan command to remove a trunk port from one VLAN, a selection of VLANs or all VLANs.

A trunk port can belong to multiple VLANs. If the port trunk permit vlan command is used many times, then the VLAN enabled to pass on trunk port is the set of these vlan_id_list. Related command: port link-type. Example To add the trunk port Ethernet1/0/1 to VLAN 2, VLAN 4 and all VLANs in the range 50-100, enter the following:
[SW7700-Ethernet1/0/1]port trunk permit vlan 2 4 50 to 100

port trunk pvid vlan

Syntax
port trunk pvid vlan vlan_id

Ethernet Port Configuration Commands

63

undo port trunk pvid

View Ethernet port view Parameter


vlan_id: Enter a VLAN ID in the range 2 to 4094, as defined in IEEE802.1Q. This

is the VLAN that you want to be the default VLAN for a trunk port. The default is 1. Description

Use the port trunk pvid vlan command to configure the default VLAN ID for a trunk port. Use the undo port trunk pvid command to restore the default VLAN ID for a trunk port.

The default VLAN ID of local trunk port should be consistent with that of the peer one, otherwise packets cannot be properly transmitted. Related command: port link-type. Example To configure the trunk port Ethernet1/0/1 to the default VLAN of 100, enter the following:
[SW7700-Ethernet1/0/1]port trunk pvid vlan 100

reset counters interface

Syntax
reset counters interface [ interface_type | interface_type interface_number ]

View User view Parameter


interface_type: Enter to reset statistical information on all ports of the specified type. This can be either Ethernet, GigabitEthernet or M-Ethernet. M-Ethernet

describes the out-of-band Ethernet management port located on the Fabric module.
interface_number: Enter to reset statistical information on a specific port type and number. Enter the port number, in the format slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis:

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module).

64

CHAPTER 2: USING PORT COMMANDS

The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Gigabit0/1/1. Description Use the reset counters interface command to reset the statistical information on the port and count the related information again on the port for the user. If you do not enter a port type, or port type and port number, information is cleared from all ports on the Switch. Example To reset statistical information on the Ethernet port Ethernet1/0/1, enter the following:
<SW7700>reset counters interface ethernet1/0/1

shutdown

Syntax
shutdown undo shutdown

View Ethernet port view Parameter None Description


Use the shutdown command to disable an Ethernet port. Use the undo shutdown command to enable an Ethernet port.

By default, the Ethernet port is enabled. Example To enable Ethernet port Ethernet1/0/1, enter the following:
[SW7700-Ethernet1/0/1]undo shutdown

speed

Syntax For a 100 Mbps Ethernet port, the command is:


speed { 10 | 100 | auto }

For a 1000 Mbps Ethernet port, the command is:


speed { 10 | 100 | 1000 | auto } undo speed

View Ethernet port view

Ethernet Port Link Aggregation Commands

65

Parameter
10: Set the port speed to 10 Mbps. 100: Set the port speed to 100 Mbps. 1000: Set the port speed to 1000 Mbps. (Only available on 10/100/1000 ports). auto: Set the port speed to auto-negotiation.

Description

Use the speed command to configure the port speed. Use the undo speed command to restore the default speed. By default, the speed is auto.

Related command: duplex. Example To configure the port speed of port Ethernet1/0/1 to 10Mbps, enter the following:
[SW7700-Ethernet1/0/1]speed 10

vlan-vpn

Syntax
vlan-vpn { enable | disable } undo vlan-vpn

View Ethernet port view Parameters


enable: Enables port VLAN VPN. disable: Disables port VLAN VPN.

Description

Use the vlan-vpn command to enable or disable port VLAN VPN. Use the undo vlan-vpn command to restore the default status, which is VLAN VPN disabled.

You can not enable VLAN VPN on a port if any of the following are enabled: GVRP, GMRP, STP, 802.1x . Example To enable VLAN VPN on Ethernet port 1/0/1, enter the following:
[SW7700-Ethernet1/0/1]vlan-vpn enable

Ethernet Port Link Aggregation Commands

This section describes the commands you can use to configure Ethernet Port LInk Aggregation on the Switch 7700.

66

CHAPTER 2: USING PORT COMMANDS

display link-aggregation

Syntax
display link-aggregation [ interface | summary | verbose groupnumber ]

View All views Parameter


interface: Specifies the interface. summary: Provides summary information on the link aggregation group. verbose groupname: Provides detailed information on the specified group.

Description Use the display link-aggregation command to view information on all link aggregations, or the link aggregation of a specified master port. If you enter the command with a master port number, information on the specific link aggregation group will be displayed. If you enter the command without a master port number, information on all link aggregation groups is displayed. Related command: link-aggregation. Example To display information on the aggregation group with the master port number Ethernet1/0/1, enter the following:
<SW7700>display link-aggregation ethernet1/0/1

The information display in the following format:


Master port: Ethernet1/0/1 Other sub-ports: Ethernet1/0/2 Mode: both

Table 5 The description of link aggregation


Field Master port Other sub-ports Mode Description Indicates the number of the master port Indicates other member ports. Indicates the aggregation mode

link-aggregation

Syntax
link-aggregation start_port_number to end_port_number { both } undo link-aggregation { master_port_number | all }

View System view

Ethernet Port Link Aggregation Commands

67

Parameter
start_port_number: Enter the first port in the range of ports that you want to add to the link aggregation. This becomes the master port in the link aggregation. end_port_number: Enter the last port in the range of ports that you want to add

to the link aggregation.


both: Enter to configure the sub-ports in the link aggregation to share the

outgoing load on the port, depending on the source address and destination MAC address.
master_port_number: Enter the master port number in a link aggregation to cancel the link aggregation. all: Enter to cancel all aggregated ports.

Description

Use the link-aggregation command to add a series of ports to the aggregation link. The port with the smallest port number is designated the master port. Use the undo link-aggregation command to cancel a link aggregation, or all link aggregations.

Note that the Ethernet ports to be added to the aggregated link must all operate with the same speed and duplex settings. The possible settings are 10 Mbps full duplex, 100 Mps full duplex, or 1000 Mbps full duplex. Related command: display link-aggregation. Example Configure outgoing traffic on two aggregated ports:
[SW7700]link-aggregation ethernet1/0/1 to ethernet1/0/2 both

68

CHAPTER 2: USING PORT COMMANDS

USING VLAN COMMANDS

This chapter describes how to use the following commands: VLAN Configuration Commands

broadcast-suppression description display interface VLAN-interface display vlan interface VLAN-interface shutdown vlan

Port-Based VLAN Configuration Command

port

Protocol-Based VLAN Configuration Commands


display vlan-protocol interface display protocol-vlan port hybrid protocol-vlan protocol-vlan

GARP Configuration Commands


display garp statistics display garp timer garp timer garp timer leaveall reset garp statistics

GVRP Configuration Commands


display gvrp statistics display gvrp status gvrp gvrp registration

VLAN Configuration Commands

This section describes the commands you can use to configure and manage the VLANs and VLAN interfaces on your system.

70

CHAPTER 3: USING VLAN COMMANDS

broadcast-suppression

Syntax
broadcast-suppression max-ratio undo broadcast-suppression

View VLAN view Parameter


max-ratio: Enter the broadcast suppression ratio for the current VLAN as a

percentage, in the range 0 to 100. The smaller the percentage, the less broadcast traffic is allowed through the VLAN. If you do not want to perform broadcast suppression on the VLAN, enter 100, the default value. Description

Use the broadcast-suppression command, to configure the broadcast suppression ratio for VLAN. When the traffic exceeds a certain threshold, the system will drop packets to guarantee the network service and reduce the broadcast traffic to a rational scale. Use the undo broadcast-suppression command to restore the default ratio to 100, namely no VLAN broadcast suppression

Note that in the Switch 7700, you cannot use the command at the port on the 20-Port 10/100/1000BASE-T or the 20-port 1000BASE-X-SFP I/O modules. Related Command: display vlan. Example To set the broadcast suppression ratio for VLAN2 to 50%, enter the following:
[SW7700-vlan2]broadcast-suppression 50

description

Syntax
description string undo description

View VLAN view Parameter


string: Enter a description of the current VLAN, up to a maximum of 32 characters. For a description of a VLAN interface, the maximum is 80 characters.

Description

Use the description command to set a description for the current VLAN. Use the undo description command to cancel the description of current VLAN.

Related command: display vlan.

VLAN Configuration Commands

71

Example To give VLAN3 the description RESEARCH, enter the following:


[SW7700-vlan3]description RESEARCH

display interface VLAN-interface

Syntax
display interface vlan-interface [ vlan_id ]

View All views Parameter


vlan_id: Enter the ID number of the VLAN interface, ranging from 1 to 4094.

Description

Use the display interface Vlan-interface command to view the information about a specific VLAN interface, or all VLAN interfaces. The information displayed includes:

Current status of the interface Current status of the line protocol VLAN interface description Maximum Transmit Unit (MTU) IP address and subnet mask Format of the IP frames MAC hardware address.

Use display interface Vlan-interface to display information on all VLAN interfaces. Use display interface Vlan-interface vlan_id to display information on a specific VLAN interface

Related command: interface Vlan-interface. Example To display information on VLAN interface 2, enter the following:
<SW7700>display interface vlan-interface 2

The information displays in the following format:


VLAN-Interface2 is up line protocol is up Description : 3COM, SW7700, VLAN-Interface2 Interface The Maximum Transmit Unit is 1500 Internet Address is 1.1.1.1/8 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0.fc00.5517

display vlan

Syntax
display vlan [ vlan_id | all | static | dynamic ]

72

CHAPTER 3: USING VLAN COMMANDS

View All views Parameter


vlan_id: Enter to display information on a specified VLAN. all: Enter to display information on all VLANs. static: Enter to display information on VLANs created statically by the system. dynamic: Enter to display information on VLANs created dynamically by the

system. Description

Use the display vlan command to view related information about specific VLANs, specific types of VLAN or all VLANs. The information includes: VLAN type, whether the Route interface has been configured on the VLAN, the Broadcast Suppression max-ratio, the VLAN description, and a list of the tagged and untagged ports that belong to the VLAN. Use the command display vlan to display a summary of the VLAN IDs of all VLANs configured on the system. Use the command display vlan vlan_id to display information on a specific VLAN. Use the command display vlan all to display information on all the VLANs. Use the command display vlan dynamic to display information on VLANs created dynamically by the system. Use the command display vlan static to display information of VLAN created statically by the system.

Related command: vlan. Examples To display a summary of the VLAN IDs of all VLANs configured on the system, enter the following:
[SW7700]display vlan

The information displays in the following format:


The following vlan exist(s): 1 (default), 2, 3

To display information on VLAN2, enter the following:


[SW7700]display vlan 2

The information displays in the following format:


Vlan ID: 2 Vlan Type: static Route interface: not configured

VLAN Configuration Commands

73

Broadcast Max-ratio: 100% Description: 3COM Tagged Ports: none Untagged Ports: Ethernet1/0/1 Ethernet1/0/5 Ethernet1/0/7

interface VLAN-interface

Syntax
interface vlan-interface vlan_id undo interface vlan-interface vlan_id

View System view Parameter


vlan_id: Enter the ID of the VLAN interface you want to configure, in the range

1 to 4094. Note that VLAN1 is the default VLAN and cannot be deleted. Description

Use the interface VLAN-interface command to enter a VLAN interface view and use the related configuration commands. Use the undo interface VLAN-interface command to exit the current VLAN interface.

Related command: display interface VLAN-interface. Example To enter the interface view of VLAN1, enter the following:

[SW7700]interface vlan-interface 1
shutdown Syntax
shutdown undo shutdown

View VLAN interface view Parameter None Description


Use the shutdown command to disable the VLAN interface. Use the undo shutdown command to enable the VLAN interface.

By default, when all Ethernet ports are in DOWN status in VLAN interface, the VLAN interface is in DOWN status and is disabled. When there is one or more Ethernet ports in VLAN interface are in UP status, the VLAN interface is UP. This command can be used to start the interface after the related parameters and protocols of VLAN interface are set. Or when the VLAN interface fails, the

74

CHAPTER 3: USING VLAN COMMANDS

interface can be shut down first and then restarted, in this way, the interface may be restored to normal status. Shutting down or starting VLAN interface will not take any effect on any Ethernet port of this VLAN. Example Restart interface after shutting down the interface.
[SW7700-Vlan-interface1] shutdown [SW7700-Vlan-interface1] undo shutdown

vlan

Syntax
vlan vlan_id undo vlan vlan_id [ to vlan_id | all }

View System view Parameter


vlan_id: Enter the ID of the VLAN you want to configure, in the range 1 to

4094. Description

Use the vlan command to enter the VLAN view, and use the related configuration commands. Use the undo vlan command to exit from the specified VLAN. VLAN 1 is default VLAN and cannot be deleted.

Related commands: display vlan. Example To enter VLAN 3, enter the following:
[SW7700]vlan 3

Port-Based Configuration Commands


port

This section describes the command for adding a port to a VLAN.

Syntax
port interface_type interface_number [ to interface_type interface_number ] undo port interface_type interface_number [ to interface_type interface_number ]

View VLAN view

Protocol-Based VLAN Configuration Commands

75

Parameter
interface_type: Enter the interface type of the port or ports you want to add to the VLAN. This can be either Ethernet or GigabitEthernet. interface_number: Enter the interface number of the port you want to add to

the VLAN. This must not be a trunk port. If you want to add a range of ports, enter the interface number of the first port in the range. Enter this number in the format slot-number/subslot-number/port-number. On the Switch 7700:

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module). The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1.
to interface_type interface_name: If you are adding a range of ports to the

VLAN, use this parameter to indicate the last port in the range. Ensure that the range does not include a trunk port. This parameter is optional. You can enter up to ten interface_type and interface_number parameters at one port command. Description

Use the port command to add one port or a group of ports to a VLAN. Use the undo port command to remove one port or a group of ports from a VLAN.

Related command: display vlan. Example To add the interfaces from Ethernet 1/0/1 through Ethernet 1/0/3 to VLAN 2, enter the following:
[SW7700-vlan2]port ethernet 1/0/1 to ethernet 1/0/3

Protocol-Based VLAN Configuration Commands

This section describes the commands you can use to configure a protocol-based VLAN. Protocol-based VLANs are supported only in the 48-port 10/100BASE-T Auto-sensing FE, 24-port 100BASE-FX MMF FE, 8-port 1000BASE-X GE, and 8-port 10/100/1000BASE-T GE I/O modules.

display vlan-protocol interface

Syntax
display vlan-protocol interface { interface_list | all }

76

CHAPTER 3: USING VLAN COMMANDS

View Any view Parameters


interface_list: Displays the protocol information of the specific port, interface_list = { interface_num [ to interface_num2 ] }. interface_num refers to the number of the port whose protocol information is to be displayed. interface_num and interface_num 2 specify the range of the port

numbers.
all: Displays the protocol information of all ports.

Description

Use the display vlan-protocol interface command to view the protocol information and protocol index configured on the specific port, to which you can refer when you use the protocol-based VLAN and add/delete a protocol.

Related command: display interface. Example Display the protocol information and protocol index configured on Ethernet1/0/1 and Ethernet1/0/2.
[SW7700] display vlan-protocol interface ethernet1/0/1 to ethernet1/0/2 Interface Number: Ethernet1/0/1 Vlan-ID Protocol-Index Protocol-type 50 1 ip 192.168.10.1 255.255.255.0 80 2 ip 101.120.34.0 255.255.0.0 100 1 ip 104.232.43.0 255.255.255.0 100 2 ipx ethernetii Interface Number: Ethernet1/0/2 50 5 ipx raw 80 1 at 100 3 mode snap etype 0x0abc 100 5 mode llc dsap 0xac ssap 0xbd ... ...

display protocol-vlan

Syntax
display protocol-vlan { vlan_list | all }

View Any view Parameter


vlan_list: Displays the protocol information of the specific VLAN, vlan_list = { vlan_id [ to vlan_id2 }. vlan_id refers to the ID of the VLAN whose protocol information is to be displayed. vlan_id and vlan_id2 specify the range

of VLAN IDs.
all: Displays the protocol information of all VLANs.

Protocol-Based VLAN Configuration Commands

77

Description

Use the display protocol-vlan command to view the protocol information and protocol index configured on a VLAN, to which you can refer when you use the protocol-based VLAN and add/delete a protocol.

Related commands: display vlan Example Display the protocol information and protocol index configured on the VLANs from VLAN10 to VLAN20
[SW7700] display protocol-vlan 10 to 20 VLAN ID: 10 VLAN Type: Protocol-based VLAN ProtocolIndex Protocol-VLAN type 1 IP 101.120.34.0/24 2 IP 104.232.43.0/24 3 IPX ETH II 4 AT VLAN ID: 15 VLAN Type: Protocol-based VLAN Protocol-Index Protocol-type 1 ip 192.168.10.1 255.255.255.0 2 mode snap etype 0x0abc ..

port hybrid protocol-vlan

Syntax
port hybrid protocol-vlan protocol-vlan_list undo port hybrid protocol-vlan protocol-vlan_list

View Ethernet port view Parameter


protocol-vlan_list: The list of VLAN protocols that is added to or deleted from a port, protocol-vlan_list = { protocol_index [ to protocol_end ]. protocol_index refers to the first value of the protocol index. protocol_end refers to the last value of the protocol index.

Description

Use the port hybrid protocol-vlan command to associate a protocol-based VLAN with the specified port. Use the undo port hybrid protocol-vlan command to delete the association between the port and the protocol-based VLAN.

Note that only the Hybrid port supports this feature at present. The port must belong to the VLAN before you associate it with the protocol-based VLAN. Otherwise, it cannot be associated with the VLAN. Related commands: display vlan-protocol interface

78

CHAPTER 3: USING VLAN COMMANDS

Example Associate Ethernet1/0/1 with protocols 10 to 20 in VLAN 3


[SW7700-Ethernet1/0/1] port hybrid protocol-vlan 10 to 20

protocol-vlan

Syntax
protocol-vlan [ protocol-index ] { ip [ ip_address [ net_mask ] ] | ipx { ethernetii | llc | raw | snap } | at | mode { ethernetii | llc | snap } } undo protocol-vlan { protocol_index [ to protocol_end ] | all }

View VLAN view Parameter


ip_address: IP address net_mask: Mask of the IP address. It defaults to 255.255.255.0. protocol_index: Initial value of the protocol index, ranging from 0 to 4. It must

be smaller than protocol_end.


protocol_end: End value of the protocol index, ranging form 0 to 4.

Description

Use the protocol-vlan command to specify parameters for a VLAN based on protocols, such as IP and IPX. Use the undo protocol-vlan command to remove the configuration.

Related commands: display protocol-vlan Example Specify VLAN 3 to be based on IP protocol.


[SW7700-vlan3] protocol-vlan ip

Specify VLAN 5 to be based on the 123.34.56.0 network segment.


[SW7700-vlan5] protocol-vlan ip 123.34.56.0

GARP Configuration Commands


display garp statistics

This section describes the commands you can use to configure and manage the Generic Attribute Registration Protocol (GARP) on your Switch 7700. Syntax
display garp statistics [ interface interface_type interface_number [ to interface_type interface_number ]]

View All views

GARP Configuration Commands

79

Parameter
interface_type: Enter an interface type. This can be either Ethernet or GigabitEthernet. interface_number: Enter an interface number. If you want to display statistics on

a range of ports, enter the first port in the range here. Enter this in the format
slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis:

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module). The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1.
to interface_type interface_number: If you want to display statistics on a

range of ports, use this parameter to indicate the last port in the range. This parameter is optional. You can enter up to ten interface_type and interface_number parameters at one display garp statistics command. Description

Use the display garp statistics command to view the GARP statistics information for a specified port, a range of ports or all ports.

This command displays GARP statistics information, including the number of GVRP and GMRP packets received and sent, and the number of discarded packets. Example To display the GARP statistics information on Ethernet port Ethernet 1/0/1, enter the following:
<SW7700>display garp statistics interface ethernet 1/0/1

The information displays in the following format:


GARP statistics on port Ethernet1/0/1 Number Of GMRP Frames Received Number Of GVRP Frames Received Number Of GMRP Frames Transmitted Number Of GVRP Frames Transmitted Number Of Frames Discarded : : : : : 0 0 0 0 0

The above table indicates that the number of GVRP and GMRP packets received and sent on Ethernet port 1/0/1 is 0, and that the number of discarded packets is 0.

80

CHAPTER 3: USING VLAN COMMANDS

display garp timer

Syntax
display garp timer [ interface interface_type interface_number [ to interface_type interface_number ]]

View All views Parameter


interface_type: Enter an interface type. This can be either Ethernet or GigabitEthernet. interface_number: Enter an interface number, in the format slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis:

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module). The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1.
to interface_type interface_number: If you want to display timer statistics

on a range of ports, use this parameter to indicate the last port in the range. This parameter is optional. You can enter up to ten interface_type and interface_number parameters at one display garp timer command. Description

Use the display garp timer command to view the GARP timer statistics on a port, a range of ports or all ports.

CAUTION: The GARP timers on all connected Layer 2 devices must have the same timer values set. If the timer values do not match, GARP applications may not operate successfully. This command displays the following GARP timer statistics: Join time, Leave time, LeaveAll time and Hold time. Related commands: garp timer, garp timer leaveall. Example To show the GARP timer statistics on Ethernet port 1/0/2, enter the following:
<SW7700>display garp timer interface ethernet 1/0/2

The information displays in the following format:

GARP Configuration Commands

81

GARP timers on GARP GARP GARP GARP

port Ethernet1/0/2 JoinTime : 20 centiseconds Leave Time : 60 centiseconds LeaveAll Time : 1000 centiseconds Hold Time : 10 centiseconds

garp timer

Syntax
garp timer { hold | join | leave } timer_value undo garp timer { hold | join | leave }

View Ethernet port view Parameter


hold: Sets the GARP Hold timer. By default, the hold timer is set to 10

centiseconds, that is 100 ms.


join: Sets the GARP Join timer. By default, the join timer is set to 20

centiseconds, that is 200 ms.


leave: Sets the GARP Leave timer. By default, the leave timer is set to 60 centiseconds, that is 600 ms. timer_value: Enter the value of either the Hold timer, Join timer or Leave timer

in centiseconds, in the range 10 to 32765. You must enter the value in units of 5 centiseconds. Description

Use the garp timer command to configure the GARP timer values for Hold, Join, Leave and LeaveAll. For details on configuring the LeaveAll timer, refer to the garp timer leaveall section.

CAUTION: The GARP timers on all connected Layer 2 devices must have the same timer values set. If the timer values do not match, GARP applications may not operate successfully.

Use the undo garp timer command to restore the default values of the GARP timer.

Related commands: display garp timer, garp timer leaveall. Example To set the Join timer of GARP to 30 centiseconds (300 ms) on port Ethernet 1/0/1, enter the following:
[SW7700-Ethernet1/0/1]garp timer join 30

garp timer leaveall

Syntax
garp timer leaveall timer_value undo garp timer leaveall

82

CHAPTER 3: USING VLAN COMMANDS

View System view Parameter


timer_value: Enter the value of the GARP LeaveAll timer in centiseconds, in the range 10 to 32765. By default, the LeaveAll timer is set to 1000 centiseconds, that is 10 seconds.

Description

Use the garp timer leaveall command to configure the GARP leaveall timer. Use the undo garp timer leaveall command to restore the default value of 1000 centiseconds.

Related command: display garp timer, garp timer. Example To set the GARP LeaveAll timer to 1 second (100 centiseconds), enter the following:
[SW7700]garp timer leaveall 100

reset garp statistics

Syntax
reset garp statistics [ interface interface_type interface_number [ to interface_type interface_number ]]

View User view Parameter


interface_type Enter an interface type. This can be either Ethernet or GigabitEthernet interface_number: Enter an interface number, in the format slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis:

The slot number is a number in the range 0 to 8 (the Fabric slot is 0 on 4- and 7-slot chassis and 1 or 0 on 8-slot chassis). The subslot number on the Fabric 32 is set to 1. The port number is a number in the range 1 to 4 (on a Fabric 32 submodule), 1 to 8 (on an 8-port module), 1 to 24 (on a 24-port module), or 1 to 48 (on a 48-port module). The M-Ethernet interface is always set to 0/0/0.

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1.
to interface_type interface_number If you want to display timer statistics on a

range of ports, use this parameter to indicate the last port in the range. This parameter is optional.

GVRP Configuration Commands

83

You can enter up to ten interface_type and interface_number parameters at one reset garp statistics command. Description

Use the reset garp statistics command to reset the GARP statistics information for a port, a range of ports or all ports.

This command clears the GARP statistics information, that is the number of GVRP and GMRP packets received or sent, and the number of discarded packets. Related command: display garp statistics Example To clear GARP statistics information for all ports, enter the following:
<SW7700>reset garp statistics

GVRP Configuration Commands


display gvrp statistics

This section describes the commands you can use to configure and manage the GARP VLAN Registration Protocol (GVRP) on your Switch 7700. Syntax
display gvrp statistics [ interface interface_type interface_number [ to interface_type interface_number ]]

View All views Parameter


interface_type Enter an interface type. This can be either Ethernet or GigabitEthernet

The slot number is a number in the range 0 to 6 (the Fabric slot is 0). interface_number: Enter an interface number, in the format slot-number/subslot-number/port-number. On the Switch 7700 7-slot chassis: The subslot number is set to 0. The port number is a number in the range 1 to 8 (on an 8-port Gigabit module), 1 to 24 (on a 24-port 100BASE-FX module), or 1 to 48 (on a 48-port 10/100/BASE-TX modules).

You can use the interface_name at this command. This is made up of interface_type and interface_number parameters combined as a single parameter, for example Ethernet0/0/1.
to interface_type interface_number If you want to display statistics on a range

of ports, use this parameter to indicate the last port in the range. This parameter is optional. You can enter up to ten interface_type and interface_number parameters at one display gvrp statistics command.

84

CHAPTER 3: USING VLAN COMMANDS

Description Using the display gvrp statistics command, you can display GVRP statistics information on a specified port, and range of ports or all ports.

Use the display gvrp statistics interface_type interface_number command to display information on a specific port. Use the display gvrp statistics interface_type interface_number to interface_type interface_number command to display information on a range of ports. Use the display gvrp statistics command to display information on all ports.

This command displays the GVRP status, failed GVRP registration entries, last GVRP data unit origin and the GVRP registration type. Example To display the GVRP statistics information on Ethernet port 1/0/3, enter the following:
<SW7700>display gvrp statistics interface ethernet 1/0/3

The information displays in the following format:


GVRP GVRP GVRP GVRP GVRP statistics on port Ethernet1/0/3 Status : Enabled Failed Registrations : 0 Last Pdu Origin : 0000-0000-0000 Registration Type : Normal

display gvrp status

Syntax
display gvrp status

View All views Parameter None Description Using the display gvrp status command, you can check the status of GVRP. Example To display GVRP status, enter the following:
<SW7700>display gvrp status GVRP is enabled

gvrp

Syntax
gvrp undo gvrp

GVRP Configuration Commands

85

View System view/Ethernet port view Parameter None Description

Use the gvrp command to enable GVRP. You must enable GVRP globally from System view before you can enable GVRP per port from Ethernet port view. GVRP can only be enabled on a trunk port; in addition, GVRP must be enabled on both ends of a trunk link. Use the undo gvrp command to disable GVRP. This can be done globally from System view, or it can be done per port, from Ethernet port view. If you want to disable GVRP on a port, you can only do this when GVRP is enabled globally.

Related command: display gvrp status. Example To enable global GVRP, enter the following:
[SW7700]gvrp

gvrp registration

Syntax
gvrp registration { fixed | forbidden | normal } undo gvrp registration

View Ethernet port view Parameter


fixed: Enables the registration of manual VLANs. If you enter this command, dynamic VLAN registration is disabled. forbidden: Blocks all VLANs except VLAN 1, and blocks the creation of new VLANs on the port. normal: Enables VLANs to be created manually or dynamically on the port.

Description

Use the gvrp registration command to configure the GVRP registration type. Use the undo gvrp registration command to restore the default type. By default, the registration type is normal.

This command can be only used on a trunk port. Related commands: display gvrp statistics.

86

CHAPTER 3: USING VLAN COMMANDS

Example To set the GVRP registration type of Ethernet port 1/0/4 to fixed, enter the following:
[SW7700-Ethernet1/0/4]gvrp registration fixed

USING NETWORK PROTOCOL COMMANDS

This chapter describes how to use the following commands: IP Address Configuration Commands

display ip host display ip interface vlan-interface ip address ip host

ARP Configuration Commands


arp check enable arp static arp timer aging debugging arp display arp display arp timer aging gratuitous-arp-learning enable reset arp

DHCP Relay Configuration Commands


address-check disable address-check enable debugging dhcp-relay dhcp-security static dhcp-server dhcp-server ip display dhcp-security display dhcp-server display dhcp-server interface vlan-interface

IP Performance Configuration Commands


display fib display icmp statistics display ip socket display ip statistics

88

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

display tcp statistics display tcp status display udp statistics ip ip forward-broadcast reset ip statistics reset tcp statistics reset udp statistics tcp timer fin-timeout tcp timer syn-timeout tcp window

IPX Configuration Commands


display ipx interface display ipx routing-table display ipx service table display ipx statistics ipx enable ipx encapsulation ipx netbios-propagation ipx network ipx rip import-route static ipx rip mtu ipx rip multiplier ipx rip timer update ipx route-static ipx route load-balance-path ipx route max-reserve-path ipx sap disable ipx sap gns-disable-reply ipx sap gns-load-balance ipx sap max-reserve-servers ipx sap mtu ipx sap multiplier ipx sap timer update ipx service ipx split-horizon ipx tick ipx update-change-only

IP Address Configuration Commands

89

reset ipx statistics reset ipx routing-table statistics protocol

IP Address Configuration Commands


display ip host

This section describes the commands you can use to configure and manage IP Addressing on your Switch 7700.

Syntax
display ip host

View All views Parameter None Description Use the display ip host command to display all host names and their corresponding IP addresses. Example To display all host names and their corresponding IP addresses, type the following:
<SW7700>display ip host

The information displays in the following format:


Host My Aa Age 0 0 Flags Address static1.1.1.1 static2.2.2.4

display ip interface vlan-interface

Syntax
display ip interface vlan-interface vlan_id

View All views Parameter


vlan_id: Enter the identifier of the vlan interface.

Description

Use the display ip interface vlan-interface vlan_id command to view information on the specified interface.

Example To display information on VLAN-Interface 1, enter the following:


<SW7700>display ip interface vlan-interface 1

The information displays in the following format:

90

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

Vlan-interface1 current state : DOWN Line protocol current state : DOWN Internet Address is 1.1.1.1/8 Primary Broadcast address : 1.255.255.255 The Maximum Transmit Unit : 1500 bytes input packets : 0, bytes : 0, multicasts : 0 output packets : 0, bytes : 0, multicasts : 0 TTL invalid packet number: 0 ICMP packet input number: 0 Echo reply: 0 Unreachable: 0 Source quench: 0 Routing redirect: 0 Echo request: 0 Router advert: 0 Router solicit: 0 Time exceed: 0 IP header bad: 0 Timestamp request: 0 Timestamp reply: 0 Information request: 0 Information reply: 0 Netmask request: 0 Netmask reply: 0 Unknown type: 0

ip address

Syntax
ip address ip_address ip_mask [ sub ] undo ip address [ ip-address { mask | mask_length } [ sub ] ]

View VLAN interface view Parameter


ip_address: Enter the IP address of the VLAN interface. ip_mask: Enter the IP subnet mask of the VLAN interface. sub: Enter if the specified IP address and subnet mask are a secondary IP address and subnet mask for this VLAN interface. Optional.

Description

Use the ip address ip_address ip_mask command to configure the primary IP address and IP subnet mask for a VLAN interface. Use the ip address ip_address ip_mask sub command to configure a secondary address and IP subnet mask for a VLAN interface. Usually, only one IP address is required for each interface. If you want to connect the interface to several subnets, you can configure an IP addresses for each subnet. Use the undo ip address ip_address ip_mask sub command to cancel a secondary IP address and IP subnet mask of a VLAN interface. Use the undo ip address ip_address ip_mask command to cancel the primary IP address and IP subnet mask of a VLAN interface. Before you can

ARP Configuration Commands

91

cancel the primary IP address of an interface, you must cancel any secondary IP addresses.

Use the undo ip address command without any parameters to delete the primary and secondary IP addresses of an interface.

By default, the IP address of a VLAN interface is set to null. The subnet address of an IP address can be identified by subnet mask. For instance, the IP address of an interface is 202.38.10.102, and the mask is 255.255.0.0. You can confirm that the subnet address is 202.38.0.0 by performing the logic operation AND on the IP address and mask. Related commands: ip route, display ip interface, display interface. Example To configure VLAN-Interface 2 to have an IP address of 202.38.10.66, and a subnet mask of 255.255.255.0, enter the following:
[SW7700-vlan-interface2]ip address 202.38.10.66 255.255.255.0

ip host

Syntax
ip host hostname ip_address undo ip host hostname [ ip_address ]

View System view Parameter


hostname: Enter the host name of the connecting device. This is a character string

of up to 20 characters.
ip_address: Enter the hosts IP address.

Description

Use the ip host command to configure the host name and the host IP address in the Switch 7700s host table. This allows you to ping or Telnet a local device by host name. Use the undo ip host command to remove the host name and the host IP address from the host table.

By default, the host name and corresponding IP address are null. Example To enter a host name of Lanswitch1 for the IP address 202.38.0.8, enter the following .
[SW7700]ip host Lanswitch1 202.38.0.8

ARP Configuration Commands

This section describes the commands you can use to configure and manage the Address Resolution Protocol (ARP) operations on your Switch 7700.

92

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

arp check enable

Syntax
arp check enable undo arp check enable

View System view Parameter none Description Use the arp check enable command to enable the checking of an ARP entry so the device does not learn the ARP entry where the MAC address is a multicast MAC address. Use the undo arp check enable command to disable the checking of ARP entry so the device learns the ARP entry where the MAC address is a multicast MAC address. By default, the checking of ARP entry is enabled and the device does not learn the ARP entry where the MAC address is a multicast MAC address. Example Configure that the device learns the ARP entry where the MAC address is multicast MAC address.
[SW7700] undo arp check enable

arp static

Syntax
arp static ip_address mac_address [ vlan-id { interface_type interface_number } ] undo arp static ip_address

View System view Parameter


ip_address: Enter the IP address of the ARP mapping entry. mac_address: Enter the MAC address of the ARP mapping entry, in the format

H-H-H (H indicates a four digit hexadecimal number, for example 00e0-fc01-0000).


vlan_id: Enter the ID number of the local VLAN that you want to use to send

frames to this address. The VLAN ID can be in the range 1 to 4094. Optional.
interface_type: Enter the type of the port that you want to use to send frames to this address. Optional, but must be entered if a VLAN ID is specified. interface_number: Enter the number of the port that you want to use to send

frames to this address. Optional, but must be entered if a VLAN ID is specified.

ARP Configuration Commands

93

Description

Use the arp static command to manually configure the static ARP mapping entries in the ARP mapping table. You must enter an IP address and MAC address with this command. You can optionally enter a VLAN ID, which also requires entry of an interface type and interface number. The aggregation port or port with LACP enabled cannot be set as the egress port of static ARP. Use the undo arp static ip_address command to remove a static ARP mapping entry from the ARP table.

To remove all static ARP entries, use the reset arp static command. Note that the reset arp static command removes all static ARP entries permanently. By default, the ARP mapping table is empty, and the Switch uses dynamic ARP to maintain its address mapping. Related commands: reset arp, display arp, debugging arp. Example To establish a mapping between IP address 129.102.0.1 and MAC address 00e0-fc01-0000, and to send frames to this address through VLAN 1, Ethernet port 1/0/1, enter the following:
[SW7700]arp static 202.38.0.10 00e0-fc01-0000 1 Ethernet1/0/1

arp timer aging

Syntax
arp timer aging aging_time undo arp timer aging

View System view. Parameter


aging_time: Enter the aging time of dynamic ARP aging timer, in the range 1 to

1440 minutes. The default is 20 minutes. Description

Use the arp timer aging command to configure the dynamic ARP aging timer. Use the undo arp timer aging command to restore the default time of 30 minutes.

Related commands: display arp timer aging Example To configure the dynamic ARP aging timer to 10 minutes, enter the following:
[SW7700]arp timer aging 10

debugging arp

Syntax
debugging arp { packet | status }

94

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

undo debugging arp { packet | status }

View User view Parameter


packet: Enter to enable ARP packet debugging. status: Enter to enable ARP status debugging.

Description

Use the debugging arp command to enable ARP packet debugging or ARP status debugging. Use the undo debugging arp command to disable ARP packet debugging or ARP status debugging. By default, ARP debugging is disabled.

This command helps you to diagnose and troubleshoot ARP related faults. Related command: arp static, display arp. Example To set ARP to packet debugging, enter the following:
<SW7700>debugging arp packet

display arp

Syntax
display arp [ ip-address | [ dynamic | static ] [ | { begin | include | exclude } text ]]

View All views Parameter


dynamic: Enter to display the dynamic ARP entries in the ARP mapping table. static: Enter to display the static ARP entries in the ARP mapping table. begin: Start displaying from the first ARP entry that contains the specified character string text. include: Display only the ARP entries that contain the specified character string

text.
exclude: Display only the ARP entries that do not contain the specified character string text. text: A character string. The ARP entries that contain this character string are

displayed. Description Use the display arp command to display the ARP mapping table entries by entry type, or by a specified IP address.

ARP Configuration Commands

95

Related commands: arp static, reset arp, debugging arp. Example To display all ARP entries in the mapping table, enter the following:
[SW7700]display arp Type: S-Static D-Dynamic IP Address MAC Address 10.1.1.2

VLAN ID

Port Name N/A

Aging Type N/A S D

00e0-fc01-0102 N/A

10.110.91.175 0050-ba22-6fd7 1

Ethernet1/0/1 20

---

2 entries found

---

Table 6 Output Description of the display arp Command


Field Description

IP Address MAC Address VLAN ID Port Name Aging Type display arp timer aging Syntax

IP address of the ARP mapping entry MAC address of the ARP mapping entry VLAN to which the static ARP entry belongs Port to which the static ARP entry belongs Aging time of dynamic ARP entry in minutes Type of ARP entry

display arp timer aging

View All views. Parameter None Description Use the display arp timer aging command to view the current setting of the dynamic ARP aging timer. Example To display the current setting of the dynamic ARP aging timer, enter the following:
[SW7700] display arp timer aging

The information displays in the following format:


Current ARP aging time is 10 minute(s)

gratuitous-arp-learning enable

Syntax
gratuitous-arp-learning enable undo gratuitous-arp-learning enable

96

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

View System view Parameters None Description

Use the gratuitous-arp-learning enable command to allow the switch to learn gratuitous ARPs. Use the undo gratuitous-arp-learning enable command to disable a switch from learning gratuitous ARPs.

By default, the switch does not learn gratuitous ARPs. Example Enable the switch to learn gratuitous ARPs.
[SW7700] gratuitous-arp-learning enable

reset arp

Syntax
reset arp [ dynamic | static | interface interface_type interface_number ]

View User view Parameter


dynamic: Enter to clear the dynamic ARP mapping entries. Note that dynamic ARP entries start re-learning immediately. static: Enter to clear the static ARP mapping entries. Note that static ARP entries are deleted permanently. interface interface_type interface_number: Enter to clear the ARP

mapping entries for the specified. port. Description

Use the reset arp command to remove information that is no longer required from the ARP mapping table. You can remove entries of a specified type, or from a specified port. Use the reset arp command to clear all ARP entries. You are asked to confirm this entry. Use the reset arp dynamic command to clear all dynamic ARP entries. Use the reset arp static command to clear all static ARP entries. Use the display arp interface command to clear all entries for the specified port.

Related command: arp static, display arp.

ARP Configuration Commands

97

Example To clear static ARP entries, enter the following:


<SW7700>reset arp static

98

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

DHCP Relay Configuration Commands


address-check disable

This section describes the commands you can use to configure and manage the Dynamic Host Configuration Protocol (DHCP) operations on your Switch 7700.

Syntax
address-check disable

View VLAN interface view Parameter None Description Use the address-check disable command to disable the security features of DHCP relay and disable the user address validity check on a VLAN interface. Related command: address-check enable. Example To disable the security features of DHCP on interface VLAN2, enter the following:
[SW7700-vlan-interface2]address-check disable

address-check enable

Syntax
address-check enable

View VLAN interface view Parameter None Description Use the address-check enable command to enable the security features of DHCP relay and enable the user address validity check on a VLAN interface. If the MAC address and IP address of incoming traffic is not in the DHCP security table, the traffic is discarded. Related command: address-check disable, dhcp-security static Example To enable the security features of DHCP relay on interface VLAN2, enter the following:
[SW7700-vlan-interface2]address-check enable

debugging dhcp-relay

Syntax
debugging dhcp-relay

DHCP Relay Configuration Commands

99

undo debugging dhcp-relay

View User view Parameter None Description


Use the debugging dhcp-relay command to enable DHCP relay debugging. Use the undo debugging dhcp-relay command to disable DHCP relay debugging. By default, DHCP relay debugging is disabled.

Related commands: dhcp-server ip, dhcp-server, display dhcp-server vlan. Example To enable DHCP relay debugging, enter the following:
<SW7700>debugging dhcp-relay

dhcp-security static

Syntax
dhcp-security static ip_address mac_address undo dhcp-security { ip_address | all | dynamic | static }

View System view Parameter static: Specifies a static address.


ip_address: Enter the clients static IP address. mac_address: Enter the clients MAC address. all: Cancel all address table entry. dynamic: Cancel dynamic address table entry. static: Cancel static address table entry.

Description

Use the dhcp-security command to configure a static address table entry for a DHCP Server group. Use the undo dhcp-security command to cancel a address table entry for a DHCP Server group.

You can use the display dhcp-security command to view the static IP address information. Related command: display dhcp-security, dhcp-server.

100

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

Example To assign the IP address 1.1.1.1 to the MAC address 0005-5D02-F2B3, and add this information to the static address table, enter the following:
[SW7700]dhcp-security static 1.1.1.1 0005-5D02-F2B3

dhcp-server

Syntax
dhcp-server group_number undo dhcp-server

View VLAN interface view Parameter


group_number: Enter the DHCP Server group number.

Description

Use the dhcp-server command to associate a VLAN interface with a DHCP Server group. DHCP Server requests are forward to the server associated with this group from the specified interface. Use the undo dhcp-server command to remove the VLAN interface from the selected DHCP Server group. By default, DHCP Server requests are not forwarded.

You can only add the primary VLAN interface to a DHCP Server group. The primary VLAN interface is the first interface that you configure. This command has more parameters when entered in system view. Refer to dhcp-server ip below for details. Related commands: dhcp-server ip, display dhcp-server vlan, debugging dhcp-relay. Example To add VLAN-Interface 1 to DHCP Server group1, enter the following:
[SW7700-Vlan-interface1]dhcp-server 1

dhcp-server ip

Syntax
dhcp-server group_number ip ip_address_primary [ ip_address_secondary ] undo dhcp-server group_number

View System view Parameter


group_number: Enter the DHCP server group number, in the range 0 to 19. ip_address_primary: Enter the IP address of the primary Server in the group.

DHCP Relay Configuration Commands

101

ip_address_secondary: Enter the IP address of the secondary Server in the

group. Optional. Description

Use the dhcp-server ip command to configure the IP address of the DHCP Server used by the DHCP Server group. Use the undo dhcp-server ip command to delete the IP addresses of all DHCP Servers in DHCP Server group.

This command has fewer parameters when entered in VLAN interface view. Refer to dhcp-server for details. Related commands: dhcp-server, debugging dhcp-relay. Example To configure the primary and secondary IP addresses of DHCP Server group 1 as 1.1.1.1 and 2.2.2.2 respectively, enter the following:
[SW7700]dhcp-server 1 ip 1.1.1.1 2.2.2.2

To delete the IP addresses of DHCP Server group1, enter the following:


[SW7700]undo dhcp-server 1

display dhcp-security

Syntax
display dhcp-security [ ip_address | dynamic | static ]

View All views Parameter


ip_address: Enter the client IP address. dynamic: Display the dynamic address table entry. static: Display the static address table entry.

Description

Use the display dhcp-security command to display information on all clients. Use the display dhcp-security ip_address command to display information on a specific client. Use the IP address to identify the client.

Example To display the IP addresses for each client, enter the following:
<SW7700>display dhcp-security

The information displays in the following format:


IP Address MAC Address Type 2.2.2.2 0005.5d02.f2b2 Static 3.3.3.3 0005.5d02.f2b3 Dynamic --1 dhcp-security item(es) found

---

102

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

Table 7 Description of the display dhcp-security information


Field IP Address MAC Address Type Description IP address of the DHCP Server group User MAC address of the DHCP Server group Type of user address table entry, can be either dynamic or static.

display dhcp-server

Syntax
display dhcp-server group_number

View All views. Parameter


group_number: Enter a DHCP Server group number.

Description Use the display dhcp-server command to view information on a selected DHCP Server group. Related commands: dhcp-server ip, dhcp-server, display dhcp-server interface vlan-interface, debugging dhcp-relay. Example To view information on DHCP Server group 0, enter the following:
<SW7700>display dhcp-server 0

The information displays in the following format:


The first IP address of DHCP Server group 0: 1.1.1.1 The second IP address of DHCP Server group 0: 1.1.1.2 Messages from this server group: 0 Messages to this server group: 0 Messages from clients to this server group: 0 Messages from this server group to clients: 0 DHCP_OFFER messages: 0 DHCP_ACK messages: 0 DHCP_NAK messages: 0 DHCP_DECLINE messages: 0 DHCP_DISCOVER messages: 0 DHCP_REQUEST messages: 0 DHCP_INFORM messages: 0 DHCP_RELEASE messages: 0

display dhcp-server interface vlan-interface

Syntax
display dhcp-server interface vlan-interface vlan_id

Views All views

IP Performance Configuration Commands

103

Parameter
vlan_id: Enter the VLAN interface number.

Description Use the display dhcp-server interface vlan-interface command to display the information on the DHCP Server group corresponding to a specific VLAN interface. Related commands: dhcp-server, debugging dhcp-relay. Example To view the information on the DHCP Server group corresponding to VLAN-Interface 2, enter the following:
<SW7700>display dhcp-server interface vlan-interface 2

The information displays in the following format:


The DHCP server group of this interface is 0

The information shown above indicates that vlan-interface 2 is configured with a DHCP Server group whose ID is 0.

IP Performance Configuration Commands


display fib

This section describes the commands you can use to configure and manage the IP performance of your Switch 7700.

Syntax
display fib

View Any view Parameter None Description Use the display fib command to view the summary of the Forwarding Information Base. The information includes: destination address/mask length, next hop, current flag and outbound interface. Example Display the summary of the Forwarding Information Base.
<SW7700> display fib Flag D:Direct, I:Indirect, B:BlackHole, R:Reject, N:Not Use Destination/Mask Nexthop Flag Interface 127.0.0.0/8 127.0.0.1 D InLoopBack0

104

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

display icmp statistics

Syntax
display icmp statistics

View Any view Parameter none Description Use the display icmp statistics command to view the statistics information about ICMP packets. Related command: display interface Example Display statistics about ICMP packets.
<SW7700> display icmp statistics Input: bad formats echo 0 5 bad checksum 0

destination unreachable 0 redirects parameter problem information request mask replies 0 0 0 0

source quench 0 echo reply timestamp 10 0

mask requests 0 time exceeded 0 Output:echo 10

destination unreachable 0 redirects parameter problem information reply mask replies 0 0 0 0

source quench 0 echo reply timestamp 5 0

mask requests 0 time exceeded 0

Table 8 Description of the output information of the display icmp statistics command
Field Input: bad formats bad checksum echo destination unreachable source quench redirects Description Number of input packets in bad format Number of input packets with wrong checksum Number of input/output echo request packets Number of input/output packets with unreachable destination Number of input/output source quench packets Number of input/output redirected packets

IP Performance Configuration Commands

105

Table 8 Description of the output information of the display icmp statistics command
Field echo reply parameter problem timestamp information request mask requests mask replies information reply time exceeded Description Number of input/output echo reply packets Number of input/output packets with parameter problems Number of input/output timestamp packets Number of input information request packets Number of input/output mask request packets Number of input/output mask reply packets Number of output information reply packets Number of time exceeded packets

display ip socket

Syntax
display ip socket [ socktype sock-type ] [ task-id socket-id ]

View Any view Parameter sock-type: The type of a socket: (tcp: 1, udp 2, raw ip 3). task-id: The ID of a task, with the value ranging from 1 to 100. socket-id: The ID of a socket, with the value ranging from 0 to 3072. Description

Use the display ip socket command to display the information about the sockets in the current system.

Example Display the information about the socket of TCP type.


<SW7700> display ipsocket socktype 1 SOCK_STREAM: Task = VTYD(18), socketid = 1, Proto = 6, LA = 0.0.0.0:23, FA = 0.0.0.0:0, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0, socket option = SO_ACCEPTCONN SO_KEEPALIVE SO_SENDVPNID SO_SETKEEPALIVE, socket state = SS_PRIV SS_ASYNC

Task = VTYD(18), socketid = 2, Proto = 6, LA = 10.153.17.99:23, FA = 10.153.17.56:1161, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0,

106

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

socket option = SO_KEEPALIVE SO_OOBINLINE SO_SENDVPNID SO_SETKEEPALIVE, socket state = SS_ISCONNECTED SS_PRIV SS_ASYNC

Task = VTYD(18), socketid = 3, Proto = 6, LA = 10.153.17.99:23, FA = 10.153.17.82:1121, sndbuf = 8192, rcvbuf = 8192, sb_cc = 0, rb_cc = 0, socket option = SO_KEEPALIVE SO_OOBINLINE SO_SENDVPNID SO_SETKEEPALIVE, socket state = SS_ISCONNECTED SS_PRIV SS_ASYNC

Table 9 Output description of the display ip socket display


Field SOCK_STREAM Task socketid Proto sndbuf rcvbuf sb_cc Description The socket type The ID of a task The ID of a socket The protocol number used by the socket The sending buffer size of the socket The receiving buffer size of the socket The current data size in the sending buffer. The value makes sense only for the socket of TCP type, because only TCP is able to cache data The current data size in the receiving buffer The option of the socket The state of the socket

rb_cc socket option socket state

display ip statistics

Syntax
display ip statistics

View All views. Parameter None Description Use the display ip statistics command to view statistics information on IP packets. For the related commands see, display interface, display ip interface, and reset ip statistics. Example Display IP packet information.

IP Performance Configuration Commands

107

<SW7700>display ip statistics Input: sum 7120 bad protocol 0 bad checksum 0 Output: forwarding 0 dropped 0 compress fails 0 Fragment:input 0 dropped 0 fragmented 0 Reassembling:sum 0

local bad format bad options local no route output

112 0 0 27 2 0

couldn't fragment 0 timeouts 0

Table 10 Description of the Output Information of the display ip statistics Command


Field Input: sum local bad protocol bad format bad checksum bad options Output: forwarding local dropped no route compress fails Fragment: input output dropped fragmented couldnt fragment Reassembling: sum time exceeded Description Sum of input packets Number of received packets whose destination is the local device Number of packets with wrong protocol number Number of packets in bad format Number of packets with wrong checksum Number of packets that have wrong options Number of forwarded packets Number of packets that are sent by the local device Number of dropped packets during transmission Number of packets that cannot be routed Number of packets that cannot be compressed Number of input fragments Number of output fragments number of dropped fragments Number of packets that are fragmented Number of packets that cannot be fragmented Number of packets that are reassembled Number of time exceeded packets

display tcp statistics

Syntax
display tcp statistics

View All views. Parameter None. Description Use the display tcp statistics command to view statistics information on TCP packets. The statistics information is divided into two major categories: Received packets and Sent packets. These two categories are then divided into further types of

108

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

information, for example window probe packets, window update packets, duplicate packets and out-of-order packets. Related commands: display tcp status, reset tcp statistics To view information on TCP packets, enter the following:
[SW7700]display tcp statistics

The information displays in the following format:


Received packets: Total: 753 packets in sequence: 412 (11032 bytes) window probe packets: 0, window update packets: 0 checksum error: 0, offset error: 0, short error: 0 duplicate packets: 4 (88 bytes), partially duplicate packets: 5 (7 bytes) out-of-order packets: 0 (0 bytes) packets of data after window: 0 (0 bytes) packets received after close: 0 ACK packets: 481 (8776 bytes) duplicate ACK packets: 7, too much ACK packets: 0 Sent packets: Total: 665 urgent packets: 0 control packets: 5 (including 1 RST) window probe packets: 0, window update packets: 2 data packets: 618 (8770 bytes) data packets retransmitted: 0 (0 bytes) ACK-only packets: 40 (28 delayed) Retransmitted timeout: 0, connections dropped in retransmitted timeout: 0 Keepalive timeout: 0, keepalive probe: 0, Keepalive timeout, so connections disconnected : 0 Initiated connections: 0, accepted connections: 0, established connections: 0 Closed connections: 0 (dropped: 0, initiated dropped: 0) Packets dropped with MD5 authentication: 0 Packets permitted with MD5 authentication: 0

display tcp status

Syntax
display tcp status

View All views Parameter None Description Use the display tcp status command to display the TCP connection status.

IP Performance Configuration Commands

109

Example To display the status of TCP connections, enter the following:


<SW7700>display tcp status

The information displays in the following format:


TCPCB 03c82754 03c661d4 Local Add:port Foreign Add:port 129.102.100.142:23 129.102.001.092:1038 0.0.0.0:23 0.0.0.0:0 State ESTABLISHED LISTEN

TCPCB is the TCP Control Block information, including sequence numbers, window sizes, TCP state and other TCP related information. display udp statistics Syntax
display udp statistics

View Any view Parameter None Description

Use the display udp statistics command to view UDP traffic statistic information.

Related command: reset udp statistics Example Display the UDP traffic statistic information.
<SW7700> display udp statistics Received packet: Total:0 checksum error:0 shorter than header:0, data length larger than packet:0 no socket on port:0 broadcast:0 not delivered, input socket full:0 input packets missing pcb cache:0 Sent packet: Total:0

ip

Syntax
ip { redirects | ttl-expires | unreachables }

110

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

undo ip { redirects | ttl-expires | unreachables }

View System view. Parameters


redirects: Enter to send redirection packets to CPU. ttl-expires: Enter to send TTL timeout packets to CPU. unreachables: Enter to send route unreachable packets to CPU.

Description

Use the ip command to configure the Switch 7700 to send redirection packets, TTL timeout packets or route unreachable packets to CPU for further processing. By default, TTL timeout packets are sent to CPU. Use the undo ip command to prevent the sending of redirection packets, TTL timeout packets or route unreachable packets to CPU.

Example To configure the Switch 7700 to send redirection packets to the CPU for further processing, enter the following:
[SW7700]ip redirects

ip forward-broadcast

Syntax
ip forward-broadcast undo ip forward-broadcast

View System view Parameter None Description Use the ip forward-broadcast command to configure to forward L3 broadcast packets. Use the undo ip forward-broadcast command to disable to forward broadcast packets. By default, L3 broadcast packets is forwarded. Example Enable the switch to forward broadcast packets.
[SW7700]ip forward-broadcast

reset ip statistics

Syntax
reset ip statistics

IP Performance Configuration Commands

111

View User view. Parameter None. Description Use the reset ip statistics command to reset the IP statistics information. Related commands: display ip interface vlan-interface, display ip
statistics

Example To reset the IP statistics information, enter the following:


<SW7700>reset ip statistics

reset tcp statistics

Syntax
reset tcp statistics

View User view. Parameter None. Description Use the reset tcp statistics command to reset the TCP statistics information. Related commands: display tcp statistics Example To reset the TCP statistics information, enter the following:
<SW7700>reset tcp statistics

reset udp statistics

Syntax
reset udp statistics

View None Parameter None Description

Use the reset udp statistics command to clear the UDP statistics information.

Example Clear the UDP traffic statistics information.

112

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

<SW7700> reset udp statistics

tcp timer fin-timeout

Syntax
tcp timer fin-timeout wait_time undo tcp timer fin-timeout

View System view Parameter


wait_time: Enter the TCP fin-wait time in seconds, in the range 76 to 3600. The

default is 675 seconds. Description


Use the tcp timer fin-timeout command to set the TCP fin-wait time. Use the undo tcp timer fin-timeout command to restore the default TCP fin-wait time.

When the TCP connection state changes from FIN_WAIT_1 to FIN_WAIT_2, the fin-wait timer is enabled. If the switch does not receive a FIN packet within the time specified using this command, the TCP connection is terminated. Related commands: tcp timer syn-timeout, tcp window. Example To configure the TCP finwait timer value as 800 seconds.
[SW7700]tcp timer fin-timeout 800

tcp timer syn-timeout

Syntax
tcp timer syn-timeout wait_time undo tcp timer syn-timeout

View System view Parameter


wait_time: Enter the TCP syn-wait time in seconds, in the range 2 to 600. The default is 75 seconds.

Description

Use the tcp timer syn-timeout command to configure the TCP syn-wait time. Use the undo tcp timer syn-timeout command to restore the default value of the timer.

TCP will enable the synwait timer when a SYN packet is sent. The TCP connection will be terminated if the response packet is not received before the timer expires.

IPX Configuration Commands

113

Related command: tcp timer fin-timeout, tcp window. Example To configure the TCP synwait timer to 80 seconds, enter the following:
[SW7700]tcp timer syn-timeout 80

tcp window

Syntax
tcp window window_size undo tcp window

View System view Parameter


window_size: The size of the receivers buffer, in kilobytes (KB), in the range 1 to 32. By default, this is set to 4KB.

Description

Use the tcp window command to configure the size of the buffer used for TCP connections. Use the undo tcp window command to restore the default size of the buffer.

Related commands: tcp timer fin-timeout, tcp timer syn-timeout. Example To configure the size of the transceiving buffer to 3KB, enter the following:
[SW7700]tcp window 3

IPX Configuration Commands IPX Configuration Commands


display ipx interface Syntax
display ipx interface [ vlan-interface vlan_id ]

View Any view Parameter vlan_id: Specifies a VLAN interface by specifying its VLAN ID. Description

Use the display ipx interface command to view the IPX information of the specified VLAN interface.

114

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

If no vlan_id is specified, the IPX information of all IPX-enabled VLAN interfaces is displayed. Example Display the IPX information of VLAN interface 1.
<SW7700> display ipx interface Vlan-interface 1 Vlan-interface1 is down IPX address is 1.0020-9c68-448e [down] SAP is enabled Split horizon is enabled Update change only is disabled Forwarding of IPX type 20 propagation packet is disabled Delay of this IPX interface, in ticks is 1 SAP GNS response is enabled RIP packet maximum size is 432 bytes SAP packet maximum size is 480 bytes IPX encapsulation is Netware 802.3 0 received, 0 sent 0 bytes received, 0 bytes sent 0 RIP received, 0 RIP sent, 0 RIP discarded 0 RIP specific requests received, 0 RIP specific responses sent 0 RIP general requests received, 0 RIP general responses sent 0 SAP received, 0 SAP sent, 0 SAP discarded 0 SAP requests received, 0 SAP responses sent

display ipx routing-table

Syntax
display ipx routing-table [ network [ verbose ] | protocol { default | direct | rip | static } [ inactive | verbose ] | statistics | verbose ]

View Any view Parameter network: Displays IPX routing information by specifying a destination network number, which comprises eight hexadecimal numbers and is in the range 0x1 to 0xFFFFFFFE. protocol: Displays the IPX routing information by route type.

IPX Configuration Commands

115

default: Displays information of all the default routes. direct: Displays information of all the direct routes. rip: Displays all the IPX RIP routing information. static: Displays all the IPX static routing information. inactive: Displays the inactive routing information. verbose: Displays the detailed IPX routing information, including the active and inactive routes. statistics: Displays the IPX routing statistics. Description

Use the display ipx routing-table command to view the IPX routing information.

If no parameters are specified, information of all the active IPX routes is displayed. Example Display information of the active IPX routes.
[SW7700] display ipx routing-table Routing tables: Summary count: 2

Dest_Ntwk_IDProto 0x1 0x2 Direct 0 Static 60

Pre Ticks Hops Nexthop 1 1 0 1 0.0000-0000-0000 1.000e-0001-0000

Interface Vlan-interface1 Vlan-interface1

Table 11 Display information of the display ipx routing-table command


Field Dest_Ntwk_ID Proto Pre Ticks Hops Nexthop interface Description Destination network number of the route Protocol type of the route Preference of the route Tick count of the route Hop count of the route Next hop of the route Outgoing interface of the route

Display the detailed IPX routing information, including the active and inactive routes.
<SW7700> display ipx routing-table verbose Routing tables:

116

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

Destinations: 2

Routes: 3

Destination Network ID: 0x1 Protocol: Direct Ticks: 1 Nexthop: 0.0000-0000-0000 Preference: 0 Hops: 0 Time: 0

Interface: 1.0020-9c68-448e(Vlan-interface1) State: <Active> Protocol: Static Ticks: 1 Nexthop: 2.000e-0001-0000 Preference: -60 Hops: 1 Time: 0

Interface: 2.0020-9c68-448f(Vlan-interface2) State: <Inactive> Destination Network ID: 0x2 Protocol: Static Ticks: 1 Nexthop: 1.000e-0001-0000 Preference: 60 Hops: 1 Time: 0

Interface: 1.0020-9c68-448e(Vlan-interface1) State: <Active>

Table 12 Display information of the display ipx routing-table verbose command


Field Time State Description Route aging time; it is 0 for the direct and static routes, meaning they never time out The state of the route. It can be active, inactive, or delete (meaning the route is being deleted)

Display the IPX routing statistics.


<SW7700> display Routing tables: Proto/State Direct Static RIP Default Total ipx routing-table statistics route 1 2 0 0 3 active 1 1 0 0 2 added 2 2 0 0 4 deleted 1 0 0 0 1 freed 1 0 0 0 1

IPX Configuration Commands

117

Table 13 Display information of the display ipx routing-table statistics command


Field Proto/State Route Active Added Deleted Freed Description Routing protocol Number of routes, including the active and inactive routes Number of the active routes Number of the added routes Number of the deleted, yet not released routes Number of the released routes

display ipx service table

Syntax
display ipx service-table [ inactive | name name | network network | order { network | type } | type service-type ] [ verbose ]

View Any view Parameter inactive: Displays information of the inactive services. name name: Displays service information by specifying a server name. network network: Displays service information on the server with a specified network number. order { network | type }: Displays the service information by network number or by service type. type service-type: Displays the service information with a specified service type. verbose: Displays the detailed service information. Description

Use the display ipx service-table command to view the contents of the IPX server information table.

Example Display the contents of the IPX server information table.


[SW7700] display ipx service-table Abbreviation: S - Static, Pref - Preference(Decimal), NetId Network number, NodeId - Node address, hop - Hops(Decimal), Recv-If - Interface from which the service is received

Number of Static Entries:

118

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

Number of Dynamic Entries: 0 Name S Prn1 S Prn2 Type 0005 0005 NetId 000d 0008

Display the details about the IPX server information table.


[SW7700] display ipx service-table verbose Abbreviation: S - Static, Pref - Preference(Decimal), NetId Network number, NodeId - Node address, hop - Hops(Decimal), Recv-If - Interface from which the service is received

Number of Static Entries:

Number of Dynamic Entries: 0 NameType S Prn10005 S Prn20005 NetIdNodeIdSock Pref HopsRecv-If 000d000a-000a-000a0452 500 0008000a-000a-000a0452 500 02 03 Vlan-interface1 Vlan-interface1

display ipx statistics

Syntax
display ipx statistics

View Any view Parameter None Description

Use the display ipx statistics command to view the IPX packet statistics.

Example Display the IPX statistics.


<SW7700> display ipx statistics Received: 0 total, 0 packets pitched 0 packets size errors, 0 format errors 0 bad hops(>16), 0 discarded(hops=16) 0 other errors, 0 local destination 0 can not be dealed Sent: 0 forwarded, 0 generated

IPX Configuration Commands

119

0 no route, 0 discarded RIP: 0 sent, 0 received 0 responses sent, 0 responses received 0 requests received, 0 requests dealt 0 requests sent, 0 periodic updates SAP: 0 general requests received 0 specific requests received 0 GNS requests received 0 general responses sent 0 specific responses sent 0 GNS responses sent 0 periodic updates, 0 errors PING: 0 requests sent, 0 requests received 0 responses sent, 0 responses received 0 responses in time, 0 responses time out

ipx enable

Syntax
ipx enable undo ipx enable

View System view Parameter None Description


Use the ipx enable command to enable IPX. Use the undo ipx enable command to disable IPX and delete all the IPX configurations.

After the undo ipx enable command is executed, the IPX configurations are not recoverable with the ipx enable command. Example Enable IPX.
[SW7700] ipx enable

120

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

ipx encapsulation

Syntax
ipx encapsulation [ dot2 | dot3 | ethernet-2 | snap ] undo ipx encapsulation

View VLAN interface view Parameter dot2: Sets the encapsulation format to Ethernet_802.2. dot3: Sets the encapsulation format to Ethernet_802.3. ethernet-2: Sets the encapsulation format to Ethernet_II. snap: Sets the encapsulation format to Ethernet_SNAP. Description

Use the ipx encapsulation command to configure an IPX frame encapsulation format on the current VLAN interface. Use the undo ipx encapsulation command to restore the encapsulation format to the default.

By default, the IPX frame encapsulation format is Ethernet_802.3 (dot3). Example Set the IPX frame encapsulation format to Ethernet_II on VLAN interface 1.
[SW7700-Vlan-interface1] ipx encapsulation ethernet-2

ipx netbios-propagation

Syntax
ipx netbios-propagation undo ipx netbios-propagation

View VLAN interface view Parameter None Description

Use the ipx netbios-propagation command to enable the current VLAN interface to forward type 20 broadcast packets. Use the undo ipx netbios-propagation command to disable the current VLAN interface to forward type 20 broadcast packets.

By default, type 20 broadcast packets are not forwarded.

IPX Configuration Commands

121

Example Allow the current interface to forward type 20 broadcast packets.


[SW7700-Vlan-interface1] ipx netbios-propagation

ipx network

Syntax
ipx network network-number undo ipx network

View VLAN interface view Parameter network-number: Hexadecimal IPX network number in the range 0x1 to 0xFFFFFFFD. The leading 0s can be omitted when you input a network number. Description

Use the ipx network command to assign an IPX network number to the VLAN interface. Use the undo ipx network command to delete the IPX network number of the VLAN interface.

By default, no network number is assigned to VLAN interfaces; therefore, IPX is disabled on all the VLAN interfaces even after it is enabled globally. Example Assign the network number 675 to VLAN interface 1.
[SW7700-Vlan-interface1] ipx network 675

ipx rip import-route static

Syntax
ipx rip import-route static undo ipx rip import-route static

View System view Parameter None Description

Use the ipx rip import-route static command to enable RIP to import static routes. The imported routes are included in the update packets of RIP. Use the undo ipx rip import-route static command to disable RIP to import static routes.

By default, IPX RIP does not import static routes.

122

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

RIP imports only active static routes; inactive static routes are neither imported nor forwarded. Example Import the static routes into RIP.
[SW7700] ipx rip import-route static

ipx rip mtu

Syntax
ipx rip mtu bytes undo ipx rip mtu

View VLAN interface view Parameter bytes: The maximum size of RIP update packets in bytes. It is in the range 432 to 1500 and defaults to 432. Description

Use the ipx rip mtu command to configure the RIP update packet size. Use the undo ipx rip mtu command to restore the default.

Example Set the maximum RIP update packet size to 500 bytes on VLAN interface 1.
[SW7700-Vlan-interface1] ipx rip mtu 500

ipx rip multiplier

Syntax
ipx rip multiplier multiplier undo ipx rip multiplier

View System view Parameter multiplier: A multiplier of the update interval, decides the aging period of the RIP routing entries together with the update interval. It is in the range 1 to 1000 and defaults to 3. Multiply the update interval by the multiplier to get the actual aging period. Description

Use the ipx rip multiplier command to configure the aging period of the RIP routing entries. Use the undo ipx rip multiplier command to restore the default.

For the related command, see ipx rip timer update.

IPX Configuration Commands

123

Example Set the RIP aging period of the routing entries to five times the update interval.
[SW7700] ipx rip multiplier 5

ipx rip timer update

Syntax
ipx rip timer update seconds undo ipx rip timer update

View System view Parameter seconds: RIP update interval in seconds. It is in the range 10 to 60000 and defaults to 60. Description

Use the ipx rip timer update command to configure a RIP update interval. Use the undo ipx rip timer update command to restore the default.

For the related command, see ipx rip multiplier. Example Set the RIP update interval to 30 seconds.
[SW7700] ipx rip timer update 30

ipx route-static

Syntax
ipx route-static network network.node [ preference value ] [ tick ticks hop hops ] undo ipx route-static { network [ network.node ] | all }

View System view Parameter network: Destination network number of an IPX static route. It comprises eight hexadecimal numbers and is in the range 1 to 0xFFFFFFFE. network.node: Next hop address of the IPX static route. network defines the network number; node defines the node address using 12 hexadecimal numbers that are separated into three parts using -, each part in the range 1 to 0xFFFF. preference value: Route preference in the range 0 to 255. A smaller value indicates a higher preference. By default, the preference values of the static routes, direct routes, and dynamic RIP IPX routes are 60 (user-configurable), 0, and 100. ticks ticks: Time that a packet must take to reach the destination network. It is in the range 1 to 65534 and defaults to 1, with 1 tick = 1/18 seconds. When the tick

124

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

value of a VLAN interface is modified, the tick value of the static route also changes. You must configure both the tick value and the hop count. hop hops: Number of the switches on the way to the destination network. It is in the range 1 to 15 and defaults to 1. You must configure both the hop count and tick value. all: All the IPX static routes. Description

Use the ipx route-static command to configure an IPX static route. Use the undo ipx route-static command to delete the static route.

The IPX static routes with the destination network number of 0xFFFFFFFE are default routes. Example Configure an IPX static route, setting the destination network number to 0x5a, next hop to 1000.0-0c91-f61f, tick value to 10 and hop count to 2.
[SW7700] ipx route-static 5a 1000.0-0c91-f61f 10 2

ipx route load-balance-path

Syntax
ipx route load-balance-path paths undo ipx route load-balance-path

View System view Parameter paths: The maximum number of equivalent routes to the same destination. It is in the range 1 to 64 and defaults to 1. Description

Use the ipx route load-balance-path command to configure the number of equivalent routes to the same destination. Use the undo ipx route load-balance-path command to restore the default.

The number of equivalent routes configured using this command is the maximum number of active equivalent routes to the same destination in the current system. If the new number is less than the number of the current active routes, the system deactivates those excessive. Example Set the number of equivalent routes to the same destination to 30.
[SW7700] ipx route load-balance-path 30

IPX Configuration Commands

125

ipx route max-reserve-path

Syntax
ipx route max-reserve-path paths undo ipx route max-reserve-path

View System view Parameter paths: The maximum number of dynamic routes to the same destination. It is in the range 1 to 255 and defaults to 4. Description

Use the ipx route max-reserve-path command to configure the maximum number of dynamic routes to the same destination. Use the undo ipx route max-reserve-path command to restore the default.

When the number of dynamic routes to the same destination exceeds the specified maximum value, the new dynamic routes are dropped directly without being added into the routing table. When the configured new value is less than the old one, the switch, however, does not delete the excessive route entries. These route entries either time out or are manually deleted. Example Set the maximum number of dynamic routes to the same destination to 200.
[SW7700] ipx route max-reserve-path 200

ipx sap disable

Syntax
ipx sap disable undo ipx sap disable

View VLAN interface view Parameter None Description

Use the ipx sap disable command to disable SAP on the current VLAN interface. Use the undo ipx sap disable command to enable SAP on the current VLAN interface.

By default, SAP is enabled on the VLAN interface when IPX is enabled. Example Disable SAP on VLAN interface 1.

126

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

[SW7700-Vlan-interface1] ipx sap disable

ipx sap gns-disable-reply

Syntax
ipx sap gns-disable-reply undo ipx sap gns-disable-reply

View VLAN interface view Parameter None Description

Use the ipx sap gns-disable-reply command to disable IPX GNS reply on the current VLAN interface. Use the undo ipx sap gns-disable-reply command to enable IPX GNS reply on the current VLAN interface.

By default, GNS reply is enabled on the VLAN interface. Example Disable GNS reply on VLAN interface 1.
[SW7700-Vlan-interface1] ipx sap gns-disable-reply

ipx sap gns-load-balance

Syntax
ipx sap gns-load-balance undo ipx sap gns-load-balance

View System view Parameter None Description

Use the ipx sap gns-load-balance command to configure the switch to respond to GNS requests through round robin polling. Use the undo ipx sap gns-load-balance command to configure the switch to respond to GNS requests with information of the nearest server.

By default, the switch responds to SAP GNS requests using the known server information in turn. This prevents a server from getting overloaded. For the related command, see ipx sap gns-disable-reply. Example Respond to GNS requests with information of the nearest server.

IPX Configuration Commands

127

[SW7700] undo ipx sap gns-load-balance

ipx sap max-reserve-servers

Syntax
ipx sap max-reserve-servers length undo ipx sap max-reserve-servers

View System view Parameter length: The maximum length of the service information reserve-queue for one service type. It is in the range 1 to 2048 and defaults to 2048. Description

Use the ipx sap max-reserve-servers command to configure the maximum length of the service information reserve-queue for one service type. Use the undo ipx sap max-reserve-servers command to restore the default.

Example Set the maximum length of the service information reserve-queue for one service type to 1024.
[SW7700] ipx sap max-reserve-servers 1024

ipx sap mtu

Syntax
ipx sap mtu bytes undo ipx sap mtu

View VLAN interface view Parameter bytes: The maximum SAP packet size in bytes. It is in the range 480 to 1500 and defaults to 480. Description

Use the ipx sap mtu command to configure the maximum size of SAP update packets. Use the undo ipx sap mtu command to restore the default.

Example Set the maximum size of SAP update packets to 674 bytes, allowing 10 service entries on VLAN interface 1.
[SW7700-Vlan-interface1] ipx sap mtu 674

128

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

ipx sap multiplier

Syntax
ipx sap multiplier multiplier undo ipx sap multiplier

View System view Parameter multiplier: A multiplier of the update interval, decides the aging period of the SAP service entries together with the update interval. It is in the range 1 to 1000 and defaults to 3. Multiply the update interval by the multiplier to get the actual aging period. Description

Use the ipx sap multiplier command to configure the aging period of the SAP service entries. Use the undo ipx sap multiplier command to restore the default.

For the related command, see ipx sap timer update. Example Set the aging period of the SAP service entries to five times the update interval.
[SW7700] ipx sap multiplier 5

ipx sap timer update

Syntax
ipx sap timer update seconds undo ipx sap timer update

View System view Parameter seconds: SAP update interval in the range 10 to 60000 seconds. By default, the value is 60 seconds. Description

Use the ipx sap timer update command to configure a SAP update interval. Use the undo ipx sap timer update command to restore the default.

This command is invalid if the triggered updates feature is applied on VLAN interface. For the related commands, see ipx sap multiplier and ipx update-change-only. Example Set the SAP update interval to 300 seconds.
[SW7700] ipx sap timer update 300

IPX Configuration Commands

129

ipx service

Syntax
ipx service service-type name network.node socket hop hopcount [ preference preference ] undo ipx service { service-type [ name [ network.node ] ] [ preference preference ] | all }

View System view Parameter service-type: A 4-byte hexadecimal number. 0 indicates all service types. name: Specifies the server providing the specified service, a string of 1 to 47 characters. network.node: Network number and node value of the server. A network number comprises eight hexadecimal numbers and is in the range 0x1 to 0xFFFFFFFD. A node address identifies a node in the network; it is 48 bits long and comprises 12 hexadecimal numbers that are separated into three parts by -. The leading 0s can be omitted when you input network/node numbers. socket: Comprises four hexadecimal numbers and is in the range 0x1 to 0xFFFF. hop-count: Number of hops to the server, written in decimal and in the range 1 to 15. The hop count equal to or exceeding 16 implies that the service is unreachable. preference: Service preference value in the range 1 to 255, with a smaller number indicating higher preference. By default, the preference value of the static service entries is 60 (modifiable); the preference value of the dynamic service entries is fixed to 500. all: Deletes all the static service entries. Description

Use the ipx service command to add a static service entry to the server information table. Use the undo ipx service command to delete a static service entry from the server information table.

Example Add a static service entry, setting service type to 4, server name to FileServer, server network number to 130, node number to 0000-0a0b-abcd, hop count to 1 and server preference to 60.
[SW7700] ipx service 4 FileServer 130.0000-0a0b-abcd 451 hop 1 preference 60

ipx split-horizon

Syntax
ipx split-horizon undo ipx split-horizon

130

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

View VLAN interface view Parameter None Description

Use the ipx split-horizon command to enable split horizon on the current VLAN interface. Use the undo ipx split-horizon command to disable split horizon on the current VLAN interface.

By default, the split horizon of IPX is enabled. Example Enable split horizon on VLAN interface 1.
[SW7700-Vlan-interface1] ipx split-horizon

ipx tick

Syntax
ipx tick ticks undo ipx tick

View VLAN interface view Parameter ticks: Delay in ticks; it is in the range 0 to 30000 and defaults to 1. Description

Use the ipx tick command to configure an IPX packet forwarding delay on the VLAN interface. Use the undo ipx tick command to restore the default.

Example Configure VLAN interface 1 to experience a delay of five ticks before forwarding IPX packets.
[SW7700-Vlan-interface1] ipx tick 5

ipx update-change-only

Syntax
ipx update-change-only undo ipx update-change-only

View VLAN interface view

IPX Configuration Commands

131

Parameter None Description

Use the ipx update-change-only command to enable update by trigger on the current VLAN interface. Use the undo ipx update-change-only command to restore the default.

By default, update by trigger is disabled. Example Enable the update by trigger feature of IPX on VLAN interface 1.
[SW7700-Vlan-interface1] ipx update-change-only

reset ipx statistics

Syntax
reset ipx statistics

View User view Parameter None Description

Use the reset ipx statistics command to clear the IPX statistics.

Example Clear the IPX statistics.


<SW7700> reset ipx statistics

reset ipx routing-table statistics protocol

Syntax
reset ipx routing-table statistics protocol { all | default | direct | rip | static }

View User view Parameter all: Clears the statistics of all the IPX routes. default: Clears the statistics of the default IPX routes. direct: Clears the statistics of the direct IPX routes. rip: Clears the statistics of the IPX RIP routes. static: Clears the statistics of the static IPX routes.

132

CHAPTER 4: USING NETWORK PROTOCOL COMMANDS

Description

Use the reset ipx routing-table statistics protocol command to clear the statistics on the IPX routes of a specific routing type.

For the related command, see display ipx routing-table statistics. Example Clear the statistics of the IPX static routes.
<SW7700> reset ipx routing-table statistics protocol static

USING ROUTING PROTOCOL COMMANDS

This chapter describes how to use the following commands: Routing Table Display Commands

display ip routing-table display ip routing-table acl display ip routing-table ip_address display ip routing-table ip_address1 ip_address2 display ip routing-table ip-prefix display ip routing-table protocol display ip routing-table radix display ip routing-table statistics display ip routing-table verbose

Static Route Configuration Command


delete static-routes all ip route-static

RIP Configuration Commands


checkzero default cost display rip filter-policy export filter-policy import host-route import-route network peer preference rip rip authentication-mode rip input rip metricin

134

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

rip metricout rip output rip split-horizon rip version rip work summary timers

OSPF Configuration Commands


abr-summary area asbr-summary authentication-mode default cost default interval default limit default tag default type default cost default-route-advertise display debugging ospf display ospf abr-asbr display ospf asbr-summary display ospf brief display ospf cumulative display ospf error display ospf interface display ospf lsdb display ospf nexthop display ospf peer display ospf request-queue display ospf retrans-queue display ospf routing display ospf vlink filter-policy export filter-policy import import-route network

135

nssa ospf ospf authentication-mode ospf cost ospf dr-priority ospf mib-binding ospf mtu-enable ospf network-type ospf timer dead ospf timer hello ospf timer poll ospf timer retransmit ospf trans-delay peer preference reset ospf all router id silent-interface snmp-agent trap enable ospf spf-schedule-interval stub vlink-peer

Integrated IS-IS Configuration Commands


area-authentication- mode cost-style default-route-advertise display isis interface display isis lsdb display isis mesh-group display isis peer display isis route display isis spf-log domain-authentication-mode filter-policy export filter-policy import ignore-lsp-checksum- error import-route isis

136

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

isis authentication-mode isis circuit-level isis cost isis dis-priority isis enable isis mesh-group isis timer csnp isis timer dead isis timer hello isis timer lsp isis timer retransmit is-level log-peer-change md5-compatible network-entity preference reset isis all reset isis peer set-overload silent-interface spf-delay-interval spf-slice-size summary timer lsp-max-age timer lsp-refresh timer spf

BGP Configuration Commands


aggregate bgp compare-different-as- med confederation id confederation nonstandard confederation peer-as dampening debugging bgp default local-preference default med display bgp group

137

display bgp network display bgp paths display bgp peer display bgp routing-table display bgp routing-table as-path-acl display bgp routing-table cidr display bgp routing-table community display bgp routing-table community-list display bgp routing-table dampened display bgp routing-table different-origin-as display bgp routing-table flap-info display bgp routing-table peer display bgp routing-table regular-expression filter-policy export filter-policy import group import-route ip as-path acl ip community-list network peer advertise-community peer allow-as-loop peer as-number peer as-path-acl export peer connect-interface peer default-route-advertise peer description peer ebgp-max-hop peer enable peer filter-policy export peer group peer ip-prefix export peer next-hop-local peer public-as-only peer reflect-client peer route-policy export peer route-update-interval peer timer

138

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

reflect between-clients reflector cluster-id reset bgp reset bgp flap-info reset bgp group reset dampening summary automatic timer

IP Routing Policy Commands


apply as-path apply community apply cost apply cost-type apply ip next-hop apply isis apply local-preference apply origin apply tag display ip ip-prefix display route-policy filter-policy export filter-policy import if-match if-match as-path if-match community if-match cost if-match interface if-match ip next-hop if-match tag ip ip-prefix route-policy

Route Capacity Configuration Commands


display memory limit memory auto-establish disable memory auto-establish enable memory

Routing Table Display Commands

139

Routing Table Display Commands

This section describes the commands you can use to display routing table information. When the Switch 7700 runs a routing protocol, it is able to perform the functions of a router. The term router in this section can refer either to a physical router, or to the Switch 7700 running a routing protocol.

display ip routing-table

Syntax
display ip routing-table

View All views Parameter None Description

Use the display ip routing-table command to view a summary of routing table information

Each line in the table represents one route. The displayed information includes destination address/mask length, protocol, preference, cost, next hop and output interface. Only the currently used route, that is the best route, is displayed. Example To view a summary of routing table information, enter the following:
<SW7700>display ip routing-table

The information displays in the following format:


Routing Table: public net Destination/Mask Proto Pre 1.1.1.0/24 DIRECT0 1.1.1.1/32 DIRECT 0 2.2.2.0/24 DIRECT 0 2.2.2.1/32 DIRECT 0 3.3.3.0/24 DIRECT 0 3.3.3.1/32 DIRECT 0 4.4.4.0/24 DIRECT 0 4.4.4.1/32 DIRECT 0 127.0.0.0/8 DIRECT 0 127.0.0.1/32 DIRECT 0 Cost 0 0 0 0 0 0 0 0 0 0 Nexthop 1.1.1.1 127.0.0.1 2.2.2.1 127.0.0.1 3.3.3.1 127.0.0.1 4.4.4.1 127.0.0.1 127.0.0.1 127.0.0.1 Interface Vlan-interface1 InLoopBack0 Vlan-interface2 InLoopBack0 Vlan-interface3 InLoopBack0 Vlan-interface4 InLoopBack0 InLoopBack0 InLoopBack0

display ip routing-table acl

Syntax
display ip routing-table acl { acl_number | acl_name } [ verbose ]

View All views.

140

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter
acl_number Enter the number of the basic ACL, in the range 2000 to 2999. acl_name Enter the name of the ACL. This can be up to 32 characters in length. verbose Enter to display verbose information about both the active and inactive

routes that passed filtering rules. If you do not enter this parameter, the command only displays a summary of the active routes that passed filtering rules. Description

Use the display ip routing-table acl command to view the route filtered through the specified ACL.

This command is used to display the routes that passed the filtering rules in the specified ACL. The command only displays routes that passed basic ACL filtering rules. Example To display a summary of the active routes filtered through IP ACL 2000, enter the following:
<SW7700>display ip routing-table acl 2000

The information displays in the following format:


Routes matched by access-list 2000: Summary count: 4 Destination/Mask Proto Pre 127.0.0.0/8 Direct 0 127.0.0.1/32 Direct 0 169.0.0.0/8 Static 60 169.0.0.0/15 Static 60

Cost 0 0 0 0

Nexthop 127.0.0.1 127.0.0.1 2.1.1.1 2.1.1.1

Interface InLoopBack0 InLoopBack0 LoopBack1 LoopBack1

To display the verbose information of the active and inactive routes that are filtered through IP ACL 2000.
<SW7700>display ip routing-table acl 2000 verbose

The information displays in the following format:


Routes matched by access-list 2000: Generate Default: no + = Active Route, - = Last Active, # = Both* = Next hop in use Summary count:5 **Destination: 127.0.0.0 Mask: 255.0.0.0 Protocol: #Direct Preference: 0 *NextHop: 127.0.0.1 Interface: 127.0.0.1(InLoopBack0) Vlinkindex: 0 State: <NoAdvise Int ActiveU Retain Multicast Unicast> Age: 3:47Metric: 0/0Tag: 0 **Destination: 127.0.0.1 Mask: 255. 255. 255. 255 Protocol: #Direct Preference: 0 *NextHop: 127.0.0.1 Interface: 127.0.0.1(InLoopBack0) Vlinkindex: 0

Routing Table Display Commands

141

State: <NotInstall NoAdvise Int ActiveU Retain Gateway Multicast Unicast> Age: 3:47Metric: 0/0 **Destination: 179.0.0.0 Mask: 255.0.0.0 Protocol: #Static Preference: -60 *NextHop: 4.1.1.1 Vlinkindex: 0 State: <Int Hidden Static Unicast> Age: 3:47Metric: 0/0 **Destination: 169.0.0.0 Mask: 255.0.0.0 Protocol: #Static Preference: 60 *NextHop: 2.1.1.1 Interface: 2.1.1.1(LoopBack1) Vlinkindex: 0 State: <Int ActiveU Static Unicast> Age: 3:47Metric: 0/0 **Destination: 169.0.0.0 Mask: 255.254.0.0 Protocol: #Static Preference: 60 *NextHop: 2.1.1.1 Interface: 2.1.1.1(LoopBack1) Vlinkindex: 0 State: <Int ActiveU Static Unicast> Age: 3:47Metric: 0/0

display ip routing-table ip_address

Syntax
display ip routing-table ip_address [ ip_mask ] [ longer-match ] [ verbose ]

View All views Parameter


ip_address Enter the destination IP address. ip_mask Enter either the IP subnet mask (in x.x.x.x format), or the subnet mask length (in the range 0 to 32). Optional. longer-match Enter to display an address route that matches the destination IP

address in natural mask range . Optional.


verbose Enter to display verbose information about both active and inactive routes. Without this parameter, this command only displays a summary of active routes. Optional.

Description

Use the display ip routing-table ip_address command to view routing information on a specific IP address, and you can also choose the type of information to display. If the destination address, ip_address, has a corresponding route in natural mask range, this command will display all subnet routes or only the route best matching the destination address, ip_address, is displayed. And only the active matching route is displayed. Use the display ip routing-table ip_address ip_mask command to display the route that matches the specified IP destination address and subnet mask.

142

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Use the display ip routing-table ip_address longer-match command to display all destination address routes that match destination IP addresses in natural mask range. Use the display ip routing-table ip_address verbose command to display verbose information about both active and inactive routes.

Example There is corresponding route in natural mask range. Display the summary.
<SW7700>display ip routing-table 169.0.0.0 Routing Tables: Summary count:1 Destination/Mask Proto Pre Cost Nexthop 169.0.0.0/16 Static 60 0 2.1.1.1

Interface LoopBack1

There are corresponding routes in the natural mask range. Display the detailed information.
<SW7700>display ip routing-table 169.0.0.0 verbose Routing Tables: Generate Default: no + = Active Route, - = Last Active, # = Both* = Next hop in use Summary count:2 **Destination: 169.0.0.0 Mask: 255.0.0.0 Protocol: #Static Preference: 60 *NextHop: 2.1.1.1 Interface: 2.1.1.1(LoopBack1) Vlinkindex: 0 State: <Int ActiveU Static Unicast> Age: 3:47 Metric: 0/0 **Destination: 169.0.0.0 Mask: 255.254.0.0 Protocol: #Static Preference: 60 *NextHop: 2.1.1.1 Interface: 2.1.1.1(LoopBack1) Vlinkindex: 0 State: <Int ActiveU Static Unicast> Age: 3:47 Metric: 0/0

display ip routing-table ip_address1 ip_address2

Syntax
display ip routing-table ip_address1 ip_mask1 ip_address2 ip_mask2 [ verbose ]

View All views Parameter


ip_address1 ip_mask1 Enter the destination IP address and subnet mask that

you want to start the address range. This command displays the route for your chosen address range. The subnet mask can be entered as either a dotted decimal notation (x.x.x.x), or an integer in the range 0 to 32.
ip_address2 ip_mask2 Enter the IP address and subnet mask that you want to end the address range. The subnet mask can be entered as either a dotted decimal notation (x.x.x.x), or an integer in the range 0 to 32.

Routing Table Display Commands

143

verbose: Enter to display the verbose information of both the active and inactive routes. Without this parameter, the command only displays a summary of active routes. Optional.

Description Use the display ip routing-table ip_address1 ip_address2 command to view the route information for the specified address range. Example To display the routing information of destination addresses ranging from 1.1.1.0 to 2.2.2.0., with a subnet mask of 24, enter the following:
<SW7700>display ip routing-table 1.1.1.0 24 2.2.2.0 24

The information displays in the following format:


Routing tables: Summary count: 3 Destination/Mask Proto 1.1.1.0/24 DIRECT 1.1.1.1/32 DIRECT 2.2.2.0/24 DIRECT

Pre Cost Nexthop 00 1.1.1.1 00 127.0.0.1 00 2.2.2.1

Interface Vlan-interface1 InLoopBack0 Vlan-interface2

display ip routing-table ip-prefix

Syntax
display ip routing-table ip-prefix ip_prefix_name [ verbose ]

View All views Parameter


ip_prefix_name Enter the ip prefix list name. verbose Enter to display verbose information about both the active and inactive

routes that passed filtering rules. Without this parameter, this command displays the summary of active routes that passed filtering rules. Description

Use the command display ip routing-table ip-prefix ip_prefix_name to view information on the routes that passed filtering rules for the specified IP prefix name. Use the command display ip routing-table ip-prefix ip_prefix_name verbose to display both the active and inactive routes that passed filtering rules. Without the verbose parameter, this command displays the summary of the active routes that passed filtering rules.

Example To display the summary information for ip prefix list abc2, active route only, enter the following:
<SW7700>display ip routing-table ip-prefix abc2

The information displays in the following format:

144

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Routes matched by ip-prefix abc2: Summary count: 4 Destination/Mask Proto Pre 127.0.0.0/8 Direct 0 127.0.0.1/32 Direct 0 169.0.0.0/8 Static 60 169.0.0.0/15 Static 60

Cost 0 0 0 0

Nexthop 127.0.0.1 127.0.0.1 2.1.1.1 2.1.1.1

Interface InLoopBack0 InLoopBack0 LoopBack1 LoopBack1

To display the information on the active and inactive routes for prefix list abc2, enter the following:
<SW7700>display ip routing-table ip-prefix abc2 verbose

The information displays in the following format:


Routes matched by ip-prefix abc2: Generate Default: no + = Active Route, - = Last Active, # = Both* = Next hop in use Summary count:4 **Destination: 127.0.0.0 Mask: 255.0.0.0 Protocol: #Direct Preference: 0 *NextHop: 127.0.0.1 Interface: 127.0.0.1(InLoopBack0) Vlinkindex: 0 State: <NoAdvise Int ActiveU Retain Multicast Unicast> Age: 3:47 Metric: 0/0 **Destination: 127.0.0.1 Mask: 255. 255. 255. 255 Protocol: #Direct Preference: 0 *NextHop: 127.0.0.1 Interface: 127.0.0.1(InLoopBack0) Vlinkindex: 0 State: <NotInstall NoAdvise Int ActiveU Retain Gateway Multicast Unicast> Age: 3:47Metric: 0/0 **Destination: 179.0.0.0 Mask: 255.0.0.0 Protocol: #Static Preference:-60 *NextHop: 4.1.1.1 Vlinkindex: 0 State: <Int Hidden Static Unicast> Age: 3:47 Metric: 0/0 **Destination: 169.0.0.0 Mask: 255.0.0.0 Protocol: #Static Preference: 60 *NextHop: 2.1.1.1 Interface: 2.1.1.1(LoopBack1) Vlinkindex: 0 State: <Int ActiveU Static Unicast> Age: 3:47 Metric: 0/0 **Destination: 169.0.0.0 Mask: 255.254.0.0 Protocol: #Static Preference: 60 *NextHop: 2.1.1.1 Interface: 2.1.1.1(LoopBack1) Vlinkindex: 0 State: <Int ActiveU Static Unicast> Age: 3:47 Metric: 0/0

display ip routing-table protocol

Syntax
display ip routing-table protocol protocol [ inactive | verbose ]

View All views

Routing Table Display Commands

145

Parameter
protocol Enter one of the following:

direct: Displays the direct connection route information static: Displays the static route information. ospf: Displays OSPF route information. ospf-ase: Displays OSPF ASE route information. ospf-nssa: Displays OSPF NSSA route information. rip: Displays RIP route information.

inactive: Enter to display inactive route information. Without this parameter, the command displays both active and inactive route information. Optional. verbose: Enter to display verbose route information. Without this parameter, the

command displays the route summary. Optional. Description Use the display ip routing-table protocol command to view the route information for a specified protocol. Example To display a summary of all direct connection routes, enter the following:
<SW7700>display ip routing-table protocol direct

The information displays in the following format:


DIRECT Routing tables: Summary count: 4 DIRECT Routing tables status:<active>: Summary count: 3 Destination/Mask Proto Pre Cost Nexthop 20.1.1.1/32 DIRECT 0 0 127.0.0.1 127.0.0.0/8 DIRECT 0 0 127.0.0.1 127.0.0.1/32 DIRECT 0 0 127.0.0.1 DIRECT Routing tables status:<inactive>: Summary count: 1 Destination/Mask Proto Pre Cost Nexthop 210.0.0.1/32 DIRECT 0 0 127.0.0.1

Interface: InLoopBack0 InLoopBack0 InLoopBack0

Interface InLoopBack0

To display a summary of all static route information, enter the following:


<SW7700>display ip routing-table protocol static

The information displays in the following format:


STATIC Routing tables: Summary count: 1 STATIC Routing tables status:<active>: Summary count: 0 STATIC Routing tables status:<inactive>: Summary count: 1 Destination/Mask Proto Pre Cost Nexthop 1.2.3.0/24 STATIC 60 0 1.2.4.5

Interface Vlan-interface2

146

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

The displayed information helps you to confirm whether the configuration of the static routing is correct. display ip routing-table radix Syntax
display ip routing-table radix

View All views Parameter None Description Use the display ip routing-table radix command to view the route information in a tree structure. Example To display the route information, enter the following:
<SW7700>display ip routing-table radix

The information displays in the following format:


Radix tree for INET (2) inodes 7 routes 5: +-32+--{210.0.0.1 +--0+ | | +--8+--{127.0.0.0 | | | +-32+--{127.0.0.1 | +--1+ | +--8+--{20.0.0.0 | +-32+--{20.1.1.1

display ip routing-table statistics

Syntax
display ip routing-table statistics

View All views Parameter None Description

Use the display ip routing-table statistics command to display the routing information for all protocols.

The information includes the number of routes per protocol, the number of active routes per protocol, the number of routes added and deleted per protocol, and the number of routes that are labeled deleted but that are not deleted per protocol. The total number of routes in each of these categories is also displayed. Example To display the integrated route information., enter the following:

Routing Table Display Commands

147

<SW7700>display ip routing-table statistics Routing tables: Proto route DIRECT 24 STATIC 4 BGP 0 RIP 0 IS-IS 0 OSPF 0 O_ASE 0 O_NSSA 0 AGGRE 0 Total 28

active 4 1 0 0 0 0 0 0 0 5

added 25 4 0 0 0 0 0 0 0 29

deleted 1 0 0 0 0 0 0 0 0 1

Table 14 Information Generated by the Display IP Routing-Table Statistics Command


Field Proto route active added deleted Description Routing protocol Number of routes Number of active routes Number of added routes after the router is rebooted or the routing table is cleared last time. Number of deleted routes (such routes will be freed in a period of time)

display ip routing-table verbose

Syntax
display ip routing-table verbose

View All views Parameter None Description Use the display ip routing-table verbose command to display the verbose routing table information. The information displayed includes the route state, the verbose description of each route and the statistics of the entire routing table. All current routes, including inactive routes and invalid routes, are displayed. Example To display the verbose routing table information, enter the following:
<SW7700>display ip routing-table verbose

The information displays in the following format:


Routing Tables: Generate Default: no + = Active Route, - = Last Active, # = Both

* = Next hop in use

148

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Destinations: 3 Routes: 3 Holddown: 0 Delete: 62 Hidden: 0 **Destination: 1.1.1.0 Mask: 255.255.255.0 Protocol: #DIRECT Preference: 0 *NextHop: 1.1.1.1 Interface: 1.1.1.1(Vlan-interface1) State: <Int ActiveU Retain Unicast> Age: 20:17:41 Metric: 0/0 **Destination: 1.1.1.1 Mask: 255.255.255.255 Protocol: #DIRECT Preference: 0 *NextHop: 127.0.0.1 Interface: 127.0.0.1(InLoopBack0) State: <NoAdvise Int ActiveU Retain Gateway Unicast> Age: 20:17:42 Metric: 0/0 **Destination: 2.2.2.0 Mask: 255.255.255.0 Protocol: #DIRECT Preference: 0 *NextHop: 2.2.2.1 Interface: 2.2.2.1(Vlan-interface2) State: <Int ActiveU Retain Unicast> Age: 20:08:05 Metric: 0/0

The parameters are defined in Table 15


Table 15 Routing Table Information
Descriptor Holddown Meaning The number of holddown routes. This refers to a route advertising policy that some distance vector routing protocols (such as RIP) use to avoid expansion of error routes and to improve the transmission speed and accuracy of unreachable routes. It usually advertises a static route at an interval, regardless of the changes to dynamic routes to the same destination. For details, see the specific routing protocol. Delete Hidden The number of deleted routes. The number of hidden routes, that is routes not available at present but still required. They can be hidden for future use.

Static Route Configuration Command


delete static-routes all

This section describes the command you can use to configure a static route.

Syntax
delete static-routes all

View System view Parameter None Description Use the delete static-routes all command to delete all the static routes.

Static Route Configuration Command

149

The system requests your confirmation before it deletes all the configured static routes. Related commands: ip route-static and display ip routing-table. Example Delete all the static routes in the router.
[SW7700] delete static-routes all This will erase all unicast static routes and their configurations, you must reconfigure all static routes Are you sure to delete all the static routes?[Y/N]

ip route-static

Syntax
ip route-static ip_address { mask | mask-length } { interface_name | gateway_address } [ preference preference_value ] [ reject | blackhole ] undo ip route-static ip-address { mask | mask_length } [ interface_name | gateway_address ] [ preference preference_value ]

View System view Parameter


ip-address: Destination IP address in dotted decimal notation. mask: Mask. mask-length: The number of consecutive 1s in the mask. Because 1s in the 32-bit

mask must be consecutive, the mask in dotted decimal format can be replaced by
mask-length. interface_name . Specify the transmission interface name of the route.Packets that are sent to a NULL interface, are discarded immediately which decreases the system load. gateway_address . Specify the next hop IP address of the route. preference_value . The preference level of the route in the range 1 to 255. The

default is 60.
reject: Indicates an unreachable route. blackhole: Indicates a blackhole route.

Description

Use the ip route-static command to configure a static route. Use the undo ip route-static command to delete the configured static route.

By default, the system can access the subnet route directly connected to the router. If you do not use the parameters preference, reject or blackhole, the

150

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

route will be reachable by default with a preference level of 60. If it is not specified as reject or blackhole, the route will be reachable by default. A static route is a special route. You can set up an interconnecting network with the static route configuration. The problem for such configuration is when a fault occurs to the network, the static route cannot change automatically to steer away from the node causing the fault without the help of an administrator. In a relatively simple network, you only need to configure the static routes to make the router work normally. The proper configuration and usage of the static route can improve the network performance and ensure the bandwidth of the important applications. All the following routes are static routes:

Reachable route A normal route is of this type. That is, the IP packet is sent to the next hop via the route marked by the destination. It is a common type of static routes. Unreachable route When a static route to a destination has the reject attribute, all the IP packets to this destination will be discarded, and the originating host will be informed destination unreachable. Blackhole route When a static route to a destination is of the blackhole attribute, all the IP packets to this destination will be discarded, and the originating host will not be informed.

The attributes reject and blackhole are usually used to control the range of reachable destinations of this router and to help troubleshoot the network. Use the following precautions when configuring a static route:

When the destination IP address and subnet mask are both set to 0.0.0.0, this is the configured default route. A packet is forwarded along the default route if a routing table is not detected. As an alternative way to configure preference level, a flexible routing protocol can be adopted.

Related command: display ip routing-table. Example To configure the next hop of the default route as 129.102.0.2, enter the following:
[SW7700]ip route-static 0.0.0.0 0.0.0.0 129.102.0.2

RIP Configuration Commands

This section describes the commands you can use to configure the Routing Information Protocol (RIP). When the Switch 7700 runs a routing protocol, it is able to perform the functions of a router. The term router in this section can refer either to a physical router or to the Switch 7700 running a routing protocol.

RIP Configuration Commands

151

checkzero

Syntax
checkzero undo checkzero

View RIP view Parameter None Description

Use the checkzero command to check the zero field of RIP-1 packets. By default, RIP-1 performs zero field checking. Use the undo checkzero command to disable the checking of the zero fields.

According to the RFC1058 protocol specifications, some fields in RIP-1 packets must be set to zero. These are called zero fields. During the zero check operation, if a RIP-1 packet is received in which the zero fields are not zeros, it will be rejected. Use the checkzero command to enable or disable the zero check operation on RIP-1. This command does not work with RIP-2 packets, since RIP-2 packets have no zero fields. Example To configure the Switch not to perform zero checking for RIP-1 packet, enter the following:
[SW7700-rip]undo checkzero

default cost

Syntax
default cost value undo default cost

View RIP view Parameter


value Enter the default routing cost, in the range 1 to 16. The default is 1.

Description

Use the default cost command to set the default routing cost of an imported route. Use the undo default cost command to restore the default value.

If you do not specify a routing cost when using the import-route command, the default cost you specify here is used. Related command: import-route.

152

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example To set the default routing cost of the imported route of another routing protocol to 3, enter the following:
[SW7700-rip]default cost 3

display rip

Syntax
display rip

View All views Parameter None Description

Use the display rip command to view the current RIP running state and its configuration information.

Example

To display the current running state and configuration information of the RIP, enter the following:
<SW7700>display rip RIP is running public net VPN-Instance Checkzero is on Default cost : 1 Summary is on Preference : 100 Period update timer : 30 Timeout timer : 180 Garbage-collection timer : 120 No peer router Network : 202.38.168.0

The information shown above indicates that RIP is running, the default-metric is 1, no unicast address is specified, the interface of the network segment 202.38.168.0 is enabled and the RIP preference is 100. filter-policy export Syntax
filter-policy { acl_number | ip-prefix ip_prefix_name } export [ routing_protocol ] undo filter-policy { acl_number | ip-prefix ip_prefix-name } export [ routing_protocol ]

View RIP view Parameter


acl_number: Enter the number of the ACL that you want to use to filter the

destination addresses of the routing information.

RIP Configuration Commands

153

ip_prefix_name: Enter the name of the address prefix list that you want to use to filter the destination addresses of the routing information. routing_protocol: Enter the routing protocol whose routing information is to be

filtered. This can be one of the following:


direct - Specifies direct routes bgp - Specifies Border Gateway Protocol (BGP). ospf- Specifies Open Shortest Path First (OSPF). ospf-ase - Specifies OSPF external routes. ospf-nssa - Specifies OSPF NSSA external routes. static - Specifies static routes.

Description

Use the filter-policy export command to configure RIP to filter the advertised routing information. Use the undo filter-policy export command to configure RIP not to filter the advertised routing information. This is the default.

Related commands: acl, filter-policy import, ip ip-prefix. Example To filter the advertised route information using acl 2003, enter the following:
[SW7700-rip]filter-policy 2003 export

filter-policy import

Syntax
filter-policy gateway ip_prefix_name import undo filter-policy gateway ip_prefix_name import filter-policy { acl_number | ip-prefix ip_prefix_name gateway ip-prefix-name ] } import undo filter-policy { acl_number | ip-prefix ip_prefix_name [ gateway ip-prefix-name ]} import

View RIP view Parameter


gateway ip_prefix_name Enter the name of the address prefix list. This is used to

filter the addresses of this neighboring routers advertising the routing information.
acl_number Enter an ACL number. This is used to filter the destination addresses

of the routing information.


ip_prefix_name Enter the name of the address prefix list. This is used to filter the

destination addresses of the routing information.

154

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Description

Use the filter-policy gateway import command to configure the switch to filter the routing information received from a specified address. Use the undo filter-policy gateway import command to configure the switch not to filter the routing information received from the specified address. Use the filter-policy import command to configure the switch to filter global routing information. Use the undo filter-policy import command to disable filtering of received global routing information.

By default, RIP does not filter the received routing information. Related commands: acl, filter-policy export, ip ip-prefix. Example To configure the filtering of the global routing information using ACL 2003, enter the following:
[SW7700-rip]filter-policy 2003 import

host-route

Syntax
host-route undo host-route

View RIP view Parameter None Description

Use the host-route command to configure RIP to accept host routes. This is the default. Use the undo host-route command to configure RIP to reject host routes.

Example To configure RIP to reject a host route, enter the following:


[SW7700-rip]undo host-route

import-route

Syntax
import-route protocol [ cost value ]* undo import-route protocol

| route-policy

route-policy-name

View RIP view

RIP Configuration Commands

155

Parameter
protocol Enter the routing protocol to be imported. This can be one of the following: direct, bgp, isis, ospf, ospf-ase, ospf-nssa or static. value Enter the cost value of the route to be imported. route-policy route_policy_name Enter a route-policy name. Only routes that

match the conditions of the specified policy are imported. Description

Use the import-route command to import the routes of other protocols into RIP. Use the undo import-route command to cancel the import of routes from other protocols. By default, RIP does not import any other route.

The import-route command is used to import the route of another protocol. If you do not specify a cost value , routes are imported according to the current value of the default cost command, which must be in the range 1 to 16. If the default cost is larger than or equal to 16, RIP regards this an unreachable and the transmission is stopped within 120 seconds. If you specify a cost value RIP regards the imported route as its own route and transmits it with the specified cost value. This command can greatly enhance the capability of RIP to obtain routes, and therefore increases the performance of RIP. Related commands: default cost. Example To import a static route with a cost of 4, enter the following:
[SW7700-rip]import-route static cost 4

To set the default cost, and then import an OSPF route with this default cost, enter the following two commands:
[SW7700-rip]default cost 3 [SW7700-rip]import-route ospf

network

Syntax
network network_address undo network network_address

View RIP view Parameter


network_address: Enter the IP network address of an interface.

156

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Description

Use the network command to enable Routing Information Protocol (RIP) on the interface of a specified network segment connected to the router. Use the undo network command to disable RIP on the interface. By default, RIP is disabled on an interface.

After you have enabled RIP, you must also enable RIP for a specified interface using this command. RIP only operates on the interface of specified network segments. The undo network command is similar to the undo rip work command, in that an interface using either command will not receive/transmit RIP routes. However, if you use undo rip work, other interfaces will still forward the routes of the interfaces set to undo rip work. If you use undo network, other interfaces will not forward the routes of interfaces set to undo network. When the network command is used on an IP address, the interface on this network segment is enabled. For example, if you view the network 129.102.1.1 with both the display current-configuration command and the display rip, the IP address is shown as 129.102.0.0. Related commands: rip work. Example To enable RIP on the interface with the network address 129.102.0.0., enter the following:
[SW7700-rip]network 129.102.0.0

peer

Syntax
peer ip_address undo peer ip_address

View RIP view Parameter


ip_address Enter the IP address of the peer router.

Description

Use the peer command to configure the destination address of the peer device. Use the undo peer command to cancel the set destination address. By default, there is no destination address.

3Com recommends that you do not use this command. RIP can use unicast to exchange information with non-broadcasting networks. If required, you can use this command to specify the destination address of the peer device. Example To specify the sending destination address as 202.38.165.1, enter the following:
[SW7700-rip]peer 202.38.165.1

RIP Configuration Commands

157

preference

Syntax
preference value undo preference

View RIP view Parameter


value Enter the preference level, in the range 1 to 255. By default, the value is

100. Description

Use the preference command to configure the route preference of RIP. Use the undo preference command to restore the default preference.

The default value of each routing protocol is determined by the specific routing policy. This preference determines the optimal route in the IP routing table. You can use this command to modify the RIP preference. Example To specify an RIP preference of 20, enter the following:
[SW7700-rip]preference 20

reset

Syntax
reset

View RIP view Parameter None Description Use the reset command to reset the system configuration parameters of RIP. When you need to re-configure parameters of RIP, this command can be used to restore to the default setting. Example Reset the RIP system.
[SW7700-rip]reset

rip

Syntax
rip undo rip

158

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

View System view Parameter None Description

Use the rip command to enable RIP and enter the RIP command view. From here, you can configure RIP using the other commands described in this section. Use the undo rip command to disable RIP. By default, RIP is disabled.

Enabling RIP does not affect interface configurations. Example To enable RIP, and enter RIP view, enter the following:
[SW7700]rip [SW7700-rip]

rip authentication-mode

Syntax
rip authentication-mode { simple password | md5 { usual key-string | nonstandard key-string key-id } } undo rip authentication-mode

View Interface View Parameter


simple: Enter to specify simple text authentication mode. password: Enter the simple text authentication key. md5: Enter to specify MD5 cipher text authentication mode. key-string: Enter the MD5 cipher text authentication key. If it is entered in plain

text, the MD5 key is a character string not exceeding 16 characters. This key is displayed in a cipher text form in a length of 24 characters when display current-configuration command is executed. Inputting the MD5 key in cipher text form with 24 characters long is also supported.
id: Enter an MD5 cipher text authentication identifier, ranging from 1 to 255. nonstandard: Enter to set the MD5 cipher text authentication packet to use a

nonstandard packet format (as described in RFC2082).


usual: Enter to set the MD5 cipher text authentication packet to use the general packet format (as described in RFC1723).

RIP Configuration Commands

159

Description Use the rip authentication-mode command to configure the RIP-2 authentication mode and its parameters for the Switch 7700.

Use the rip authentication-mode simple command to configure the RIP-2 simple text authentication key. Use the rip authentication-mode md5 key-string to configure the MD5 cipher text authentication key for RIP-2. Use the rip authentication-mode md5 key-id command to configure the MD5 cipher text authentication ID for RIP-2. Use the rip authentication-mode md5 type command to configure the format type of the MD5 cipher text authentication packet for RIP-2. Use the undo rip authentication-mode command to cancel RIP-2 authentication.

There are two RIP-2 authentication modes: simple authentication and MD5 cipher text authentication. When you use MD5 cipher text authentication mode, two types of packet formats are available. The standard format (set using the usual parameter), is described in RFC 1723. The non-standard format (set using the nonstandard parameter), is described in RFC 2082. RIP-1 does not support authentication. Related command: rip version. Example To specify the interface Vlan-interface 1 to use simple authentication with the key set to aaa, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip version 2 [SW7700-Vlan-interface1]rip authentication-mode simple aaa

To specify the interface Vlan-interface 1 to use MD5 cipher text authentication with the key set to aaa and the packet type as nonstandard, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip version 2 [SW7700-Vlan-interface1]rip authentication-mode md5 key-string aaa [SW7700-Vlan-interface1]rip authentication-mode md5 type nonstandard

To set MD5 authentication on Vlan-interface 1 with the key string set to aaa and the packet type set to usual, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip version 2 [SW7700-Vlan-interface1]rip authentication-mode md5 key-string aaa [SW7700-Vlan-interface1]rip authentication-mode md5 type usual

rip input

Syntax
rip input undo rip input

160

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

View Interface View Parameter None Description

Use the rip input command to allow an interface to receive RIP packets. By default, all interfaces except loopback interfaces are able to receive RIP packets. Use the undo rip input command to block an interface from receiving RIP packets.

This command is used in conjunction with two other two commands: rip output and rip work. The rip input and rip output commands control, respectively, the receipt and the transmission of RIP packets on an interface. The rip work command allows both receipt and transmission of RIP packets. Related commands: rip output, rip work. Example To set the interface Vlan-interface 1 not to receive RIP packets, enter the following:
[SW7700-Vlan-interface1]undo rip input

rip metricin

Syntax
rip metricin value undo rip metricin

View Interface View Parameter


value: Enter an additional route metric to be added when receiving a packet, ranging from 0 to 16. By default, the value is 0.

Description Use the rip metricin command to configure an additional route metric to be added to the route when an interface receives RIP packets. Use the undo rip metricin command to restore the default value of this additional route metric. Related command: rip metricout. Example To set the additional route metric to 2 when the interface Vlan-interface 1 receives RIP packets, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip metricin 2

RIP Configuration Commands

161

rip metricout

Syntax
rip metricout value undo rip metricout

View Interface View Parameter


value: Enter an additional route metric added when transmitting a packet,

ranging from 1 to 16. By default, the value is 1. Description

Use the rip metricout command to configure an additional route metric to be added to a route when an interface transmits RIP packets. Use the undo rip metricout command to restore the default value of the additional route metric.

Related command: rip metricin. Example To set the additional route metric to 2 when the interface Vlan-interface 1 transmits RIP packets, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip metricout 2

rip output

Syntax
rip output undo rip output

View Interface View Parameter None Description


Use the rip output command to allow an interface to transmit RIP packets. Use the undo rip output command to disable an interface to transmit RIP packets.

By default, all interfaces except loopback interfaces are able to transmit RIP packets. This command is used in conjunction with two other commands: rip input and rip work. rip input and rip output control, respectively, the receipt and the transmission of RIP packets on an interface. rip work allows both receipt and transmission of RIP packets.

162

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related commands; rip input, rip work.


Example

To prevent the interface Vlan-interface 1 from transmitting RIP packets, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]undo rip output

rip split-horizon

Syntax
rip split-horizon undo rip split-horizon

View Interface View Parameter None Description

Use the rip split-horizon command to configure an interface to use split horizon when transmitting RIP packets. This is the default. Use the undo rip split-horizon command to configure an interface not to use split horizon when transmitting RIP packets.

Normally, split horizon is necessary for reducing router loops. You may need to disable split horizon to ensure proper operation of protocols. Example To set the interface Vlan-interface 1 not to use split horizon when processing RIP packets, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]undo rip split-horizon

rip version

Syntax
rip version 1 rip version 2 [ broadcast | multicast ] undo rip version

View Interface View Parameter


1 Enter to set the interface version to RIP-1. 2 Enter to set the interface version to RIP-2. broadcast Enter to set the transmission mode of an RIP-2 packet to broadcast. multicast Enter to set the transmission mode of an RIP-2 packet to multicast.

RIP Configuration Commands

163

Description

Use the rip version command to configure the version number of RIP packets on an interface. Use the undo rip version command to restore the default RIP packet version on the interface. The interface RIP version is RIP-1.

By default, RIP-1 transmits packets in broadcast mode, while RIP-2 transmits packets in multicast mode. When running RIP-1, the interface receives and transmits RIP-1 packets, and can also receive RIP-2 broadcast packets. When running RIP-2 in broadcast mode, the interface receives and transmits RIP-2 broadcast packets, and can also receive both RIP-1 packets and RIP-2 multicast packets. When running RIP-2 in multicast mode, the interface receives and transmits RIP-2 multicast packets, and can also receive RIP-2 broadcast packets. The interface can not receive RIP-1 packets. Example To configure the interface Vlan-interface 1 to RIP-2 broadcast mode, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip version 2 broadcast

rip work

Syntax
rip work undo rip work

View Interface View Parameter None Description

Use the rip work command to enable the RIP on an interface. This is the default. Use the undo rip work command to disable RIP on an interface.

This command is used in conjunction with the rip input, rip output and network commands. Refer to the descriptions of these commands for details. Related commands: network, rip input, rip output. Example To disable the running of RIP on interface Vlan-interface 1, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]undo rip work

164

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

summary

Syntax
summary undo summary

View RIP view Parameter None Description

Use the summary command to activate RIP-2 automatic route summarization. This is the default. Use the undo summary command to disable RIP-2 automatic route summarization.

Route aggregation can be performed to reduce the routing traffic on the network as well as to reduce the size of the routing table. RIP-1 does not support subnet masks. Forwarding subnet routes may cause ambiguity. Networks that use RIP-1 should always use the natural mask. Therefore, RIP-1 uses route summarization all the time. If RIP-2 is used, route summarization function can be disabled with the undo summary command, when it is necessary to broadcast the subnet route. Related command: rip Example To set the RIP version on the interface Vlan-interface 1 to RIP-2, and then disable the route aggregation, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]rip version 2 [SW7700-Vlan-interface1]quit [SW7700]rip [SW7700-rip]undo summary

timers

Syntax
timers { update update-timer-length | timeout timeout-timer-length } * undo timers { update | timeout } *

View RIP view Parameter


update-timer-length: Value of the period update timer, ranging from 1 to 3600 seconds. The default value is 30 seconds. timeout-timer-length: Value of the timeout timer, ranging from 1 to 3600 seconds. The default value is 180 seconds.

OSPF Configuration Commands

165

Description

Use the timers command to modify the values of the three RIP timers: period update, timeout, and garbage-collection. Use the undo timers command to restore the default settings.

By default, the values of period update, timeout, and garbage-collection timers are 30 seconds, 180 seconds, and 120 seconds, respectively. Generally, the value of garbage-collection timer is fixed to 4 times the value of period update timer. However, before RIP completely deletes an unreachable route from the routing table, it advertises the route by sending four period update packets, to acknowledge to all the neighbors that the route is unreachable. Therefore, the actual value of garbage-collection timer is 3 to 4 times of that of period update timer. Adjusting period update timer will affect garbage-collection timer. The modification of RIP timers takes effect immediately. Related Command: display rip Example Set the values of Period Update timer and Timeout timer of RIP to 10 seconds and 30 seconds respectively.
[SW7700] rip [SW7700] timers update 10 timeout 30

OSPF Configuration Commands

This section describes the commands you can use to configure the Open Shortest Path First (OSPF) routing protocol. When the Switch 7700 runs a routing protocol, it is able to perform the functions of a router. The term router in this section can refer either to a physical router or to the Switch 7700 running a routing protocol.

abr-summary

Syntax
abr-summary ip_address ip_mask [ advertise | not-advertise ] undo abr-summary ip_address ip_mask

View OSPF Area view Parameter


ip_address Enter a network segment IP address. ip_mask Enter the subnet mask.

Description

Use the abr-summary command to configure the route aggregation on the area border router.

166

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Use the undo abr-summary command to disable the route aggregation on the area border router. This is the default.

This command is applicable only to the area border router (ABR) and is used for the route aggregation in an area. The ABR only transmits an aggregated route to other areas. Route aggregation refers to the routing information that is processed in the ABR. For each network segment configured with route aggregation, there is only one route transmitted to other areas. Example To enter area 1, and then aggregate the network segments, 66.48.10.0 and 66.48.120.0 into the summary route 66.48.0.0, enter the following:
[SW7700-ospf-1]area 1 [SW7700-ospf-1-area-0.0.0.1]network 66.48.10.0 0.0.0.255 [SW7700-ospf-1-area-0.0.0.1]network 66.48.120.0 0.0.0.255 [SW7700-ospf-1-area-0.0.0.1]abr-summary 66.48.0.0 255.255.0.0

area

Syntax
area area_id undo area area_id

View OSPF view Parameter


area_id: Enter the ID of the OSPF area. This can either be in IP address format, or as a number in the range 0 to 4294967295.

Description

Use the area command to enter an OSPF area view. Use the undo area command to exit from the OSPF area view.

Example To enter the OSPF area view 0, enter the following:


[SW7700-ospf]area 0 [SW7700-ospf-area-0.0.0.0]

asbr-summary

Syntax
asbr-summary ip_address mask [ not-advertise | tag value ] undo asbr-summary ip-address mask View

OSPF view Parameter


ip_address Enter the matched IP address. ip_mask Enter the IP subnet mask.

OSPF Configuration Commands

167

not-advertise Enter this parameter if you do not want to advertise routes

matching the specified IP address and mask.


tag value: Enter a tag value, which is mainly used to control advertisement of routes via route-policy. This value can be in the range 0 to 4294967295. The default is 1.

Description

Use the asbr-summary command to configure a summary of imported routes for OSPF. Use the undo asbr-summary command to cancel the summary. This is the default.

After the summarization of imported routes is configured, if the local router is an autonomous system border router (ASBR), this command summarizes the imported Type-5 LSAs in the summary address range. When NSSA is configured, this command will also summarize the imported Type-7 LSAs in the summary address range. If the local router acts as both an ABR and a router in the NSSA, this command summarizes Type-5 LSAs transformed from Type-7 LSAs. If the router is not the router in the NSSA, the summarization is disabled. Related commands: display ospf asbr-summary. Example To summarize the OSPF imported routes, enter the following:
[SW7700-ospf]asbr-summary 10.2.0.0 255.255.0.0 not-advertise

authentication-mode

Syntax
authentication-mode [ simple | md5 ] undo authentication-mode

View OSPF Area view Parameter


simple: Enter to configure simple text authentication mode. md5: Enter to configure MD5 cipher text authentication mode.

Description

Use the authentication-mode command to configure an OSPF area to use a specified authentication mode. Use the undo authentication-mode command to cancel the authentication mode for this area. By default, an area does not support an authentication mode.

168

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

All the routers in one area must use the same authentication mode (no authentication, simple text authentication or MD5 cipher text authentication). In addition, all routers on the same segment must use the same authentication key. To configure a simple text authentication key, use the ospf authentication-mode simple command. To configure an MD5 cipher text key, use the ospf authentication-mode md5 command. Related command: ospf authentication-mode. Example To set the OSPF area 0 to support MD5 cipher text authentication, enter the following:
[SW7700-ospf-area-0.0.0.0]authentication-mode md5

default cost

Syntax
default cost value undo default cost

View OSPF view Parameter


value Enter the default routing cost of the external route imported by OSPF, in the range 0 to 16777215.

Description

Use the default cost command to configure the default routing cost of an external route imported by OSPF. Use the undo default cost command to restore the default routing cost of an external route imported by OSPF. By default, the routing cost of an external route imported by OSPF is 1.

OSPF requires a default cost when redistributing a route found by other routing protocols. Example To specify a default routing cost of 10 for an external route imported by OSPF, enter the following:
[SW7700-ospf]default cost 10

default interval

Syntax
default interval seconds undo default interval

OSPF Configuration Commands

169

View OSPF view Parameter


seconds Enter the default interval, in seconds, for redistributing external routes. This can be in the range 1 to 2147483647. The default is 1 second.

Description

Use the default interval command to configure the default interval for OSPF to import external routes. Use the undo default interval command to restore the default value of 1 second.

OSPF requires a default interval when redistributing a route found by other routing protocols. Example To specify a default interval of 10 seconds for OSPF to import external routes, enter the following:
[SW7700-ospf]default interval 10

default limit

Syntax
default limit routes undo default limit

View OSPF view Parameter


routes Enter a limit on the number of imported external routes, in the range 200

to 2147483647. By default, the limit is 1000. Description

Use the default limit command to configure maximum number of allowed imported routes. Use the undo default limit command to restore the default value.

OSPF requires a default limit when redistributing a route found by other routing protocols. Related commands: default interval. Example To specify a limit of 200 imported external routes, enter the following:
[SW7700-ospf]default limit 200

default tag

Syntax
default tag tag

170

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

undo default tag

View OSPF view Parameter


tag Enter a tag number, in the range 0 to 4294967295.

Description Use the default tag command to configure the default tag of OSPF when it redistributes an external route. Use the undo default tag command to restore the default tag of OSPF when it redistributes the external route. OSPF requires a default tag when redistributing a route found by other routing protocols. Related command: default type. Example To set a default tag of 10 to OSPF imported external routes, enter the following:
[SW7700-ospf]default tag 10

default type

Syntax
default type { 1 | 2 } undo default type

View OSPF view Parameter


1 Enter to set the default to external routes of type 1. 2 Enter to set the default to external routes of type 2.

Description

Use the default type command to configure the default type when OSPF redistributes external routes. Use the undo default type command to restore the default type. By default, external routes of type 2 are imported.

OSPF requires a default type when redistributing a route found by other routing protocols. Related command: default tag.

OSPF Configuration Commands

171

Example To specify the default type as type 1 when OSPF imports an external route, enter the following:
[SW7700-ospf]default type 1

default-cost

Syntax
default-cost value undo default-cost

View OSPF Area view Parameter


value Enter the cost value of the default route transmitted by OSPF to the STUB or NSSA area, in the range 0 to 16777215. The default value is 1.

Description

Use the default-cost command to configure the cost of the route transmitted by OSPF to the STUB or NSSA area. Use the undo default-cost command to restore the default cost of the default route transmitted by OSPF to the STUB or NSSA.

Related commands: stub, nssa. Example To set area 1 as the STUB area, and to set the cost of the default route transmitted to this STUB area to 60, enter the following commands:
[SW7700-ospf-1]area 1 [SW7700-ospf-1-area-0.0.0.1]network 20.0.0.0 0.255.255.255 [SW7700-ospf-1-area-0.0.0.1]stub [SW7700-ospf-1-area-0.0.0.1]default-cost 60

default-route-advertise

Syntax
default-route-advertise [ always | cost value | type type_value | route-policy route-policy-name ]* undo default-route-advertise [ always | cost | type | route-policy ]*

View OSPF view Parameter


always This parameter will generate an ASE LSA which describes the default route

and advertise it if the local router is not configured with the default route. If this parameter is not set, the local router cannot import the ASE LSA, which generates the default route only when it is configured with the default route.
cost value: Enter the cost value of the ASE LSA, in the range 0 to 16777215.

The default value is 1.

172

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

type type_value Enter the cost type of this ase lsa, which can be either 1 or 2. The default value is 2. route-policy route_policy_name: if the default route match the route-policy specified by route-policy-name, route-policy will affect the value in the ase lsa. The length of route_policy_name parameter ranges from 1 to 16 character string.

Description

Use the default-route-advertise command to import the default route to the OSPF route area. Use the undo default-route-advertise command to cancel the import of default route. This is the default.

The import-route command cannot import the default route. When local router is not configured with default route, the keyword always should be used by ase lsa to generate default route. Related command: import-route. Example If a local route has no default route, the ASE LSA of the default route will be generated.
[SW7700-ospf]default-route-advertise

The ASE LSA of the default route will be generated and advertised to OSPF route area even if the local router has no default route.
[SW7700-ospf]default-route-advertise always

display debugging ospf

Syntax
display debugging ospf

View Any view Description

Use the display debugging ospf command to view the debugging states of global OSPF and all processes.

Related command: debugging ospf Example Display the debugging states of global OSPF and all processes.
<SW7700> display debugging ospf OSPF global debugging state: OSPF SPF debugging is on OSPF LSA debugging is on OSPF process 100 debugging state: OSPF SPF debugging is on OSPF process 200 debugging state: OSPF SPF debugging is on

OSPF Configuration Commands

173

OSPF LSA debugging is on

display ospf abr-asbr

Syntax
display ospf [ process-id ] abr-asbr

View All views Parameter process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID. Description

Use the display ospf abr-asbr command to view information about the Area Border Router (ABR) and Autonomous System Border Router (ASBR) of OSPF.

Example To display information on the ABR and ASBR of OSPF, enter the following:
<SW7700>display ospf abr-asbr OSPF Process 1 with Router ID 10.110.98.138 Routing Table to ABR and ASBR I = Intra i = Inter A = ASBR B = ABR S = SumASBR Destination IA 2.2.2.2 Vlan-interface1 Area 0.0.0.0 Cost 10 Nexthop 10.153.17.89 Interface

display ospf asbr-summary

Syntax
display ospf [ process-id ] asbr-summary [ ip-address ip-mask ]

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is

applied to all current OSPF processes if you do not specify a process ID.
ip_address Enter an IP address. ip_mask Enter an IP subnet mask.

Description

Use the display ospf asbr-summary command to view the summary information of an OSPF imported route, or all OSPF imported routes.

If you do not specify an IP address and subnet mask, the summary information of all OSPF imported routes is displayed.

174

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related command: asbr-summary. Example To display the summary information of all OSPF imported routes, enter the following:
<SW7700>display ospf asbr-summary OSPF Process 1 with Router ID 1.1.1.1 Summary Addresses Total summary address count: 2 Summary Address net : 168.10.0.0 mask : 255.254.0.0 tag : 1 status : Advertise The Count of Route is 0 Summary Address 1.1.0.0 255.255.0.0 100 DoNotAdvertise
The Count of Route is 0

net mask tag status

: : : :

display ospf brief

Syntax
display ospf [ process-id ] brief

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID.

Description

Use the display ospf brief command to view OSPF summary information.

Example To display OSPF summary information, enter the following:


<SW7700>display ospf brief OSPF Process 1 with Router ID 10.110.95.189 OSPF Protocol Information

The information displays in the following format:


RouterID: 10.110.95.189 Border Router: AS spf-schedule-interval: 5 Routing preference: Inter/Intra: 10 External: 150 Default ASE parameters: Metric: 1 Tag: 0.0.0.1 Type: 2 SPF computation count: 16 Area Count: 1 Nssa Area Count: 0 Area 0.0.0.0:

OSPF Configuration Commands

175

Authtype: none Flags: <> SPF scheduled: <> Interface: 201.1.1.4 (Vlan-interface1) Cost: 1 State: DR Type: Broadcast Priority: 1 Designated Router: 201.1.1.4 Backup Designated Router: 201.1.1.3 Timers: Hello 10, Dead 40, Poll 0, Retransmit 5, Transmit Delay 1

display ospf cumulative

Syntax
display ospf [ process-id ] cumulative

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is

applied to all current OSPF processes if you do not specify a process ID> Description

Use the display ospf cumulative command to view the OSPF cumulative information.

Example To display the OSPF cumulative information, enter the following:


<SW7700>display ospf cumulative OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


Cumulations IO Statistics Type Input Output Hello 225 437 DB Description 78 86 Link-State Req 18 18 Link-State Update 48 53 Link-State Ack 25 21 ASE: 1 Checksum Sum: FCAF LSAs originated by this router Router: 50 SumNet: 40SumASB: 2 LSAs Originated: 92 LSAs Received: 33 Area 0.0.00.0: Neighbors: 1 Interfaces: 1 Spf: 54 Checksum Sum F020 rtr: 2 net: 0 sumasb: 0 sumnet: 1 Area 0.0.0.1: Neighbors: 0 Interfaces: 1 Spf: 19 Checksum Sum 14EAD rtr: 1 net: 0sumasb: 1sumnet: 1 Routing Table: Intra Area: 2 Inter Area: 0ASE: 1

176

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

display ospf error

Syntax
display ospf [ process-id ] error

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID.

Description

Use the display ospf error command to view OSPF error information.

Example To display the OSPF error information, enter the following:


<SW7700>display ospf error OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


OSPF packet error statistics: 0: IP: received my own packet 0: OSPF: bad packet type 0: OSPF: bad version 0: OSPF: bad checksum 0: OSPF: bad area id 0: OSPF: area mismatch 0: OSPF: bad virtual link 0: OSPF: bad authentication type 0: OSPF: bad authentication key 0: OSPF: packet too small 0: OSPF: packet size > ip length 0: OSPF: transmit error 0: OSPF: interface down 0: OSPF: unknown neighbor 0: HELLO: netmask mismatch 0: HELLO: hello timer mismatch 0: HELLO: dead timer mismatch 0: HELLO: extern option mismatch 0: HELLO: router id confusion 0: HELLO: virtual neighbor unknown 0: HELLO: NBMA neighbor unknown 0: DD: neighbor state low 0: DD: router id confusion 0: DD: extern option mismatch 0: DD: unknown LSA type 0: LS ACK: neighbor state low 0: LS ACK: bad ack 0: LS ACK: duplicate ack 0: LS ACK: unknown LSA type 0: LS REQ: neighbor state low 0: LS REQ: empty request 0: LS REQ: bad request 0: LS UPD: neighbor state low 0: LS UPD: newer self-generate LSA 0: LS UPD: LSA checksum bad 0: LS UPD:received less recent LSA 0: LS UPD: unknown LSA type 0: OSPF routing: next hop not exist 0: DD: MTU option mismatch

display ospf interface

Syntax
display ospf [ process-id ] interface [ interface-type interface-number ]

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID.

OSPF Configuration Commands

177

interface_type Enter the interface type. interface_number Enter the port number.

Description Use the display ospf interface command to view OSPF interface information for a specified port, or for all ports. The information displayed includes OSPF configuration and running state. Example To display OSPF interface information, enter the following:
<SW7700>display ospf interface vlan-interface 1 OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


Interfaces Interface: 10.110.10.2 (Vlan-interface1) Cost: 1 State: BackupDR Type: Broadcast Priority: 1 Designated Router: 10.110.10.1 Backup Designated Router: 10.110.10.2 Timers: Hello 10, Dead 40, Poll 0, Retransmit 5, Transmit Delay 1

display ospf lsdb

Syntax
display ospf [ process-id ] [ area_id ] lsdb [ brief | [ asbr | ase | network | nssa | router | summary ] [ ip_address ] [ originate-router ip_address | self-originate ] ]

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is

applied to all current OSPF processes if you do not specify a process ID.
area_id Enter the ID of the OSPF area, as either an ID number or an IP address.

Description

Use the display ospf lsdb command to view database information about the OSPF connecting state.

Example To display database information about the OSPF connecting state, enter the following:
<SW7700>display ospf lsdb OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


Link State Database

178

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Area: 0.0.0.0 TypeLinkStateID AdvRouter Age Len Sequence Stub 10.10.0.0 0.0.0.1 388 24 0 Rtr 0.0.0.1 0.0.0.1 362 48 8000002f Rtr 0.0.0.2 0.0.0.2 389 48 8000002e SNet 10.110.0.0 0.0.0.1 193 28 80000003 Area: 0.0.0.1 TypeLinkStateID AdvRouter Age Len Sequence Stub 10.110.0.0 0.0.0.1 2074 24 0 Rtr 0.0.0.1 0.0.0.1 363 36 80000003 SNet 10.10.0.0 0.0.0.1 193 28 80000002 ASB 0.0.0.2 0.0.0.1 193 28 80000002 AS External Database TypeLinkStateIDAdvRouter Age Len Sequence ASE 2.2.0.0 0.0.0.2 278 36 80000001 <SW7700> display ospf lsdb ase OSPF Process 1 with Router ID 1.1.1.1 Link State Data Base type : ASE ls id : 2.2.0.0 adv rtr: 0.0.0.2 ls age: 349 len:36 seq#:80000001 chksum: 0xfcaf Options: (DC) Net mask:255.255.0.0 Tos 0 metric: 1 E type :2 Forwarding Address: 0.0.0.0 Tag: 1

Metric 0 0 0 10 Metric 0 0 10 10 Metric 1

Where SpfTree SpfTree SpfTree Inter List Where SpfTree SpfTree Inter List SumAsb List Where initialized

display ospf nexthop

Syntax
display ospf [ process-id ] nexthop

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID.

Description

Use the display ospf nexthop command to view the information about the next-hop.

Example To display the OSPF next-hop information, enter the following:


<SW7700>display ospf nexthop OSPF Process 1 with Router ID 1.1.1.1

OSPF Configuration Commands

179

The information displays in the following format:


Address Type Refcount Intf Addr Intf Name -------------------------------------------------------------------202.38.160.1 Direct 3 202.38.160.1 Vlan-interface2 202.38.160.2 Neighbor 1 202.38.160.1 Vlan-interface2

display ospf peer

Syntax
display ospf [ process-id ] peer [ brief ]

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is

applied to all current OSPF processes if you do not specify a process ID. Description

Use the display ospf peer command to view detailed OSPF peer information. Use the display ospf peer brief command to view brief information of every peer in OSPF, in particular the peer number of all states in every area.

Example To view the information on an SPF peer, enter the following:


<SW7700>display ospf peer OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


Neighbors Area 0.0.0.0 interface 10.153.17.88(Vlan interface1)s neighbor(s) RouterID: 2.2.2.2 Address: 10.153.17.89 State: Full Mode: Nbr is Master Priority: 1 DR: 10.153.17.89 BDR: 10.153.17.88 Dead times expires in 31s Neighbor has been up for 01:14:14

Table 16 Description of Information Generated by the Command display ospf peer


Field RouterID Address State Mode Priority DR BDR Dead timer expires in 31 seconds Description Router ID of neighbor route Address of the interface, through which neighbor router communicates with the router State of adjacency relation Master/Slave mode formed by negotiation in exchanging DD packet Priority of DR/BDR for neighbor election IP address of the interface of elected DR IP address of the interface of elected BDR Time of hello packet received from the neighbor last time

180

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Table 16 Description of Information Generated by the Command display ospf peer


Field Neighbor has been up for 01:14:14 Description Time of neighbor connection

To view brief information for every peer, enter the following:


<SW7700>display ospf peer brief OSPF Process 1 with Router ID 1.1.1.1 Neighbor Statistics Area ID Down Attempt Init 2-Way ExStart 0.0.0.0 0 0 0 0 0 0.0.0.1 0 0 0 0 0 Total 0 0 0 0 0

Exchange 0 0 0

Loading 0 0 0

Full 1 1 2

Total 1 1 2

Table 17 Description of Information Generated by the Command Display OSPF Peer Brief
Field Area ID Down Description Area ID The initial state for OSPF to establish neighbor relation, which indicates that the OSPF router has not received the message from a certain neighbor router within a period of time. Enabled in the NBMA environment, such as Frame Relay, X.25 or ATM. It indicates that OSPF router has not received the message from a certain neighbor router within a period of time, but still attempts to send a Hello packet to the adjacent routers for their communications with a lower frequency. Indicates that the OSPF router has received a Hello packet from a neighbor router, but its IP address is not contained in the Hello packet. Therefore, a two-way communication between them has not been established.. It indicates that a two-way communication between an OSPF router and a neighbor router has been established. DR and BDR can be selected in this state (or higher state) In this state, the router determines the sequence number of the initial database description (DD) packet used for data exchange, so that it can obtain the latest link state information. Indicates that the OSPF router sends DD packet to its neighbor routers to exchange link state information. In this state, OSPF router requests neighbor routers based on the updated link state information from neighbor routers and its expired information, and waits for response from neighbor routers. Indicates that database synchronization between the routers that has established neighbor relations has been completed, and their link state databases have been consistent.

Attempt

Init

2-Way

ExStart

Exchange Loading

Full

display ospf request-queue

Syntax
display ospf [ process-id ] request-queue

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID.

OSPF Configuration Commands

181

Description

Use the display ospf request-queue command to view information about the OSPF request-queue.

Example To display the information on the OSPF request-queue, enter the following:
<SW7700>display ospf request-queue

The information displays in the following format:


The Router's Neighbors is RouterID: 1.1.1.1 Address: 1.1.1.1 Interface: 1.1.1.3 Area: 0.0.0.0 LSID:1.1.1.3 AdvRouter:1.1.1.3 Sequence:80000017

Age:35

display ospf retrans-queue

Syntax
display ospf [ process-id ] retrans-queue

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is

applied to all current OSPF processes if you do not specify a process ID. Description

Use the display ospf retrans-queue command to view information on the OSPF retransmission queue.

Example To display information on the OSPF retransmission queue, enter the following:
<SW7700>display ospf retrans-queue OSPF Process 200 with Router ID 103.160.1.1

The information displays in the following format:


The Router's Neighbors is RouterID: 1.1.1.3 Address: 1.1.1.3 Interface: 1.1.1.1 Area: 0.0.0.0 Retrans list: Type: Net LSID:1.1.1.1 AdvRouter:1.1.1.1

display ospf routing

Syntax
display ospf [ process-id ] routing

View All views Parameter


pcrocess-id: Process ID of OSPF, ranging from 1 to 65535. The command is

applied to all current OSPF processes if you do not specify a process ID.

182

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Description Use the display ospf routing command to view the information about the OSPF routing table. Example To view information on the OSPF routing table, enter the following:
<SW7700>display ospf routing OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


Routing tables Routing for Destination 10.110.0.0 10.10.0.0 Routing for Destination 2.2.0.0 Total Nets: Intra Area: Network Cost 10 10 ASEs Cost 1 2 2 Inter

Type Stub Stub Type 2 Area: 0

NextHop 10.110.10.1 10.10.0.1 Tag 1

AdvRouter 0.0.0.1 0.0.0.1 AdvRotue 0.0.0.2

Area 1 0

NextHop 10.10.0.1

ASE: 1 NSSA: 0

display ospf vlink

Syntax
display ospf [ process-id ] vlink

View All views Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. The command is applied to all current OSPF processes if you do not specify a process ID.

Description

Use the display ospf vlink command to view the information about OSPF virtual links.

Example To view OSPF virtual links information, enter the following:


<SW7700>display ospf vlink OSPF Process 1 with Router ID 1.1.1.1

The information displays in the following format:


Virtual links Virtual-link Neighbor-id -> 2.2.2.2, State: Full Cost: 0 State: Full Type: Virtual Transit Area: 0.0.0.2 Timers: Hello 10, Dead 40, Poll 0, Retransmit 5, Transmit Delay 1

OSPF Configuration Commands

183

filter-policy export

Syntax
filter-policy { acl_number | ip-prefix ip_prefix_name } export [ routing_protocol ] undo filter-policy {acl_number | ip-prefix ip_prefix-name} export [ routing_protocol ]

View OSPF view Parameter


acl_number Enter an access control list number. ip_prefix_name: Enter the name of the address prefix list. routing_protocol Enter the protocol advertising the routing information. This can be one of the following: direct, bgp, rip and static.

Description Using the filter-policy export command, you can configure how OSPF filters the advertised routing information. Only the routing information that meets these conditions is advertised. Using the undo filter-policy export command, you can cancel the filtering rules. By default, no filtering of the distributed routing information is performed. Related commands: acl, ip ip-prefix. Example To configure OSPF to only advertise the routing information permitted by acl 1, enter the following commands:
[SW7700]acl number 1 [SW7700-acl-basic-1]rule permit source 11.0.0.0 [SW7700-acl-basic-1]rule deny source any [SW7700-ospf]filter-policy 1 export 0.255.255.255

filter-policy import

Syntax
filter-policy { acl_number | ip-prefix ip_prefix_name | gateway prefix_list_name } import undo filter-policy { acl_number | ip-prefix ip_prefix_name | gateway ip-prefix-name } import

View OSPF view Parameter


acl_number Enter the access control list number used for filtering the destination addresses of the routing information. ip_prefix_name Enter the name of address prefix list used for filtering the destination addresses of the routing information.

184

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

gateway ip_prefix_name Enter the name of address prefix list used for filtering

the addresses of the neighboring routers advertising the routing information. Description Using the filter-policy import command, you can configure how OSPF filters the routing information received. Only the routing information that meets these conditions can be received. Using the undo filter-policy import command, you can cancel the filtering of the received routing information received. By default, no filtering of the received routing information is performed. Example To filter the received routing information using the rules defined by access control list 2, enter the following commands:
[SW7700]acl number 2 [SW7700-acl-basic-2]rule permit source 20.0.0.0 0.255.255.255 [SW7700-acl-basic-2]rule deny source any [SW7700-ospf]filter-policy 2 import

import-route

Syntax
import-route protocol [ cost value | type value | tag value | route-policy route-policy-name ] undo import-route protocol

View OSPF view Parameter


protocol Enter the source routing protocol to be imported. This can be one of the following: direct, rip, and static. route-policy route_policy_name Enter a route policy name. Only routes that match the specified route policy are imported. cost value Enter the cost of the imported route. type value Enter the cost type of imported routes. The value can be 1 or 2. tag value Enter the tag value for imported external routes.

Description Using the import-route command, you can import the external routing information of another routing protocol. Using the undo import-route command, you can cancel the import of external routing information. By default, the routing information of other protocols is not imported.

OSPF Configuration Commands

185

Example To configure an imported RIP route with the route of type 2, a route tag of 33 and a route cost of 50, enter the following:
[SW7700-ospf]import-route rip type 2 tag 33 cost 50

network

Syntax
network ip-address ip-mask undo network ip-address ip-mask

View OSPF Area view Parameter


ip_address Enter the IP address of the network segment where the interface is

located.
ip_mask Enter the IP subnet mask, which is similar to the reversed form of the mask of IP address.

Description Using the network command, you can configure the interface running OSPF protocol to which the interface belongs. Using the undo network command, you can cancel the interface running OSPF. By default, the interface does not belong to any area. With the two parameters, ip_address and ip_mask, one or more interfaces can be configured as an area. To run the OSPF protocol on one interface, the master IP address of this interface must be in the range of the network segment specified by this command. If the slave IP address of the interface is in the range of the network segment specified by this command, this interface will not run OSPF protocol. Related command: ospf. Example To configure the interfaces whose master IP addresses are in the segment range of 10.110.36.0 to run the OSPF protocol, and to specify the number of the OSPF area where these interfaces are located as 6, enter the following:
[SW7700-ospf]area 6 [SW7700-ospf-area-0.0.0.6]network 10.110.36.0.0 0.0.0.255

nssa

Syntax
nssa [ default-route-advertise ] [ no-import-route ] [ no-summary ] undo nssa

View OSPF Area view

186

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter
default-route-advertise Imports the default route to the NSSA area. no-import-route Blocks the import of the default route to the NSSA area. no-summary: Disables ABR from transmitting summary_net LSAs to the NSSA

area. Description Using the nssa command, you can configure the type of an OSPF area as an NSSA area. Using the undo nssa command, you can cancel the function. By default, NSSA area is not configured. For all the routers connected to the NSSA area, the command nssa must be used to configure the area as the NSSA attribute. The default-route-advertise parameter is used to generate a default type-7 LSA. No matter whether there is route 0.0.0.0 in the routing table on an ABR, type-7 LSA default route will always be generated. Only when there is route 0.0.0.0 in routing table on ASBR, will a type-7 LSA default route be generated. On ASBR, the no-import-route parameter disables an external route that is imported by OSPF with the import-route command from being advertised to the NSSA area. Example To configure area 1 as an NSSA area, enter the following:
[SW7700-ospf]area 1 [SW7700-ospf-area-0.0.0.1]network 36.0.0.0 0.255.255.255 [SW7700-ospf-area-0.0.0.1]nssa

ospf

Syntax
ospf [ process-id [ router-id router-id ] ] undo ospf [ router-id ]

View System view Parameter


process-id: The id of the OSPF process, ranging from 1 to 65535. By default, the

process ID is 1.
router-id: Router ID that is a 32-bit unsigned integer.

Description Using the ospf command, you can enable the OSPF protocol. Using the undo ospf command, you can disable the OSPF protocol. By default, the system does not run the OSPF protocol.

OSPF Configuration Commands

187

After enabling the OSPF protocol, you can configure OSPF operations using the commands described in the OSPF Configuration Commands section. Related command: network. Example Enable the OSPF protocol.
[SW7700] router id 10.110.1.8 [SW7700] ospf [SW7700-ospf-1]

Enable the OSPF protocol with a process ID of 120.


[SW7700] router id 10.110.1.8 [SW7700] ospf 120 [SW7700-ospf-120]

ospf authentication-mode

Syntax
ospf authentication-mode { simple password | md5 key_id key } undo ospf authentication-mode { simple | md5 }

View VLAN interface view Parameter


simple password Enter a password of no more than 8 characters. key_id Enter the ID of the MD5 authentication key, in the range from 1 to 255. key Enter the MD5 authentication key. You can enter this either as plain text in 16

characters or less. The key is displayed in a cipher text form in 24 characters. You can also enter the MD5 key in a cipher text form in 24 characters or less. Description Using the ospf authentication-mode command, you can configure the authentication mode and key between adjacent routers. Using the undo ospf authentication-mode command, you can cancel the set authentication key. By default, the interface does not authenticate the OSPF packets. The passwords for the authentication keys of routers on the same network segment must be identical. In addition, if you use this command with the authentication-mode command, you can set the authentication type of an area (see the example below). Related command: authentication-mode. Example Area 1 is where the network segment 131.119.0.0 of Interface Vlan-interface 1 is located. To set this area to support MD5 cipher text authentication, with an

188

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

authentication key identifier of 15 and an authentication key of 3Com, enter the following:
[SW7700-ospf]area 1 [SW7700-ospf-area-0.0.0.1]network 131.119.0.0 0.0.255.255 [SW7700-ospf-area-0.0.0.1]authentication-mode md5 [SW7700-Vlan-interface1]ospf authentication-mode md5 15 3Com

ospf cost

Syntax
ospf cost value undo ospf cost

View VLAN interface view Parameter


value Enter the cost for running the OSPF protocol, in the range 1 to 65535.

Description Using the ospf cost command, you can configure the cost of sending messages from each interface. Using the undo ospf cost command, you can restore the default costs. Example To specify a cost of 33 when the interface vlan-interface 1 runs OSPF, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf cost 33

ospf dr-priority

Syntax
ospf dr-priority value undo ospf dr-priority

View VLAN interface view Parameter


value Enter the interface priority for electing the designated router, ranging

from 0 to 255. The default value is 1. Description Using the ospf dr-priority command, you can configure the priority for electing the "designated router" on an interface. Using the undo ospf dr-priority command, you can restore the default value. The priority of the interface determines the qualification of the interface when the designated router is elected. The interface with higher priority will be considered first if a vote collision occurs.

OSPF Configuration Commands

189

Example To set a priority of 8 for interface Vlan-interface 1 to 8, when electing the DR, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf dr-priority 8

ospf mib-binding

Syntax
ospf mib-binding process-id undo ospf mib-binding

View System view Parameter


process-id: Process ID of OSPF, ranging from 1 to 65535. By default, the process

ID is 1. Description Using the ospf mib-binding command, you can bind the MIB operation to the specified OSPF process. Using the undo ospf mib-binding command, you can restore the default settings. When OSPF protocol enables the first process, it always binds MIB operation to this process. You can use this command to bind MIB operation to another OSPF process. Execute the undo ospf mib-binding command if you want to cancel the setting. OSPF will automatically re-bind MIB operation to the first process that it enables. By default, MIB operation is bound to the first enabled OSPF process. Example Bind MIB operation to OSPF process 100.
[SW7700] ospf mib-binding 100

Bind MIB operation to OSPF process 200.


[SW7700] ospf mib-binding 200

Cancel the binding of MIB operation.


[SW7700] undo ospf mib-binding

ospf mtu-enable

Syntax
ospf mtu-enable undo ospf mtu-enable

View VLAN interface view

190

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter None. Description Using the ospf mtu-enable command, you can enable the interface to write the MTU value when sending DD packets. Using the undo ospf mtu-enable command, you can restore the default. By default, the MTU value is 0 when sending DD packets, that is the MTU value of the interface is not written. DD packets (Database Description Packet) are sent by the router to describe its own LSDB when the router running OSPF protocol is synchronizing the database. Example To set interface Vlan-interface 3 to write the MTU value when sending DD packets, enter the following:
[SW7700]interface Vlan-interface 3 [SW7700-Vlan-interface 3]ospf mtu-enable

ospf network-type

Syntax
ospf network-type { broadcast | nbma | p2mp | p2p } undo ospf network-type

View VLAN interface view Parameter


broadcast: Change the interface network type to broadcast. nbma: Change the interface network type to NBMA. p2mp: Change the interface network type to p2mp. p2p: Change the interface network type to point-to-point.

Description

Use the ospf network-type command to configure the network type of OSPF interface. Use the undo ospf network-type command to restore the default network type of the OSPF interface.

OSPF divides networks into four types by link layer protocol:

Broadcast: If Ethernet or FDDI is adopted, OSPF defaults the network type to broadcast. Non-Broadcast Muli-access (nbma): If Frame Relay, ATM, HDLC or X.25 is adopted, OSPF defaults the network type to NBMA. Point-to-Multipoint (p2mp): OSPF will not default the network type of any link layer protocol to p2mp. The general undertaking is to change a partially

OSPF Configuration Commands

191

connected NBMA network to p2mp network if the NBMA network is not fully-meshed.

Point-to-point (p2p): If PPP, LAPB or POS is adopted, OSPF defaults the network type to p2p.

NBMA means that a network is non-broadcast and multi-accessible. ATM is a typical example. A user can configure the polling interval to specify the interval of sending polling hello packets before the adjacency of the neighboring routers is formed. Configure the interface type to nonbroadcast on a broadcast network without multi-access capability. Configure the interface type to p2mp if not all the routers are directly accessible on an NBMA network. Change the interface type to p2p if the router has only one peer on the NBMA network. When the network type of an interface is NBMA or it is changed to NBMA manually, the peer command must be used to configure the neighboring point. Related command: ospf dr-priority. Example Set the interface Vlan-interface 1 to NBMA type.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf network-type nbma

ospf timer dead

Syntax
ospf timer dead seconds undo ospf timer dead

View VLAN interface view Parameter


seconds Enter the amount of dead time allowed, in seconds, in the range 1 to

65535. Description Using the ospf timer dead command, you can configure the amount of dead time allowed to OSPF neighbors, in seconds. Using the undo ospf timer dead command, you can restore the default value. By default, the dead time allowed to OSPF neighbors is 40 seconds. If no Hello message is received from a neighbor in the specified time, the neighbor is considered invalid. The timer dead value should be at least four times that of the timer hello value. The timer dead value for routers on the same network segment must be identical.

192

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related commands: ospf timer hello. Example To set the dead time to 80 seconds on interface Vlan-interface 1, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf timer dead 80

ospf timer hello

Syntax
ospf timer hello seconds undo ospf timer hello

View VLAN interface view Parameter


seconds Enter the Hello interval time allowed, in seconds, in the range 1 to 255.

Description Using the ospf timer hello command, you can configure the Hello interval time allowed for an interface. Using the undo ospf timer hello command, you can restore the interval to the default value. By default, the amount of time allowed is 10 seconds for an interface of p2p or broadcast type, and 30 seconds for an interface of nbma or p2mp type. Related command: ospf timer dead. Example To set a time interval of 20 seconds for transmitting Hello messages on the interface Vlan-interface 1, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf timer hello 20

ospf timer poll

Syntax
ospf timer poll seconds undo ospf timer poll

View VLAN interface view Parameter


seconds Enter the poll Hello interval in seconds, in the range 1 to 65535. The default value is 120 seconds.

OSPF Configuration Commands

193

Description Using the ospf timer poll command, you can configure the Hello packet poll interval. Using the undo ospf timer poll command, you can restore the default poll interval. The Poll interval should be at least three times the Hello interval. Example To set the transmit poll Hello packet interval to 130 seconds for interface Vlan-interface 2, enter the following:
[SW7700-Vlan-interface2]ospf timer poll 130

ospf timer retransmit

Syntax
ospf timer retransmit interval undo ospf timer retransmit

View VLAN interface view Parameter


interval Enter the interval allowed before LSA re-transmission. This time is set for

an interface, in seconds, in the range 1 to 65535. The default value is 5 seconds. Description Using the ospf timer retransmit command, you can configure the interval before LSA re-transmission on an interface. Using the undo ospf timer retransmit command, you can restore the default interval value for LSA re-transmission on an interface. When a router transmits a Link State Advertisement (LSA) to the peer, it waits for the acknowledgement packet. If no acknowledgement is received from the neighbor within the time you set using this command, the LSA is re-transmitted. According to RFC2328, the LSA retransmit between adjacent routers should not be set too short to avoid unexpected re-transmission. Example To set the retransmit interval between the interface Vlan-interface 1 and the adjacent routers to 12 seconds, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf timer retransmit 12

ospf trans-delay

Syntax
ospf trans-delay value undo ospf trans-delay

194

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

View VLAN interface view Parameter


value Enter the LSA transmission delay, in seconds, in the range 1 to 3600. By default, the value is 1 second.

Description Using the ospf trans-delay command, you can configure the LSA transmission delay on an interface. Using the undo ospf trans-delay command, you can restore the default value of the LSA transmission delay. LSA will age in the link state database (LSDB) of the router as time goes by (add 1 for every second), but it will not age during network transmission. Therefore, it is necessary to add a period of time set by this command to the aging time of LSA before transmitting it. Example To set the LSA transmission delay to three seconds on interface Vlan-interface 1, enter the following:
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]ospf trans-delay 3

peer

Syntax
peer ip-address [ dr-priority dr-priority-number ] undo peer ip-address

View OSPF view Parameter


ip_address Enter the IP address of the neighboring router. dr_priority_number The priority value represents the corresponding priority

value of the network neighbor. The range is from 0 to 255. The default value is 1. Description Using the peer command, you can configure the neighboring point if a router is connected to a network of NBMA type. Using the undo peer command, you can cancel the configured neighboring point. Example To configure the IP address of the neighboring router to 10.1.1.1, enter the following:
[SW7700]peer 10.1.1.1.

OSPF Configuration Commands

195

preference

Syntax
preference [ ase ] value undo preference [ ase ]

View OSPF view Parameter


value Enter the OSPF protocol route preference, ranging from 1 to 255. ase Enter to indicate the preference of an imported external route of the AS.

Description Using the preference command, you can configure the OSPF protocol route preference. Using the undo preference command, you can restore the default value of the OSPF protocol route. By default, the preference of an OSPF protocol internal route is 10 and the preference of an external route is 150. Because multiple dynamic routing protocols could be running on a router at any one time, priority needs to be assigned to each protocol. Using this command, you can set a default preference for each routing protocol. The protocol with the higher preference has priority. Example To set the preference of an imported external route of the AS to 160, enter the following:
[SW7700-ospf]preference ase 160

reset ospf all

Syntax
reset ospf [ statistics ] { all | process-id }

View User view Parameter


all: Reset all OSPF processes process-id: Process ID of OSPF, ranging from 1 to 65535. By default, the process

ID is 1.
statistics: Reset OSPF statistics.

Description Using the reset ospf all command, you can reset the OSPF process, as follows:

Invalid LSAs are cleared immediately without waiting for LSA timeout. If the Router ID changes, a new Router ID takes effect to execute the command.

196

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Re-elect DR and BDR. OSPF configuration before the restart will not be lost.

After you enter the command, you are asked to confirm that the OSPF protocol should be re-enabled. Example Reset all the OSPF processes:
<SW7700>reset ospf all

router id

Syntax
router id router_id undo router id

View System view Parameter


router_id Enter the router ID as a 32-bit unsigned integer.

Description Using the router id command, you can configure the ID of a router running the OSPF protocol. Using the undo router id command, you can cancel the router ID that has been set. To discover the router ID, use the display ospf brief command to read the selected interface. You can also use the router id command to select the router ID interface manually. The router ID is a 32-bit unsigned integer that uniquely identifies a router in an OSPF system. You can specify the ID for a router. If a router ID isnt specified, the router automatically selects one of the configured IP address as the router ID. If an IP address is not configured for any interface, the router ID must be configured in OSPF view. Otherwise, OSPF protocol cannot be enabled. When the router ID is configured manually, the IDs of any two routers cannot be the same in the autonomous system. So, the IP address of one interface can be selected as the router ID. The modified router ID will not be valid unless OSPF is re-enabled. Related command: ospf. Example To set the router ID to 10.1.1.3., enter the following:
[SW7700]router id 10.1.1.3

OSPF Configuration Commands

197

silent-interface

Syntax
silent-interface interface_type interface_number undo silent-interface interface_type interface_number

View OSPF view Parameter


interface_type Enter the interface type interface_number Enter the interface number.

Description Using the silent-interface command, you can prevent an interface from transmitting OSPF packets. Using the undo silent-interface command, you can restore the default setting. By default, the interface transmits OSPF packets. You can use this command to stop the transmission of OSPF packets on an interface. This prevents the router on some network from receiving the OSPF routing information. Example To stop interface Vlan-interface 2 from transmitting OSPF packets, enter the following:
[SW7700-ospf]silent-interface Vlan-interface 2

snmp-agent trap enable ospf

Syntax
snmp-agent trap enable ospf [ process-id ] [ ifstatechange | virifstatechange | nbrstatechange | virnbrstatechange | ifcfgerror | virifcfgerror | ifauthfail | virifauthfail | ifrxbadpkt | virifrxbadpkt | txretransmit | viriftxretransmit | originatelsa | maxagelsa | lsdboverflow | lsdbapproachoverflow ] undo snmp-agent trap enable ospf [ process-id ] [ ifstatechange | virifstatechange | nbrstatechange | virnbrstatechange | ifcfgerror | virifcfgerror | ifauthfail | virifauthfail | ifrxbadpkt | virifrxbadpkt | txretransmit | viriftxretransmit | originatelsa | maxagelsa | lsdboverflow | lsdbapproachoverflow ]

View System view Parameter


process-id: Process ID of OSPF. The command is applied to all current OSPF

processes if you do not specify a process ID.


ifstatechange, virifstatechange, nbrstatechange, virnbrstatechange, ifcfgerror, virifcfgerror, ifauthfail, virifauthfail, ifrxbadpkt, virifrxbadpkt, txretransmit, viriftxretransmit, originatelsa,

198

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

maxagelsa, lsdboverflow, lsdbapproachoverflow: Types of TRAP packets

that the switch produces in case of OSPF anomalies. Description Use the snmp-agent trap enable ospf command to enable the OSPF TRAP function. Use the undo snmp-agent trap enable ospf command to disable the OSPF TRAP function. This command cannot be applied to the OSPF processes that are started after the command is executed. By default, the switch does not send TRAP packets in case of OSPF anomalies. For detailed configuration of SNMP TRAP, see Using System Management Commands on page 133. Example Enable the TRAP function for OSPF process 100.
<SW7700> snmp-agent trap enable ospf 100

spf-schedule-interval

Syntax
spf-schedule-interval interval undo spf-schedule-interval

View OSPF view Parameter


interval Enter the SPF route calculation interval for OSPF, in seconds, in the range 1 to 10. The default value is 5 seconds.

Description Using the spf-schedule-interval command, you can configure the route calculation interval of OSPF. Using the undo spf-schedule-interval command, you can restore the default setting. According to the Link State Database (LSDB), the router running OSPF can calculate the shortest path tree, with itself as the root, and determine the next hop to the destination network according to the shortest path tree. By adjusting the SPF calculation interval, you can decrease the frequency of network changes and unnecessary consumption of bandwidth and router resources. Example To set the OSPF route calculation interval of the Switch 7700 to 6 seconds, enter the following:
[SW7700-ospf]spf-schedule-interval 6

OSPF Configuration Commands

199

stub

Syntax
stub [ no-summary ] undo stub

View OSPF Area view Parameter


no-summary Enter to prevent the transmission of Summary LSAs to the STUB area.

Description Using the stub command, you can configure the type of an OSPF area as stub. Using the undo stub command, you can cancel the setting. By default, no OSPF areas are set as STUB areas. If the router is an ABR, it will send a default route to the connected stub area. Using the default-cost command, you can configure the default route cost. Related commands: default-cost. Example To set the type of OSPF area 1 to STUB, enter the following:
[SW7700-ospf]area 1 [SW7700-ospf-area-0.0.0.1]stub

vlink-peer

Syntax
vlink-peer router_id [ hello seconds | retransmit seconds | trans-delay seconds | dead seconds | simple password | md5 keyid key ]* undo vlink-peer router-id

View OSPF Area view Parameter


router_id Enter the Router ID of a virtual link neighbor. hello seconds Enter the interval for the transmission of hello packets, in the range 1 to 8192 seconds. This must equal the hello seconds value of the router virtually linked to the interface. The default value is 10 seconds. retransmit seconds Enter the interval for the retransmission of LSA packets on an interface, in the range 1 to 8192 seconds. The default value is 5 seconds. trans-delay seconds Enter the delay interval for transmitting LSA packets on an

interface, in the range 1 to 8192 seconds. The default value is 1 second.

200

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

dead seconds Enter the dead time interval, in the range 1 to 8192 seconds. This

value must equal the dead time of the virtually linked router, and must be at least four times that of the hello interval. The default value is 40 seconds.
simple password Enter the simple text authentication key of the interface, in eight characters or less. This must equal the authentication key of the virtually linked neighbor. md5 keyid Enter the MD5 authentication key ID, in the range 1 to 255. This must

be equal to the authentication key ID of the virtually linked peer.


key Enter the MD5 authentication key, in a character string not exceeding 16

characters. This must be equal to the authentication key of the virtually linked peer. It is displayed in cipher text format, 24 characters in length. Entering the key in cipher text format with 24 characters is also supported. Description Using the vlink-peer command, you can create and configure a virtual link. Using the undo vlink-peer command, you can cancel an existing virtual link. RFC2328 recommends that an OSPF area should be connected to the backbone network. You can use vlink-peer command to set up the connectivity. Virtual link can be regarded as a common interface that uses OSPF so that you can easily understand how to configure parameters such as hello, retransmit, and trans-delay. When configuring virtual link authentication, use the authentication-mode command to set the authentication type to MD5 cipher text or plain text on the backbone network. Related commands: authentication-mode, display ospf. Example To create a virtual link to 10.110.0.3, and use the MD5 cipher authentication mode, enter the following:
[SW7700-ospf]area 10.0.0.0 [SW7700-ospf-area-10.0.0.0]vlink-peer 10.110.0.3 md5 3 345

Integrated IS-IS Configuration Commands

This section describes the commands you can use to configure Integrated Intermediate System-to-Intermediate System (IS-IS) on your Switch 7700. When an Ethernet switch runs a routing protocol, it can perform router functions. The router that is referred to in the following and its icon represent a generalized router or an Ethernet switch running routing protocols.

area-authenticationmode

Syntax
area-authentication-mode { simple | md5 } password [ ip | osi ] undo area-authentication-mode { simple | md5 } [ ip | osi ]

Integrated IS-IS Configuration Commands

201

View IS-IS view Parameter


password: Specify the authentication password which can be a character string with 1 to 16 characters. If md5 is specified, the password is displayed in a cipher text form with 24 characters when the display current-configuration command is executed. Entering a password in a cipher text form with 24 characters is also supported. simple: Configure to transmit the password in simple text. md5: Configure to transmit the password encrypted with MD5 algorithm. ip: Specify the IP authentication password. osi: Specify the OSI authentication password.

The configuration of an IP or an OSI authentication password is independent of the real network environment. Description

Use the area-authentication-mode command to configure ISIS to authenticate received level-1 routing information packets (LSP, CSNP and PSNP), according to the pre-defined mode and password. Use the undo area-authentication-mode command to configure ISIS not to authenticate the received level-1 routing information packets.

In default configuration, the system will not authenticate received level-1 routing packets, and there is no password. By setting authentication, you can reject all the level-1 routing packets, whose area authentication passwords are not consistent with the one set by this command. At the same time, this command makes ISIS insert the area authentication password, hashed or plain-text, into all the level-1 routing packets sent by this node. Related commands: reset isis all, domain-authentication-mode, isis authentication-mode. Example Set the area authentication password to hello and the authentication type to simple.
[SW7700]isis [SW7700-isis]area-authentication-mode simple hello

cost-style

Syntax
cost-style { narrow | wide | wide-compatible | { compatible | narrow-compatible } [ relax-spf-limit ] } undo cost-style

View IS-IS view

202

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter
narrow: Only receive/send packets whose cost type is narrow wide: Only receive/send packets whose cost type is wide. compatible: Receive/send packets whose cost type is narrow or wide. narrow-compatible: Receive packets whose cost type is narrow or wide, but only

send packets whose cost type is narrow


wide-compatible: Receive packets whose cost type is narrow or wide, but only

send packets whose cost type is wide.


relax-spf-metric: Receive routes whose cost value is larger than 1024. If this

item is not set, routes whose metrics value is larger than 1024 will be discarded. This setting is only valid for compatible and narrow-compatible. Description Using cost-style command, you can set the cost type of an IS-IS packet received/sent by the router. Using undo cost-style command, you can restore the default settings. By default, IS-IS only receives/sends packets whose cost type is narrow. Example Set IS-IS to receive packets whose cost type is narrow or wide, but only send packets whose cost type is narrow.
[SW7700] isis [SW7700-isis] cost-style narrow-compatible

default-route-advertise

Syntax
default-route-advertise [ route-policy route_policy_name ] undo default-route-advertise [ route-policy route_policy_name ]

View IS-IS view Parameter


route-policy route_policy_name: Only the route that matches the requirements of the specified Route-policy can generate a default route.

Description

Use the default-route-advertise command to create the default route of L1, L2 router. Use the undo default-route-advertise command to cancel this configuration.

By default, an L2 router generates a default route for an attached L1 area.

Integrated IS-IS Configuration Commands

203

This command can be set on L1 router or L2 router. By default, the command generates a default route on L2 LSPs. If level level-1 is set in Route-policy view, the default route will be generated on L1 LSP. If level level-2 is set in Route-policy view, the default route will be generated on L2 LSP. If level level-1-2 is set in Route-policy view, the default route will be generated on both L1 LSP and L2 LSP. Example Set the router to create the default route in the LSP of the corresponding level.
[SW7700]default-route-advertise

display isis interface

Syntax
display isis interface [ verbose ]

View All views Parameter


verbose: If this parameter is used, the details of the interface will be displayed.

Description Use the display isis interface command to view information on the enabled IS-IS interface. This command displays information on the enabled IS-IS interface, including interface name, IP address of the interface, link state of the interface and so on. Besides displaying all the information shown by the display isis interface command, the display isis interface verbose command displays information about the IS-IS parameters of the interface, such as the CSNP packet broadcast interval, Hello packet broadcast interval and the cost of the interface. Example Display information about the enabled IS-IS interfaces.
<SW7700>display isis interface Interface IP Address Id Vlan-interface3 2.1.1.12 001 Link.Sta Up IP.Sta Up MTU Type DIS 1497 L12 No/No

Display details of the IS-IS enabled interfaces.


<SW7700>display isis interface verbose Interface IP Address Id Link.Sta Vlan-interface3 2.1.1.12 001 Up Secondary IP Address(es): Csnp-Interval : L1 10 L2 10 Hello-Interval: L1 10 L2 10 Hold Time : L1 30 L2 30 Lsp Interval: 1 Cost : L1 10 L2 10 Priority : L1 64 L2 64 Retransmit Interval: 5 IP.Sta Up MTU Type DIS 1497 L12 No/No

204

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

display isis lsdb

Syntax
display isis lsdb [ [ l1 | l2 | level-1 | level-2 ]|[ [ LSPID | local ] | verbose ]* ]*

View All views Parameter


l1 and level-1: Both refer to the link state database of level-1. l2 and level-2: Both refer to the link state database of level-2. local: Display the information from the link state database. verbose: Display the verbose (detailed) information from the link state database. LSPID: Specify the ID of the LSP of the Network-entity-title. The ID is derived from

the Network Entity Title of the router originating the LSP. Description Use the display isis lsdb command to view the link state database of the IS-IS. Example Display verbose information for an LSP.
<SW7700>display isis lsdb 0050.0500.5005.00-00 verbose IS-IS Level-1 Link State Database Lsp ID Sequence Holdtime A-P-O Checksum 0050.0500.5005.00-00 0x00000328 780 0-0-0 0xf211

The table below gives an explanation of the A-P-O column:


Table 18 Description of A-P-O in the IS-IS Link State Database
Heading A Meaning The Attach bit. Indicates that the router is also a Level 2 router, and it can reach other areas. Level 1 routers, and Level 2 routers that have lost connection to other Level 2 routers, use the Attach bit to find the closest Level 2 router. The P bit. This detects if the IS is area partition repair capable. The Overload bit. This determines if the IS is congested. If the Overload bit is set, other routers do not use this system as a transit router when calculating routes. Only packets for destinations directly connected to the overloaded router are sent to this router.

P O

display isis mesh-group

Syntax
display isis mesh-group

View All views Parameter None

Integrated IS-IS Configuration Commands

205

Description Use the display isis mesh-group command to view the configuration of the IS-IS mesh group of the current router interface. Example Add Interface Vlan-interface 1 and Interface Vlan-interface 2 running IS-IS into mesh group 100.
[SW7700-Vlan-interface1]isis mesh-group 100 [SW7700]interface Vlan-interface 2 [SW7700-Vlan-interface2]isis mesh-group 100

Display information for the IS-IS mesh-group.


[SW7700-Vlan-interface2]display isis mesh-group Interface Mesh-group/Blocked Vlan-interface 1 100 Vlan-interface 2 100

display isis peer

Syntax
display isis peer [ verbose ]

View All views Parameter


verbose: When this parameter is configured, the area address carried in the Hello packet from the neighbor will be displayed. Otherwise, only the universal information will be displayed.

Description Use the display isis peer command to view IS-IS peer information. The display isis peer verbose command yields not only all the outputs of the display isis peer command, but also the area address, Uptime and IP address of the directly connected interface of the peer. Example Output more information, using the verbose parameter.
<SW7700>display isis peer verbose System ID Interface Circuit ID State HoldTimeTypePri 0001.0002.0002Vlan-interface10001.0002.0008.01Up 23s L1(L12)64 System ID Interface Circuit ID State HoldTimeTypePri Area Address: 49.0055 IP Address: 175.1.19.36 Period: 00:25:30 0001.0002.0002Vlan-interface20001.0002.002.02 Up 26s L1 0 Area Address: 49.0055 IP Address: 175.1.19.22 Period: 00:00:51

View IS-IS peer information.


<SW7700>display isis peer System ID Interface Circuit ID State HoldTimeTypePri 0001.0002.0002Vlan-interface1 0001.0002.0008.01Up 26s L1(L12)64 0001.0002.0002Vlan-interface20001.0002.002.02 Up 29s L1 0

206

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

display isis route

Syntax
display isis route

View All views Parameter None Description Use display isis route command to view IS-IS routing information. Example View IS-IS routing information.
<SW7700>display isis route ISIS Level - 1 Forwarding Table : Type - D -Direct, C -Connected, I -ISIS, S -Static, O -OSPF B -BGP, R -RIP Flags: R-Added to RM, L-Advertised in LSPs, U-Up/Down Bit Set Destination/Mask In.Met Ex.Met NextHop Interface Flags -------------------------------------------------------------------D 4.0.0.0/8 10 NULL Direct Vlan-interface2 R/L/ISIS Level - 2 Forwarding Table : Type - D -Direct, C -Connected, I -ISIS, S -Static, O -OSPF B -BGP, R -RIP Flags: R-Added to RM, L-Advertised in LSPs, U-Up/Down Bit Set Destination/Mask In.Met Ex.Met NextHop Interface Flags ------------------------------------------------------------------D 4.0.0.0/8 10 NULL Direct Vlan-interface2 R/L/-

display isis spf-log

Syntax
display isis spf-log

View All views Parameter None Description Use the display isis spf-log command to view SPF calculation log information for IS-IS. Example View the SPF calculation log of IS-IS.
<SW7700>display isis spf-log Details of Level 1 SPF Run: ------------------------------Trig.Event No.Of Nodes IS_SPFTRIG_ADJDOWN 2 IS_SPFTRIG_NEWADJ 3

Duration 0 0

StartTime 23:10:54 23:10:54

Integrated IS-IS Configuration Commands

207

IS_SPFTRIG_LSPCHANGE 3 IS_SPFTRIG_PERIODIC 2 IS_SPFTRIG_PERIODIC 2 IS_SPFTRIG_CIRC_UP 3 IS_SPFTRIG_CIRC_UP 3 IS_SPFTRIG_LSPCHANGE 3 Details of Level 2 SPF Run: ------------------------------Trig.Event No.Of Nodes IS_SPFTRIG_NEWADJ 4 IS_SPFTRIG_LSPCHANGE 4 IS_SPFTRIG_PERIODIC 4 IS_SPFTRIG_PERIODIC 4 IS_SPFTRIG_PERIODIC 4 IS_SPFTRIG_CIRC_UP 5 IS_SPFTRIG_LSPCHANGE 5 IS_SPFTRIG_CIRC_UP 7 IS_SPFTRIG_LSPCHANGE 7 IS_SPFTRIG_LSPCHANGE 7 IS_SPFTRIG_ADJDOWN 4 IS_SPFTRIG_ADJDOWN 4

0 0 0 0 0 0

23:10:54 23:10:37 23:10:52 23:10:53 23:10:53 23:10:53

Duration 0 0 0 0 0 0 0 0 0 0 0 0

StartTime 23:10:54 23:10:54 23:10:37 23:10:52 23:10:52 23:10:53 23:10:53 23:10:53 23:10:53 23:10:53 23:10:54 23:10:54

domain-authenticationmode

Syntax
domain-authentication-mode { simple | md5 } password [ ip | osi ] undo domain-authentication-mode { simple | md5 } [ ip | osi ]

View IS-IS view Parameter


simple: Configure to transmit the password in plain text. md5: Configure to transmit the password encrypted with MD5 algorithm. password: Specify the password, ranging from 1 to 16 characters. If you specify md5, the password is displayed in a cipher text form with 24 characters when the display current-configuration command is executed. You can also enter the

password in a cipher text form with 24 characters.


ip: Specify the IP authentication password. osi: Specify the OSI authentication password.

The configuration of an IP or an OSI authentication password is independent of the real network environment. Description

Use the domain-authentication-mode command to configure IS-IS to authenticate received level-2 routing packets (LSP, CSNP, PSNP), according to the pre-defined mode and password. Use the undo domain-authentication-mode command to configure IS-IS not to authenticate the received level-2 routing packets.

208

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

In a default configuration, the system will not authenticate the received level-2 routing packets, and there is no password. By setting authentication, you can reject all the level-2 routing packets, whose domain authentication passwords are are inconsistent with the password set by this command. At the same time, this command makes IS-IS insert the domain authentication password, hashed or plain-text, into all the level-2 routing packets sent by this node. Related commands: area-authentication-mode, isis authentication-mode. Example To authenticate the level-2 routing packets, select the simple mode, and set the password to 3Com.
[SW7700]isis [SW7700-isis]domain-authentication-mode simple 3Com

filter-policy export

Syntax
filter-policy acl-number export [ protocol ] undo filter-policy acl-number export [ protocol ]

View IS-IS view Parameter


acl-number: Specify the number of the access control list, ranging 1 to 199. protocol: Specify the protocols that distribute routing information, including

direct, static, rip, bgp, ospf, and ospf-ase etc. If no protocols are specified, the distributed routes of all the protocols will be filtered. Description

Use the filter-policy export command to configure to filter the routes distributed by IS-IS. Use the undo filter-policy export command to cancel the filtering of exported routes.

By default, IS-IS does not filter any distributed routing information. In some cases, only the routing information meeting the specified conditions will be distributed. You can configure the filter-policy to specify the filter conditions so as to distribute the desired routing information only. Related command: filter-policy import. Example Use acl 6 to filter the routes distributed by IS-IS.
[SW7700-isis]filter-policy 6 export

filter-policy import

Syntax
filter-policy acl-number import

Integrated IS-IS Configuration Commands

209

undo filter-policy acl-number import

View IS-IS view Parameter


acl-number: Specify the number of the access control list, ranging 1 to 199.

Description

Use the filter-policy import command to filter the routes received by IS-IS. Use the undo filter-policy import command to prevent filtering of received routes.

By default, IS-IS does not filter the received routing information. In some cases, only the routing information meeting the specified conditions will be accepted. You can configure the filter-policy to specify the filter conditions so as to accept the desired routing information only. Related command: filter-policy export. Example Filter the received routes by using acl 3.
[SW7700-isis]filter-policy 3 import

ignore-lsp-checksumerror

Syntax
ignore-lsp-checksum-error undo ignore-lsp-checksum-error

View IS-IS view Parameter None Description

Use the ignore-lsp-checksum-error command to require the IS-IS to discard LSPs with checksum errors. Use the undo ignore-lsp-checksum-error command to requires the IS-IS to process LSPs with checksum errors.

By default, the LSP checksum errors are retained. After receiving an LSP packet, the local IS-IS calculates its checksum and compare the result with the checksum in the LSP packet. By default, if the checksum in the packet is not consistent with the calculated result, the LSP is processed and rejected. A network purge of the corrupted LSP can then be initiated. However, if the ignore-lsp-checksum-error command is used, an LSP with a checksum error is discarded silently.

210

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example Discard the LSPs with checksum errors.


[SW7700-isis]ignore-lsp-checksum-error

import-route

Syntax
import-route protocol [ cost value | type { external | internal } | [ level-1 | level-1-2 | level-2 ] | route-policy route-policy-name ]* undo import-route protocol [ cost value | type { external | internal } | [ level-1 | level-1-2 | level-2 ] | route-policy route-policy-name ]*

View IS-IS view Parameter


protocol: Specify the source protocol for importing the routing information,

which can be direct, static, rip, bgp, and ospf etc.


value: Specify the metric of the imported route, ranging from 0 to 63. type external: Configure to set external cost type for routes imported by IS-IS. type internal: Configure to set internal cost type for routes imported by IS-IS. level-1: Configure to import the route into the Level-1 routing table. level-2: Configure to import the route into the Level-2 routing table. If the level is not specified, it defaults to importing the routes into level-2. level-1-2: Configure to import the route into Level-1 and Level-2 routing table. route-policy route-policy-name: Configure to import the routes matching the conditions defined in the specified route-policy only.

Description

Use the import-route command to configure IS-IS to import the routing information of other protocols. Use the undo import-route command to cancel this function.

By default, IS-IS does not import the routing information of other protocols. For IS-IS, the routes discovered by other routing protocols are processed as routes outside the routing domain. When importing the routes of other protocols, you can specify their routing metric. When IS-IS imports routes, you can also specify whether to import the routes into Level-1, Level-2 or Level-1-2. IS-IS regards all the routes imported into the routing domain as external routes, which describe routing outside the IS-IS routing domain.

Integrated IS-IS Configuration Commands

211

Example Configure IS-IS to import routing information from OSPF.


[SW7700-isis]import-route ospf

isis

Syntax
isis [ tag ] undo isis [ tag ]

View System view Parameter


tag: the name given to the ISIS process. The name length should be no longer

than 128 characters, and it can be 0, which means null. Description

Use the isis command to start the corresponding IS-IS routing process and enter the ISIS view. Use the undo isis command to delete the specified IS-IS routing process.

By default, the IS-IS routing process is not started For the normal operation of the IS-IS protocol, the isis command must be used to enable the IS-IS process. Then the network-entity command is used to set a Network Entity Title (NET) for the router. Finally, the isis enable command is used to enable each interface on which the IS-IS process runs. The IS-IS protocol is actually enabled upon the completion of these configurations. Only one IS-IS routing process can be started on one router. Related commands: isis enable, network-entity. Example Start an IS-IS routing process, in which the system ID is 0000.0000.0002 and the area ID is 01.0001.
[SW7700]isis [SW7700-isis]network-entity 01.0001.0000.0000.0002.00

isis authentication-mode

Syntax
isis authentication-mode { simple | md5 } password [ { level-1 | level-2 } [ ip | osi ] ] undo isis authentication-mode { simple | md5 } password [ { level-1 | level-2 } [ ip | osi ] ]

View VLAN interface view

212

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter
password: Specify the authentication password which can be a character string of 1 to 16 characters. If you specify md5, the password is displayed in a cipher text form with 24 characters when the display current-configuration command is executed. Inputting the password in a cipher text form with 24 characters is also supported. md5: Configure to transmit the password encrypted with MD5 algorithm. simple: Configure to transmit the password in plain text. level-1: Configure authentication password for L1. level-2: Configure authentication password for L2. ip: Specify the IP authentication password. osi: Specify the OSI authentication password.

The configuration of ip or osi authentication password is independent of the real network environment. Description

Use the isis authentication-mode command to configure IS-IS to authenticate hello packets of the corresponding level, in the specified mode and with the specified password on the IS-IS interface. Use the undo isis authentication-mode command to cancel authentication and delete the password at the same time.

By default, the password is not set and no authentication is executed. If the password is set, but no parameter is specified, the default settings are level-1, and osi. Related commands: area-authentication-mode, domain-authentication-mode. Example Set the authentication password tangier in plain text for the Level-1 hello packets on Interface Vlan-interface 1.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis authentication-mode simple tangier level-1

isis circuit-level

Syntax
isis circuit-level [ level-1 | level-1-2 | level-2 ] undo isis circuit-level

View VLAN interface view

Integrated IS-IS Configuration Commands

213

Parameter
level-1: Configure the current interface to send only Level-1 hello packets and to form only Level-1 adjacencies. level-1-2: Configure the current interface to send Level-1 and Level-2 hello packets and to form Level-1 and Level-2 adjacencies. level-2: Configure the current interface to send only Level-2 hello packets and to form only Level-2 adjacencies.

Description Use the isis circuit-level command to configure the circuit type. Use the undo isis circuit-level command to restore the default setting. By default, the value is level-1-2. This command is only applicable to a level-1-2 router. If the local router is a level-1-2 router and it is required to establish an adjacency with the peer router on a certain level (level-1 or level-2), this command can specify that the interface send and receive hello packets of this level. Certainly, only one type of hello packet is sent and received on the point-to-point link. In this way, excessive processing is avoided, and the bandwidth is saved. Related commands: is-level. Example When interface Vlan-interface 1 is connected with a non-backbone router in the same area, you can set this interface as level-1, prohibiting the sending and receiving of level-2 hello packets.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis enable [SW7700-Vlan-interface1]isis circuit-level level-1

isis cost

Syntax
isis cost value [ level-1 | level-2 ] undo isis cost [ level-1 | level-2 ]

View VLAN interface view Parameter


value: Specify the link cost used in the SPF calculation of corresponding level. Its

range is 0 to 63 for cost-style narrow. By default, the value is 10.


level-1: indicate that the link cost corresponds to level-1. level-2: indicate that the link cost corresponds to level-2

Description

Use the isis cost command to configure the link cost of this interface when performing SPF calculation.

214

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Use the undo isis cost command to restore the default link cost.

If neither Level 1 nor Level 2 is specified in the configuration, level-1 will be the default value. We recommend that you configure the appropriate link cost for all the interfaces. Otherwise, the link cost in the calculation of IS-IS routes cannot reflect the desired link cost. Example Set the link cost of the Level-2 link on Interface Vlan-interface 1 to 5.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis cost 5 level-2

isis dis-priority

Syntax
isis dis-priority value [ level-1 | level-2 ] undo isis dis-priority [ level-1 | level-2 ]

View VLAN interface view Parameter


value: The priority used when selecting the designated intermediate system (DIS). Its value ranges 0 to 127, and the default priority is 64. level-1: Specify the priority when selecting level-1 DIS. level-2: Specify the priority when selecting level-2 DIS.

If the level is not specified, it defaults to setting the Level-1 priority. Description

Use the isis dis-priority command to configure the priority of an interface for the DIS election. Use the undo isis dis-priority command to restore the default priority.

The IS-IS protocol does not include the concept of a backup DIS. In addition, the router with the priority 0 can become the DIS, which is different from the DR election of OSPF. Related commands: area-authentication-mode, domain-authentication-mode. Example Set the priority of Interface Vlan-interface 1 to 127.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis dis-priority 127 level-2

isis enable

Syntax
isis enable [ tag ]

Integrated IS-IS Configuration Commands

215

undo isis enable [ tag ]

View VLAN interface view Parameter


tag: the name given to an IS-IS routing process, when the isis command in

system view was executed. If not specified, it is null. Description

Use the isis enable command to configure the interface to activate the corresponding IS-IS routing process. Use the undo isis enable command to cancel this designation.

By default, the IS-IS routing process is not enabled on an interface. For normal operation of the IS-IS protocol, the isis command must be used to enable the IS-IS process. Then the network-entity command is used to set a Network Entity Title (NET) for the router. Finally, the isis enable command is used to enable each interface on which the IS-IS process runs. The IS-IS protocol is actually enabled upon the completion of these configurations. Related commands: isis, network-entity. Example Create an IS-IS routing process named 3Com, and activate this routing process on interface Vlan-interface 1.
[SW7700]isis 3Com [SW7700-isis]network-entity 10.0001.1010.1020.1030.00 [SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis enable 3Com

isis mesh-group

Syntax
isis mesh-group { mesh_group_number | mesh-blocked } undo isis mesh-group

View VLAN interface view Parameter


mesh_group_number: Specify the mesh group number, ranging from 1 to

4294967295.
mesh-blocked: Configure to block a specified interface, so that it will not flood

the received LSP to other interfaces. Description

Use the isis mesh-group command to add an interface to a specified mesh group.

216

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Use the undo isis mesh-group command to delete this interface from the mesh group.

By default, the interface does not belong to any mesh group and floods LSPs normally. The interface beyond the mesh group floods the received LSP to other interfaces, following the normal procedure. This processing method applies to an NBMA network with higher connectivity, where redundant, point-to-point links cause repeated LSP flooding and waste bandwidth. The interface joining a mesh group only floods the received LSP to the interfaces beyond the local mesh group. Be sure to provide some redundancy when adding an interface to a mesh group or blocking it. This will minimize the potential for a loss of routing information that can occur when there is a link failure. Example Add interface Vlan-interface 1 to mesh group 3.
[SW7700-Vlan-interface1]isis mesh-group 3

isis timer csnp

Syntax
isis timer csnp seconds [ level-1 | level-2 ] undo isis timer csnp [ level-1 | level-2 ]

View VLAN interface view Parameter


seconds: Specify the complete sequence number packet (CSNP) packet interval

on the broadcast network, ranging from 1 to 65535 and measured in seconds. By default, the value is 10 seconds.
level-1: Specify the Level-1 CSNP packet interval. level-2: Specify the Level-2 CSNP packet interval.

Description

Use the isis timer csnp command to configure the interval of sending CSNP packets on the broadcast network. Use the undo isis timer csnp command to restore the default value, that is, 10 seconds.

Only the DIS can periodically send CSNP packets, therefore, this command is valid only for the router that is selected as the DIS. Furthermore, the DIS are elected separately for level-1 and level-2, and their intervals of sending CSNP packets must be set respectively.

Integrated IS-IS Configuration Commands

217

Example Set the CSNP packet of Level-2 to be transmitted every 15 seconds on the interface Vlan-interface 1.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis timer csnp 15 level-2

isis timer dead

Syntax
isis timer dead seconds [ level-1 | level-2 ] undo isis timer dead [ level-1 | level-2 ]

View VLAN interface view Parameter


seconds: Specify the Hello failure interval for IS-IS neighbors, ranging from 9 to

65535 and measured in seconds. The default value is 30 seconds.


level-1: Specify the Hello failure interval for Level-1 IS-IS neighbors. level-2: Specify the Hello failure interval for Level-2 IS-IS neighbors.

If the level is not specified, it defaults to setting the Hello failure interval of Level-1. Description

Use the isis timer dead command to set the failure interval for an IS-IS neighbor. Use the undo isis timer dead command to restore the default setting.

For the broadcast network, you can configure the neighbor Hello failure interval of Level-1 or Level-2 separately. However, it is not necessary for point-to-point links, because only one kind of Hello packet is applied. The Hello failure interval is the hold-down time. If a router has not received a hello packet from a peer within the hold-down time, the link between the router and the peer is considered invalid. The hold-down time is based on the interface configuration, and the different routers in the same area can be configured with different hold-down values. The dead-time value that is set on router A is the hold-down time that is used by neighboring router B to decide when to tear down their peer relationship. Related command: isis timer hello. Example Set the failure interval for receiving Hello packets from an IS-IS neighbor on Vlan-interface 1 to 30s
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis enable [SW7700-Pos 1/0/0]isis timer dead 30 level-2

218

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

isis timer hello

Syntax
isis timer hello seconds [ level-1 | level-2 ] undo isis timer hello [ level-1 | level-2 ]

View VLAN interface view Parameter


seconds: Specify the Hello interval, ranging from 3 to 255 and measured in

seconds. The default value is 10 seconds.


level-1: Specify the Level-1 Hello interval. level-2: Specify the Level-2 Hello interval.

If the level is not specified, it defaults to Level-1. Description

Use the isis timer hello command to configure the interval for sending hello packets. Use the undo isis timer hello command to restore the default value of 10 seconds.

On a broadcast link, both level-1 and level-2 hello packets can be sent and their intervals should also be set. Such settings are unnecessary on point-to-point links. The shorter the sending interval is, the more system resources are occupied to send hello packets. Therefore, the interval should be set according to actual conditions. Related command: isis timer dead. Example Set the Level-2 Hello packet to be transmitted every 20 seconds on Interface Vlan-interface 1.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis timer hello 20 level-2

isis timer lsp

Syntax
isis timer lsp time undo isis timer lsp

View VLAN interface view Parameter


time: Specify the LSP interval, ranging from 1 to 1000 and measured in milliseconds. The default value is 33 milliseconds.

Integrated IS-IS Configuration Commands

219

Description

Use the isis timer lsp command to configure the IS-IS LSP interval on the interface. Use the undo isis timer lsp command to restore the default setting.

Related command: isis timer retransmit. Example Set the LSP interval on Interface Vlan-interface 1 to 500 milliseconds.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis timer lsp 500

isis timer retransmit

Syntax
isis timer retransmit seconds undo isis timer retransmit

View VLAN interface view Parameter


seconds: Specify the retransmission interval of LSP packets, in seconds, in the range of 1 to 300 and a default value of 5 seconds.

Description

Use the isis timer retransmit command to configure the LSP retransmission interval over a point-to-point link. Use the undo isis timer retransmit command to restore the default setting.

Use caution when setting this parameter to avoid unnecessary retransmission. The response is required when sending LSP packets on a point-to-point link but not on a broadcast link. This command is unnecessary for a broadcast link. Related command: isis timer lsp. Example Set the LSP retransmission interval to 10 seconds on Interface Vlan-interface 1.
[SW7700]interface Vlan-interface 1 [SW7700-Vlan-interface1]isis timer retransmit 10

is-level

Syntax
is-level { level-1 | level-1-2 | level-2 } undo is-level

View IS-IS view

220

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter
level-1: Configure the router to operate at Level-1, only calculate the intra-area

routes and maintain the L1 LSDB.


level-1-2: Configure the router to operate at Level-2, calculate both the L1 and

L2 routes and maintain an L1 and L2 LSDB.


level-2: Configure the router to operate at Level-2, only flood L2 LSPs and calculate L2 routes and maintain an L2 LSDB.

Description

Use the is-level command to configure the IS-IS level. Use the undo is-level command to restore the default value.

By default, the value is level-1-2. 3Com recommends setting the system Level when you configure IS-IS. If there is only one area, you are advised to set the level of all the routers to Level-1 or Level-2, because it is not necessary for all the routers to maintain two identical databases. You are advised to set all the routers to Level-2 for convenient future extension, when applying them to an IP network. Related command: isis circuit-level. Example Set the current router to operate at Level-1.
[SW7700]isis [SW7700-isis]is-level level-1

log-peer-change

Syntax
log-peer-change undo log-peer-change

View IS-IS view Parameter None Description


Use the log-peer-change command to log peer changes. Use the undo log-peer-change command to prevent log peer changes.

By default, logging of peer changes is disabled. After peer changes log is enabled, the IS-IS peer changes will be output on the configuration terminal until the log is disabled.

Integrated IS-IS Configuration Commands

221

Example Configure to output the IS-IS peer changes on the current router.
[SW7700-isis]log-peer-change

md5-compatible

Syntax
md5-compatible undo md5-compatible

View IS-IS view Parameter None Description Using the md5-compatible command, you can set the IS-IS to use the MD5 algorithm which is compatible with that of the other vendors. Using the undo md5-compatible command, you can return to the defaults. By default, the system uses the MD5 algorithm in IS-IS which is compatible with that of 3Com. You must configure this command when the switch needs to authenticate the devices of other vendors using MD5 algorithm in IS-IS. Example Set the IS-IS to use the MD5 algorithm compatible with that of the other vendors [SW7700-isis] md5-compatible network-entity Syntax
network-entity NET undo network-entity NET

View IS-IS view Parameter


NET: Specify the Network Entity Title in the XX.XXXX....XXXX.00 format, in which the first XX is the area address, the twelve Xs in the middle is the System ID of the router, and the 00 in the end is SEL.

Description

Use the network-entity command to configure the name of Network Entity Title (NET) of the IS-IS routing process. Use the undo network-entity command to delete a NET.

By default, the value is No NET. NET means the Network Service Access Point (NSAP). It consists of three parts. Part one is area ID, which is variable (1 to 13 bytes), and the area IDs of the routers in

222

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

the same area are identical. Part two is system ID (6 bytes) of this router, which must be unique in the whole area and backbone area. Part three, the last byte SEL, whose value must be 00. So the NET field of IS-IS is 8 to 20 bytes. Usually, one router can be configured with one NET. When the area is redesigned by combination, separation, or after reconfiguration, the correctness and uniqueness of the NETs must be ensured. Related commands: isis, isis enable. Example Specify NET as 10.0001.1010.1020.1030.00, in which the system ID is 1010.1020.1030, area ID is 10.0001.
[SW7700]isis [SW7700-isis]network-entity 10.0001.1010.1020.1030.00

preference

Syntax
preference value undo preference

View IS-IS view Parameter value: Specify the preference, ranging from 1 to 255. By default, the value is 15. Description

Use the preference command to configure the preference of IS-IS protocol. Use the undo preference command to restore the default value.

Several dynamic routing protocols could run simultaneously on a router. In this case, there is an issue of sharing and selecting the routing information among all the routing protocols. The system sets a preference for each routing protocol; 1 is the highest preference and 255 the lowest. When various routing protocols find the route to the same destination, the protocol with the higher preference takes effect. Example Configure the preference of IS-IS to 25.
[SW7700-isis]preference 25

reset isis all

Syntax
reset isis all

View User view Parameter None

Integrated IS-IS Configuration Commands

223

Description Use the reset isis all command to reset all the IS-IS data structures. This command is used when LSPs need refreshing immediately. For example, after area-authentication-mode and domain-authentication-mode commands are executed, the old LSPs still remain on the router. This command can be used to clear them. Related commands: area-authentication-mode, domain-authentication-mode. Example Reset all the IS-IS data structures.
<SW7700>reset isis all

reset isis peer

Syntax
reset isis peer system-id

View User view Parameter


system-id: Specifies the system ID of IS-IS neighbor.

Description Use the reset isis peer command to reset the specified IS-IS peer. This command is used when you want to reset the peer relationship with a certain neighbor. Example Clear the IS-IS neighbor whose system ID is 0000.0c11.1111.
<SW7700>reset isis peer 0000.0c11.1111

set-overload

Syntax
set-overload undo set-overload

View IS-IS view Parameter None Description


Use the set-overload command to set overload flag for the current router. Use the undo set-overload command to cancel the overload flag.

224

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

By default, no overload flag is set. If a router is configured with the overload flag, the routes it calculates will be ignored by other routers in SPF calculation. (However the directly connected routes will not be ignored.) And other routers should not send this router the packets which would normally be forwarded by it. Example Set overload flag on the current router.
[SW7700-isis]set-overload

silent-interface

Syntax
silent-interface silent_interface_type silent_interface_number undo silent-interface silent_interface_type silent_interface_number

View IS-IS view Parameter


silent_interface_type: Specifies the interface type. silent_interface_number: Specifies the interface number.

Description

Use the silent-interface command to disable transmission of IS-IS packets on the specified interface. Use the undo silent-interface command to enable transmission of IS-IS packets.

By default, all interfaces are allowed to transmit/receive IS-IS packets. The silent-interface command is only used to suppress transmission of IS-IS packets on the interface, but the routing information for this interface will still be transmitted from other interfaces. Example Prohibit transmission of IS-IS packets to be transmitted via Interface Vlan-interface 3.
[SW7700-isis]silent-interface Vlan-interface 3

spf-delay-interval

Syntax
spf-delay-interval number undo spf-delay-interval

View IS-IS view

Integrated IS-IS Configuration Commands

225

Parameter
number: Specify number of routes, from 1000 to 50000, to process before releasing the CPU. The default value is 5000 routes.

Description

Use the spf-delay-interval command to configure the number of routes to process before releasing the CPU. Use the undo spf-delay-interval command to restore the default setting.

When there are a large number of routes in the routing table, this command can be used to insure that CPU resources are released after a certain number of routes are processed. Processing of the unprocessed routes continues after one second. In this way, SPF calculation does not consume system resources for a long time or degrade the response time of the console. The value of the parameter number can be adjusted according to the capacity of the routing table. If the spf-slice-size command is also configured, the SPF calculation will be paused when any limit is met. By default, the CPU is released when 5000 routes are processed. Related command: spf-slice-size. Example Set IS-IS to release CPU once after processing every 3000 routes.
[SW7700-isis]spf-delay-interval 3000

spf-slice-size

Syntax
spf-slice-size seconds undo spf-slice-size

View IS-IS view Parameter


seconds: Duration, in seconds, of one SPF calculation cycle in the range of 0 to

120. When the calculation duration time reaches or exceeds the set value, this slice of the calculation ends. If seconds is set to 0, it indicates that SPF calculation is not divided into slices and it will operate until the end. By default, the value is 0. Description

Use the spf-slice-size command to configure whether to set slice and the duration time of one cycle when IS-IS performs SPF route calculation. Use the undo spf-slice-size command to restore the default setting.

When there are a large number of routes in the routing table, this command can be used to enable the SPF calculation in slices to prevent it from occupying the system resources for an extended time.

226

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

The user is recommended to use the command when the number of routes reaches 150,000 or 200,000 and the value of seconds is recommended to be 1. In other cases, the default setting should be used, that is, SPF runs to the end with no slice. If the spf-delay-interval command is also configured, when SPF calculation is run, the SPF calculation is paused if any limit is met. Related command: spf-delay-interval. Example Set the SPF duration time to 1 second.
[SW7700-isis]spf-slice-size 1

summary

Syntax
summary ip-address mask [ level-1 | level-1-2 | level-2 ] undo summary ip-address mask [ level-1 | level-1-2 | level-2 ]

View IS-IS view Parameter


ip-address: Aggregated network segment address. mask: Aggregated network mask. level-1: Configure to aggregate the routes imported into Level-1. level-2: Configure to aggregate the routes imported into Level-2 routing table. level-1-2: Configure to aggregate the routes imported into Level-1 and Level-2.

Description

Use the summary command to configure IS-IS route summary. Use the undo summary command to cancel the summary.

By default, no routes are summarized. Multiple routes with a long subnet mask and the same next hop can be aggregated into one route with a shorter subnet mask. For example, 11.1.1.0/24, 11.1.2.0/24, and 11.2.0.0/16 can be aggregated into 11.0.0.0/8. In this way, the sizes of the routing table, LSP packets and LSDB are reduced. The aggregated route can be either a route found by IS-IS protocol, or an imported route. Furthermore, the cost value of the aggregated route adopts the smallest cost of the routes aggregated. Example Set a route summary of 202.0.0.0/8.
[SW7700-isis]summary 202.0.0.0 255.0.0.0

Integrated IS-IS Configuration Commands

227

timer lsp-max-age

Syntax
timer lsp-max-age seconds undo timer lsp-max-age

View IS-IS view Parameter


seconds: Specifies the maximum lifetime of LSP, measured in seconds. The range is 1 to 65535. The default value is 1200 seconds.

Description

Use the timer lsp-max-age command to configure the maximum lifetime of an LSP generated by the current router. Use the undo timer lsp-max-age command to restore the default value.

When the router generates an LSP for the system, it adds the maximum lifetime to it. When other routers receive this LSP, the lifetime decreases continuously as time goes. If an updated LSP has not been received before the old one times out, this LSP will be deleted from the LSDB. Related commands: timer lsp-refresh. Example Set the lifetime of an LSP generated by the current system to 25 minutes, i.e., 1500 seconds.
[SW7700-isis]timer lsp-max-age 1500

timer lsp-refresh

Syntax
timer lsp-refresh seconds undo timer lsp-refresh

View IS-IS view Parameter


seconds: Specifies the LSP refresh interval, measured in seconds. The range is 1

to 65535. The default value is 900 seconds. Description


Use the timer lsp-refresh command to configure the refresh interval of LSP. Use the undo timer lsp-refresh command to restore the default value, that is, 900 seconds.

Using this mechanism, the latest synchronization of the LSP within the entire area can be maintained. Related command: timer lsp-max-age.

228

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example Set the LSP refresh interval of the current system to 25 minutes, that is, 1500 seconds.
[SW7700-isis]timer lsp-refresh 1500

timer spf

Syntax
timer spf seconds [ level-1 | level-2 ] undo timer spf [ level-1 | level-2 ]

View IS-IS view Parameter


seconds: Specifies the SPF calculation interval, ranging from 1 to 120 and measured in seconds. The default value is 5 seconds. level-1: Sets Level-1 SPF calculation interval only. level-2: Sets Level-2 SPF calculation interval only.

If the level is not specified, it defaults to setting the Level-1 SPF calculation interval. Description

Use the timer spf command to configure the interval for the SPF calculation of corresponding level. Use the undo timer spf command to restore the system default value, that is, 5 seconds.

Usually, when the LSDB of the corresponding level is changed, an SPF calculation is required. However, when the network is unstable and the LSDB changes frequently, if the SPF calculation is performed too frequently, the system efficiency will be lowered. In a severe condition, other services will be affected. By setting a proper interval for performing the SPF calculation, you can avoid the above situation. The interval for SPF calculation should not be set too long, because a long interval will prevent the current routing table from showing the actual network condition. The setting must be made according to actual conditions. Example Set the SPF calculation interval of the router to 3 seconds.
[SW7700-isis]timer spf 3

BGP Configuration Commands

This section describes the commands you can use to configure Border Gateway Protocol (BGP) on your Switch 7700. For the commands defining routing policies in BGP, refer to the Routing Policy of the next chapter.

BGP Configuration Commands

229

aggregate

Syntax
aggregate address mask [ as-set | attribute-policy route-policy-name | detail-suppressed | origin-policy route-policy-name | suppress-policy route-policy-name ] undo aggregate address mask [ as-set | attribute-policy route-policy-name | detail-suppressed | origin-policy route-policy-name | suppress-policy route-policy-name ]

View BGP view Parameter


address: Address of the aggregated route. mask: Network mask of the aggregated route.

Description

Using aggregate command, you can establish an aggregated record in the BGP routing table. Using undo aggregate command, you can disable the function.

By default, there is no route aggregation. Example Create an aggregated record in BGP routing table.
[SW7700-bgp]aggregate 168.328.0.0 255.255.0.0

bgp

Syntax
bgp as_number undo bgp [ as_number ]

View System view Parameter


as_number: The specified local AS number.

Description

Use the bgp command to enable BGP and enter the BGP view. Use the undo bgp command to disable BGP.

By default, the system does not run BGP. This command is used to enable and disable BGP as well as to specify the local AS number of BGP. Example Enable BGP.

230

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

[SW7700]bgp 100 [SW7700-bgp]

compare-different-asmed

Syntax
compare-different-as-med undo compare-different-as-med

View BGP view Parameter none Description

Use the compare-different-as-med command to enable comparison of MED values from different AS neighboring routes when determining the best route. Use the undo compare-different-as-med command to disable the comparison.

By default, the comparison of MED attribute values from the routing paths of different AS peers is disabled. If there are several routes available to one destination address, the route with smaller MED parameter can be selected as the final route item. Do not use this command unless it is determined that the same IGP and routing selection mode are adopted by different autonomous systems. Example
[SW7700-bgp]compare-different-as-med

confederation id

Syntax
confederation id as_number undo confederation id

View BGP view Parameter


as_number: The ID of BGP AS confederation. It is equal to the AS number which

contains the AS numbers of multiple sub-ASs. The range is 1 to 65535. Description


Use the confederation id command to configure confederation identifier. Use the undo confederation id command to cancel the BGP confederation specified by as-number parameter.

By default, the confederation ID is not configured.

BGP Configuration Commands

231

Confederation can be adopted to solve the problem of too many IBGP full connections in a large AS domain. The solution is, first dividing the AS domain into several smaller sub-ASs, and each sub-ASs remains full-connected. These sub-ASs form a confederation. Key IGP attributes of the route, such as next hop, MED, local preference, are not discarded across each sub-ASs. The sub-ASs still look like a whole from the point of view of a confederation although these sub-ASs have EBGP relations. This can assure the integrity of the former AS domain, and ease the problem of too many connections in the domain Related commands: confederation nonstandard, confederation peer-as. Example Confederation 9 consists of four sub-ASs, namely, 38, 39, 40 and 41. Here, the peer 10.1.1.1 is an internal member of the AS confederation while the peer 200.1.1.1 is an external member of the AS confederation. For external members, Confederation 9 is a unified AS domain.
[SW7700]bgp 41 [SW7700-bgp]confederation id 9 [SW7700-bgp]confederation peer-as 38 39 40 [SW7700-bgp]group Confed38 external [SW7700-bgp]peer Confed38 as-number 38 [SW7700-bgp]peer 10.1.1.1 group Confed38 [SW7700-bgp]group Remote98 external [SW7700-bgp]peer Remote98 as-number 98 [SW7700-bgp]peer 200.1.1.1 group Remote98

confederation nonstandard

Syntax
confederation nonstandard undo confederation nonstandard

View BGP view Parameter None Description

Use the confederation nonstandard command to configure the router to be compatible with routers not following RFC1965. Use the undo confederation nonstandard command to disable this function.

By default, it is in accordance with RFC1965. Related commands: confederation id, confederation peer-as. Example AS100 contains routers following nonstandard, which is composed of two sub-ASs, 64000 and 65000.
[SW7700]bgp 64000 [SW7700-bgp]confederation id 100 [SW7700-bgp]confederation peer-as 65000

232

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

[SW7700-bgp]confederation nonstandard

confederation peer-as

Syntax
confederation peer-as as_number-1 [... as_number_n ] undo confederation peer-as [ as-number-1 ] [... as-number_n]

View BGP view Parameter


as-number_1...as-number_n: Sub-AS number. The range is 1 to 65535. 0 to 32 sub-autonomous systems can be configured.

Description

Use the confederation peer-as command to configure a confederation consisting of which sub-ASs. Use the undo confederation peer-as command to cancel the specified sub-AS in the confederation.

By default, no autonomous system is configured as a member of the confederation. Before this command is performed, the confederation ID should be configured by the confederation id command. Otherwise this configuration is invalid. The configured ASs in this command are inside the confederation and each AS uses fully meshed network. The confederation appears as a single AS to the routers outside it. Related commands: confederation nonstandard, confederation id. Example Configure the confederation contains AS 2001 and 2002.
[SW7700-bgp]confederation peer-as 2000 2001

dampening

Syntax
dampening [ half_life_reachable half_life_unreachable reuse suppress ceiling ] [ route-policy policy_name ] undo dampening

View BGP view Parameter


half_life_reachable: Specify the semi-dampening when the route is reachable. The range is 1 to 45 minutes. By default, the value is 15 minutes. half_life_unreachable: Specify the semi-dampening when the route is unreachable. The range is 1 to 45 minutes. By default, the value is 15 minutes.

BGP Configuration Commands

233

reuse: The penalty value of a route when it start to be reused. The range is 1 to 20000. By default, the value is 750. suppress: The penalty threshold of a route when it start to be suppressed. The range is 1 to 20000. By default, the value is 2000. ceiling: The upper threshold of the penalty. The range is 1001 to 20000. By default, the value is 16000. policy_name: Configure route policy name.

If the parameters are not set, the BGP route attenuation is valid and each parameter is taken as the default value. The parameters are mutually dependent. Once any parameter is configured, all other parameters should also be specified. Description

Use the dampening command to make BGP route attenuation valid or modify various BGP route attenuation parameters. Use the undo dampening command to make the characteristics invalid.

By default, no route attenuation is configured. Related commands: reset dampening, reset bgp flap-info, display bgp routing-table dampening, display bgp routing-table flap-info. Example
[SW7700-bgp]dampening 15 15 1000 2000 10000

debugging bgp

Syntax
debugging bgp { all | event | normal | { keepalive | mp-update | open | packet | route-refresh | update } [ receive | send ] [ verbose ] undo debugging bgp { all | event | normal | keepalive | mp-update | open | packet | route-refresh | update }

View User view Parameter


all: Indicating to enable all BGP information debugging. event: Indicating to enable BGP event information debugging. normal: Indicating to enable information debugging of BGP normal functions. keepalive: Indicating to enable BGP Keepalive packet information debugging. mp-update: indicating to enable MBGP Update packet information debugging. open: Indicating to enable BGP Open packet information debugging. packet: Indicating to enable BGP packet information debugging.

234

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

route-refresh: Indicating to enable BGP route-refresh packet information

debugging.
update: Indicating to enable BGP Update packet information debugging. receive: Information of receiving packets. send: Information of sending packets. verbose: Detailed information.

Description

Use the debugging bgp all command to enable all the information debugging of BGP packet and events. Use the debugging bgp event command to enable the information debugging of BGP events Use the debugging bgp keepalive command, to enable the information debugging of BGP Keepalive packets. Use the debugging bgp packet command to enable the information debugging of BGP packets. Use the undo debugging bgp command to disable the debugging functions.

Example # Enable the information debugging of BGP packets.


<SW7700>debugging bgp packet

default local-preference

Syntax
default local-preference value undo default local-preference

View BGP view Parameter


value: Default local preference to be configured. The range is 0 to 4294967295. By default, its value is 100.

Description

Use the default local-preference command to configure the default local preference. Use the undo default local-preference command to restore the default value.

Configuring different local preferences will affect BGP routing selection. When a router running BGP gets routes with the same destination address but different next hops through different internal peers, it will select the route of highest local preference to this destination.

BGP Configuration Commands

235

Example The two routers RTA and RTB in the same autonomous area use X.25 and Frame Relay protocols separately to connect with external autonomous areas. The command can be used to configure the default local preference of RTB as 180 so that the route via RTB is selected first when the same route goes through RTA and RTB at the same time.
[SW7700-bgp]default local-preference 180

default med

Syntax
default med med_value undo default med

View BGP view. Parameter


med_value: MED value to be specified. The range is 0 to 4294967295. By default, the med-value is 0.

Description

Use the default med command to configure the default system metric. Use the undo default med command to restore the default metric of the system.

In the case that all other conditions are the same, the system first selects the route with the smaller MED value as the external route of the autonomous system. Example Routers RTA and RTB belong to AS100 and router RTC belongs to AS200. RTC is the peer of RTA and RTB. The network between RTA and RTC is X.25 network and the network between RTB and RTC is Ethernet. So the MED of RTA can be configured as 25 to allow RTC to select the route transmitted by RTB first.
[SW7700-bgp]default med 25

display bgp group

Syntax
display bgp group [ group_name ]

View All views Parameter


group_name: Specified a peer group.

Description Use the display bgp group command to view the information of peer groups.

236

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example View the information of the peer group aaa.


<SW7700>display bgp group aaa Group : aaa type : external as-number : 200 members in this group : 10.1.1.1 11.1.1.1 configuration within the group : no export policy route-policy no export policy filter-policy no export policy acl no export policy ip-prefix route-policy specified in import policy : aaa no import policy filter-policy no import policy acl no import policy ip-prefix no default route produce

Table 19 Information Generated by the display bgp group Command


Field Group type as-number members in this group route-policy filter-policy acl ip-prefix Description Name of peer group Type of peer group: IBGP or EBGP AS number of peer group Members in this peer group Name of configured route policy Configured export and import route filter for BGP Configured access control list Configured IP address prefix list

display bgp network

Syntax
display bgp network

View All views Parameter none Description Use the display bgp network command to view the routing information that has been configured. Example Display the routing information that has been configured.
<SW7700>display bgp network Network Mask Route-policy 133.1.1.0 255.255.255.0 None 112.1.0.0 255.255.0.0 None

BGP Configuration Commands

237

Table 20 Information Generated by the display bgp network Command


Field Network Mask Route-policy Description Network address Mask Configured route policy

display bgp paths

Syntax
display bgp paths as-regular-expression

View All views Parameter


as_regular_expression: Matched AS path regular expression.

Description Use the display bgp paths command to view the information about AS paths Example Display the information about the AS paths.
<SW7700>display bgp paths ^600$ Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Id Hash-Index References Aggregator Origin As-Path -------------------------------------------------------------------6 90 15 <null> IGP 600

Table 21 Information Generated by the display bgp paths Command


Field Flags Description State flags: # - valid (valid) ^ - best (selected) D - damped (discarded) H - history (history) I - internal (interior gateway protocol) S - aggregate suppressed (suppressed) Value of sequence number Value of Hash-index Number of routes with reference Mask length of aggregate route Origin attribute of route, which indicates that the route updates its origin relative to the route originating it from AS. It has three optional values: IGP: The route belongs to inside of AS. BGP treats aggregate route and the route defined by the command network as inside of AS, and origin type as IGP. The route is learned from exterior gateway protocol (EGP). Short for INCOMPLETE: indicates that the original source of the route information is unknown (learned by other methods). BGP sets the origin of the route imported through other IGP protocols as INCOMPLETE

Id Hash-Index References Aggregator Origin

EGP INC

238

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Table 21 Information Generated by the display bgp paths Command


As-path AS-path attribute of route, which records all AS areas that the route passes. With it, routing loops can be avoided

display bgp peer

Syntax
display bgp peer peer_address verbose display bgp peer [ verbose ]

View All views Parameter


peer_address: Specify the peer to be displayed.

Description Use the display bgp peer command to view the information about BGP peers. Example Display the detail information of the peer 10.110.25.20.
<SW7700>display bgp peer 10.110.25.20 verbose Peer: 10.110.25.20 Local: Unspecified Type: External State: Idle Flags: <Idled> Last State: NoState Last Event: NoEvent Last Error: None Options: <> Configuration within the peer : no export policy route-policy no export policy ip-prefix no export policy filter-policy no export policy acl no import policy route-policy no import policy ip-prefix no import policy filter-policy no import policy acl no default route produce

Table 22 Information Generated by the display bgp peer verbose Command


Field Peer Local Type State Flags Last State Last Event Description IP address of peer and port number used by the peer to establish TCP connection IP address and port number used to establish TCP connection of local end Type of peer: Internal for IBGP and External for EBGP State of peer Flags of peer Last state before entering current state Last event of neighbor state machine

BGP Configuration Commands

239

Table 22 Information Generated by the display bgp peer verbose Command


Last Error Options Last error of neighbor state machine Options

display bgp routing-table

Syntax
display bgp routing-table [ ip-address [ ip-mask ]]

View All views Parameter


ip_address: Destination of the network. ip_mask: Mask of the network.

Description Use the display bgp routing-table command to view all the BGP routing information. Example Display all the BGP routing information.
<SW7700>display bgp routing-table Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/Mask Pref Next-Hop Med Local-Pref Origin As-Path -------------------------------------------------------------------*> 1.1.1.0/24 10.10.10.1 IGP 200 *> 1.1.2.0/24 10.10.10.1 IGP 200 *> 1.1.3.0/24 10.10.10.1 IGP 200 *> 2.2.3.0/24 10.10.10.1 INC 200 *> 4.4.4.0/24 10.10.10.1 IGP 200 *> 9.9.9.0/24 10.10.10.1 INC 200 *> 10.10.10.0/24 0.0.0.0 IGP * 10.10.10.1 IGP 200

Table 23 Information Generated by the display bgp routing-table Command


Field Flags Description State flags: # - valid (valid) ^ - best (selected) D - damped (discarded) H - history (history) I - internal (interior gateway protocol) S - aggregate suppressed (suppressed) Destination address/Mask Preference IP address of next hop MULTI_EXIT_DISC attribute value, which ranges from 0 to 4294967295 Local preference, which ranges from 0 to 4294967295

Dest/Mask Pref Next Hop Med Local-Pref

240

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Table 23 Information Generated by the display bgp routing-table Command


Origin Origin attribute of route, which indicates that the route updates its origin relative to the route originating it from AS. It has three optional values: IGP The route belongs to inside of AS. BGP treats aggregate route and the route defined by the command network as inside of AS, and origin type as IGP. The route is learned from exterior gateway protocol (EGP). Short for INCOMPLETE: indicates that the original source of the route information is unknown (learned by other methods). BGP sets the origin of the route imported through other IGP protocols as INCOMPLETE

EGP INC

As-path

AS-path attribute of route, which records all AS areas that the route passes. With it, routing loops can be avoided

display bgp routing-table as-path-acl

Syntax
display bgp routing-table as-path-acl acl_number

View All views Parameter


acl_number: Specify matched AS path list number ranging from 1 to 199.

Description Use the display bgp routing-table as-path-acl command to view routes that match an as-path acl Example Display routes that match the as-path-acl 1.
<SW7700>display bgp routing-table as-path-acl 1 Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/Mask Pref Next-Hop Med Local-pref Origin As-path -------------------------------------------------------------------#^ 1.1.1.0/24 256 10.10.10.1 0 IGP 200 #^ 1.1.2.0/24 256 10.10.10.1 0 IGP 200 #^ 1.1.3.0/24 256 10.10.10.1 0 IGP 200 #^ 2.2.3.0/24 256 10.10.10.1 0 INC 200 #^ 4.4.4.0/24 256 10.10.10.1 0 INC 200 #^ 9.9.9.0/24 256 10.10.10.1 0 INC 200 #^ 10.10.10.0/24 256 10.10.10.1 0 IGP 200 #^ 22.1.0.0/16 256 200.1.7.2 100 INC 200 # 88.1.0.0/16 60 0.0.0.0 IGP

Table 24 Information Generated by the display bgp routing-table as-path-acl Command


Field Dest/Mask Pref Description Destination address/Mask Preference

BGP Configuration Commands

241

Table 24 Information Generated by the display bgp routing-table as-path-acl Command


Nexthop Med Local-pref Origin IP address of next hop MULTI_EXIT_DISC attribute value Local preference Origin attribute of route, which indicates that the route updates its origin relative to the route originating it from AS. It has three optional values: IGP The route belongs to inside of AS. BGP treats aggregate route and the route defined by the command network as inside of AS, and origin type as IGP. The route is learned from exterior gateway protocol (EGP). Short for INCOMPLETE: indicates that the original source of the route information is unknown (learned by other methods). BGP sets the origin of the route imported through other IGP protocols as INCOMPLETE

EGP INC

As-path

AS-path attribute of route, which records all AS areas that the route passes. With it, routing loops can be avoided

display bgp routing-table cidr

Syntax
display bgp routing-table cidr

View All views Parameter None Description Use the display bgp routing-table cidr command to view the routing information about the non-natural mask (namely the classless interdomain routing, CIDR). Example
<SW7700>display bgp routing-table cidr Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/Mask Pref Next-Hop Med Local-prefOrigin As-path -------------------------------------------------------------------#^ 22.1.0.0/16 256 200.1.7.2 100 INC 200 # 88.1.0.0/16 60 0.0.0.0 IGP

For detailed description of the output information, see Table 23. display bgp routing-table community Syntax
display bgp routing-table community [ aa:nn | no-export-subconfed | no-advertise | no-export ]* [ whole-match ]

View All views

242

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Parameter
aa:nn: Specify a community number. no-export-subconfed: Do not send matched routes outside AS. no-advertise: Send matched route to no peers. no-export: Do not pass a route through AS but advertise it to other sub ASs. whole-match: Display the exactly matched routes.

Description Use the display bgp routing-table community command to view the routing information related to the specified BGP community number in the routing table. Example Display the routing information matching BGP community number 11:22.
<SW7700>display bgp routing-table community 11:22 Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/Mask Pref Next-Hop Med Local-prefOrigin As-path -------------------------------------------------------------------#^ 1.0.0.0/8 256 172.10.0.2 100 IGP #^ 2.0.0.0/8 256 172.10.0.2 100 IGP

For a detailed description of the output information, see Table 23. display bgp routing-table community-list Syntax
display bgp routing-table community-list community_list_number [ whole-match ]

View All views Parameter


community_list_number: Specify a community-list. whole-match: Display routes that are exact matches.

Description Use the display bgp routing-table community-list command to view the routing information matching the specified BGP community list. Example Display the routing information matching BGP community list 1.
[SW7700]display bgp routing-table community-list 1 Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed

BGP Configuration Commands

243

Destination/MaskPref Next-hop Med Local-PrefOrigin As-Path ------------------------------------------------------------------1.1.1.0/24 256 10.10.10.1 0 IGP 200 1.1.2.0/24 256 10.10.10.1 0 IGP 200 1.1.3.0/24 256 10.10.10.1 0 IGP 200 2.2.3.0/24 256 10.10.10.1 0 INC 200 4.4.4.0/24 256 10.10.10.1 0 INC 200 9.9.9.0/24 256 10.10.10.1 0 INC 200 10.10.10.0/24 0 10.10.10.2 0 IGP 10.10.10.0/24 256 10.10.10.1 0 IGP 200

For detailed description of the output information, see Table 23. display bgp routing-table dampened Syntax
display bgp routing-table dampening

View All views Parameter None Description Use the display bgp routing-table dampened command to view BGP dampened routes. Example View BGP dampened information.
<SW7700>display bgp routing-table dampened Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/Mask Source Damping-limit Origin As-path ----------------------------------------------------------------#D 11.1.0.0/16 133.1.1.2 1:20:00 IGP 200

Table 25 Information Generated by the display bgp routing-table dampened Command


Item Flags Description State flags: # - valid (valid) ^ - best (selected) D - damped (discarded) H - history (history) I - internal (interior gateway protocol) S - aggregate suppressed (suppressed) The valid and damped route The dampened route to the destination network 11.1.0.0 The nexthop of the route The time before dampening turns invalid and the route can be reused. Origin attribute of route, which indicates that the route updates its origin relative to the route originating it from AS. It has three optional values:

#D Dest/Mask Source Damping-limit Origin

244

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Table 25 Information Generated by the display bgp routing-table dampened Command


IGP The route belongs to inside of AS. BGP treats aggregate route and the route defined by the command network as inside of AS, and origin type as IGP. The route is learned from exterior gateway protocol (EGP). Short for INCOMPLETE: indicates that the original source of the route information is unknown (learned by other methods). BGP sets the origin of the route imported through other IGP protocols as INCOMPLETE

EGP INC

As-path

AS-path attribute of route, which records all AS areas that the route passes. With it, routing loops can be avoided

display bgp routing-table different-origin-as

Syntax
display bgp routing-table different-origin-as

View All views Parameter none Description Use the display bgp routing-table different-origin-as command to view routes that have different source autonomous systems Example View the routes that have different source ASs.
<SW7700>display bgp routing-table different-origin-as Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Destination/MaskPref Next-hop Med Local-Pref Origin As-Path -----------------------------------------------------------------10.10.10.0/24 0 10.10.10.2 0 IGP 10.10.10.0/24256 10.10.10.1 0 IGP 200

For detailed description of the output information, see Table 23. display bgp routing-table flap-info Syntax
display bgp routing-table flap-info [ { regular-expression as_regular_expression } | { as-path-acl acl_number } | { network_address [ mask [ longer-match ] ] } ]

View All views Parameter


as_regular_expression: The route flap-info matching AS path regular

expression.

BGP Configuration Commands

245

acl_number: Number of the specified AS path to be matched, ranging 1 to 199. network_address: Network IP address related to the dampening information to

be shown
mask: Network mask. longer-match: Show the route flap-info that is more specific than address, mask.

Description Use the display bgp routing-table flap-info command to view BGP flap-info.

246

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example Display BGP flap-info.


<SW7700>display bgp routing-table flap-info Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/Mask Source Keepup-timeDamping-limitFlap-timesOriginAs-path -------------------------------------------------------------------#D 11.1.0.0/16133.1.1.2 48 1:20:30 4 IGP 200

Table 26 Description of Information Generated by the display bgp routing-table flap-info Command
Item Flags Description State flags: # - valid (valid) ^ - best (selected) D - damped (discarded) H - history (history) I - internal (interior gateway protocol) S - aggregate suppressed (suppressed) The valid and damped route The dampened route to the destination network 11.1.0.0 The nexthop of the route The time that route damping has continued The time before dampening turns invalid and the route can be reused. The times of the route flap Origin attribute of route, which indicates that the route updates its origin relative to the route originating it from AS. It has three optional values: IGP The route belongs to inside of AS. BGP treats aggregate route and the route defined by the command network as inside of AS, and origin type as IGP. The route is learned from exterior gateway protocol (EGP). Short for INCOMPLETE: indicates that the original source of the route information is unknown (learned by other methods). BGP sets the origin of the route imported through other IGP protocols as INCOMPLETE

#D Dest/Mask Source Keepup-time Damping-limit Flap-times Origin

EGP INC

As-path

AS-path attribute of route, which records all AS areas that the route passes. With it, routing loops can be avoided

display bgp routing-table peer

Syntax
display bgp routing-table peer peer_address { advertised | received } [ network-address [ mask ] | statistic ]

View All views Parameter


peer_address: Specifies the peer to be displayed. advertised: Routing information advertised by the specified peer. received: Routing information the specified peer received.

BGP Configuration Commands

247

network-address mask: IP address and address mask of the destination network. statistic: Statistic routing information of the peer.

Description Use the display bgp routing-table peer command to view the routing information the specified BGP peer advertised or received. Example Display the routing information advertised by BGP peer 10.10.10.1.
[SW7700]display bgp routing table peer 10.10.10.1 advertised Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Dest/mask Next-Hop Med Local-pref Origin As-path *>10.10.10.0/24 0.0.0.0 INC

For detailed description of the output information, see Table 23. display bgp routing-table regular-expression Syntax
display bgp routing-table regular-expression as-regular-expression

View All views Parameter


as-regular-expression: Matched AS regular expression.

Description Use the display bgp routing-table regular-expression command to view the routing information matching the specified AS regular expression Example Display the routing information matched with ^200$.
<SW7700>display bgp routing-table regular-expression ^200$ Flags: # - valid, ^ - best, D - damped, H - history, I - internal, S aggregate suppressed Destination/MaskPref Next-hop Med Local-PrefOriginPath -------------------------------------------------------------------1.1.1.0/24 256 10.10.10.1 0 IGP 200 1.1.2.0/24 256 10.10.10.1 0 IGP 200 1.1.3.0/24 256 10.10.10.1 0 IGP 200 2.2.3.0/24 256 10.10.10.1 0 INC 200 4.4.4.0/24 256 10.10.10.1 0 IGP 200 9.9.9.0/24 256 10.10.10.1 0 INC 200 10.10.10.0/24 256 0.10.10.1 0 IGP 200

For detailed description of the output information, see Table 23.

248

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

filter-policy export

Syntax
filter-policy { acl_number | ip-prefix ip_prefix_name } export [ protocol ] undo filter-policy { acl_number | ip-prefix ip_prefix_name } export [ protocol ]

View BGP view Parameter


acl_number: Number of IP access control list. ip_prefix_name: Number of ip prefix list. protocol: Specified protocols advertising routing information which include

direct, ospf, ospf-ase, ospf-nssa, rip and static. Description

Use the filter-policy export command to filter the advertised routes and only the routes passing the filter can be advertised by BGP. Use the undo filter-policy export command to cancel filtering of advertised routes.

By default, filtration of the received routing information is not configured. If the parameter protocol is specified, only the imported route generated by the specified protocol is filtered and the imported routes generated by other protocols are not affected. If the parameter protocol is not specified, the imported route generated by any protocol will be filtered. Example Use acl 3 to filter the routing information advertised by BGP.
[SW7700-bgp]filter-policy 3 export

filter-policy import

Syntax
filter-policy gateway ip_prefix_name import undo filter-policy gateway ip_prefix_name import filter-policy { acl-number | ip-prefix ip_prefix_name } import undo filter-policy { acl-number | ip-prefix ip_prefix_name } import

View BGP view Parameter


acl_number: Number of IP access control list. ip_prefix_name: Number of address prefix list.

BGP Configuration Commands

249

Description

Use the filter-policy gateway import command to filter the learned routing information advertised by the specified address. Use the undo filter-policy gateway import command to cancel the filtration to the routing information advertised by the specified address. Use the filter-policy import command to filter the received global routing information. Use the undo filter-policy import command to remove the filtration to the received global routing information.

By default, filtration to the received routing information is not configured. This command can be used to filter the routes received by BGP and determines whether to add the routes to the BGP routing table. Example Use acl 3 to filter the routing information received by BGP.
[SW7700-bgp]filter-policy 3 import

group

Syntax
group group_name [ internal | external ] undo group group_name

View BGP view Parameter


group-name: Specify the name of the peer group. internal: Specify the type of the peer group as IBGP. external: Specify the type of the peer group as EBGP.

Description

Use the group group_name command to establish a peer group. Use the undo group group_name command to cancel the configured peer group.

The default type of BGP peer group is internal. The external peer group members must be in the same network segment. Otherwise, some EBGP peers may discard the transmitted route update. Example Create a BGP group named test.
[SW7700-bgp]group test

250

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

import-route

Syntax
import-route protocol [ med med_value | route-policy route_policy_name ]* undo import-route protocol

View BGP view Parameter


protocol: Specify source routing protocols which can be imported, which include direct, ospf, ospf-nssa , ospf-ase, rip, isis and static at present. med med_value: Specify the MED value loaded by a redistributes route, ranging from 0 to 4294967295. route-policy route_policy_name: Specify a route-policy.

Description

Use the import-route command to import routes of other protocols. Use the undo import-route command to cancel redistributing routes of other protocols.

By default, BGP does not import routes of other protocols. Example Import routes of RIP.
[SW7700-bgp]import-route rip

ip as-path acl

Syntax
ip as-path acl acl_number { permit | deny } as_regular_expression undo ip as-path acl acl_number

View System view Parameter


acl_number: Number of AS path list ranging from 1 to 199. as_regular_expression: AS regular expression.

Description

Use the ip as-path acl command to configure an AS path regular expression. Use the undo ip as-path acl command to disable the defined regular expression.

The configured AS path list can be used in BGP policy.

BGP Configuration Commands

251

Related commands: peer as-path-acl, display bgp routing-table


as-path-acl.

Example Configure an AS path list.


[SW7700]ip as-path acl 10 permit 200,300

ip community-list

Syntax
ip community-list stand-comm-list-number { permit | deny } [ aa:nn | internet | no-export-subconfed | no-advertise | no-export ] ip community-list ext-comm-list-number { permit | deny } as-regular-expression undo ip community-list { stand-comm-list-number | ext-comm-list-number }

View System view Parameter


stand_comm_list_number: Number of the standard community list ranging from

1 to 99.
ext_comm_list_number: Number of the extended community list ranging from

100 to 199.
permit: Permit those that match conditions to access. deny: Deny those that match conditions to access. aa:nn: Community number. internet: Advertise all routes. no-export-subconfed: Used not to advertise the matched route beyond the

confederation.
no-advertise: Used not to send the matched route to any peer. no-export: Advertise routes to other autonomous sub-systems rather than the

system outside of the autonomous system.


as_regular_expression: Community attribute of the regular expression.

Description

Use the ip community-list command to configure a BGP community list. Use the undo ip community-list command to cancel the configured BGP community list.

The configured community list can be used in BGP policy.

252

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related commands: apply community, display bgp routing-table community-list. Example Define a community attribute list which does not advertise routes with the community attribute beyond the confederation.
[SW7700]ip community-list 6 permit no-export-subconfed

network

Syntax
network ip_address [ address_mask ] [ route-policy route_policy_name ] undo network ip_address [ address_mask ] [ route-policy route-policy-name ]

View BGP view Parameter


ip_address: Network address that BGP advertises. address_mask: Mask of the network address. route_policy_name: Route-policy applied to advertised routes.

Description

Use the network command to configure the network routes advertised by the local BGP. Use the undo network command to cancel the existing configuration.

By default, no networks are sent through BGP Example Advertise routes to network segment 10.0.0.0/16.
[SW7700-bgp]network 10.0.0.1 255.255.0.0

peer advertise-community

Syntax
peer group_name advertise-community undo peer group_name advertise-community

View BGP view Parameter


group_name: Name of peer group.

Description

Use the peer advertise-community command to enable the transmission of the community attribute to a peer group.

BGP Configuration Commands

253

Use the undo peer advertise-community command to cancel the existing configuration.

By default, the community attribute is not transmitted to any peer group. Related commands: if-match community-list, apply community. Example Transmit community attribute to the peer group name test.
[SW7700-bgp]peer test advertise-community

peer allow-as-loop

Syntax
peer { group-name | peer_address } allow-as-loop [ number ] undo peer { group_name | peer_address } allow-as-loop

View BGP view Parameter


group_name: Specify name of the peer group. peer_address: Specify IP address of the peer. number: Specify the repeating times of local AS, ranging from 1 to 10.

Description

Use the peer allow-as-loop command to configure the repeating time of local AS. Use the undo peer allow-as-loop command to remove the repeating time of local AS.

Related commands: display current-configuration, display bgp routing-table peer, display bgp routing-table group Example Specify to configure the repeating times of local AS to 2.
[SW7700-bgp]peer 1.1.1.1 allow-as-loop 2

peer as-number

Syntax
peer group-name as-number as-number undo peer group-name as-number

View BGP view Parameter


group_name: Name of peer group.

254

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

as_number: The AS number of the peer/peer group, the range is 1 to 10.

Description

Use the peer as-number command to configure the AS number of peer group. Use the undo peer as-number command to delete the AS number of peer group.

By default, no AS number of the peer group is configured. Example Specify the peer AS number for the peer test as 100.
[SW7700-bgp]peer test as-number 100

peer as-path-acl export

Syntax
peer group-name as-path-acl acl-number export undo peer group-name as-path-acl acl-number export

View BGP view Parameter


group_name: Specify name of the peer group. acl_number: Specify the filter list number of an AS regular expression. The range

is 1 to 199.
export: For the advertised routes.

Description

Use the peer as-path-acl export command to configure the filtering Policy of BGP advertised routes based on the AS path list. Use the undo peer as-path-acl export command to cancel the existing configuration.

By default, the peer group has no AS path list. This command can only be configured on a peer group. Related commands: peer as-path-acl import. Example Set the AS path ACL of the peer group test.
[SW7700-bgp]peer test as-path-acl 3 export

peer as-path-acl import

Syntax
peer { group-name | peer-address } as-path-acl acl-number import undo peer { group-name | peer-address } as-path-acl acl-number import

BGP Configuration Commands

255

View BGP view Parameter


group-name: Specify name of the peer group. peer-address: Specify IP address of the peer. acl-number: Specify the filter list number of an AS regular expression. The range

is 1 to 199.
import: For the received routes.

Description Using the peer as-path-acl import command, you can configure filtering Policy of BGP received routes based on AS path list. Using the undo peer as-path-acl import command, you can cancel the existing configuration. By default, the peer/peer group has no AS path list. Related commands: peer as-path-acl export Example Set the AS path ACL of the peer group test to filter BGP received routes.
[SW7700-bgp] peer test as-path-acl 3 import

peer connect-interface

Syntax
peer { group_name | peer_address } connect-interface interface_name undo peer { group_name | peer_address } connect-interface interface_name

View BGP view Parameter


group_name: Specified peer group. peer_address: IP address of the peer. interface_name: Interface name.

Description

Use the peer connect-interface command to specify the source interface of a route update packet. Use the undo peer connect-interface command to restore the best source interface.

By default, BGP uses the best source interface.

256

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Usually, BGP uses the optimal route to update the source interface of the packets. However, you can set the mode of the interface to Loopback in order to send route updates even if the interface is not working normally. Example Specify Vlan-interface1 as the source interface of a route update packet.
[SW7700-bgp]peer test connect-interface vlan-interface 1

peer default-route-advertise

Syntax
peer group-name default-route-advertise undo peer group-name default-route-advertise

View BGP view Parameter group-name: Specify name of the peer group. Description

Use the peer default-route-advertise command to configure a peer group to generate a default route for a peer. Use the undo peer default-route-advertise command to cancel the existing configuration.

By default, a peer group does not import the default route. For this command, no default route needs to exist in the routing table. A default route is sent unconditionally to a peer with the next hop as itself. Related command: default-route-advertise. Example Configure a peer group named test to generate a default route.
[SW7700-bgp]peer test default-route-advertise

peer description

Syntax
peer { group_name | peer_address } description description_line undo peer { group_name | peer_address } description

View BGP view Parameter


group_name: Group name. peer_address: Address of the peer.

BGP Configuration Commands

257

description_line: Description information configured, which can be letters or

figures. Description

Use the peer description command to configure the description information of the peer/peer group. Use the undo peer description command to cancel the description information of the peer/peer group.

By default, description information of peers/peer group is not configured. Related commands: display current-configuration, display bgp routing-table peer, display bgp routing-table group. Example Set the description information of the peer whose name is group1 to marlborough1.
[SW7700-bgp]peer group1 description marlborough1

peer ebgp-max-hop

Syntax
peer group-name ebgp-max-hop [ ttl ] undo peer group-name ebgp-max-hop

View BGP view Parameter


group_name: Specify Name of the peer group. ttl: Maximum hop value. The range is 1 to 255. By default, the value is 64.

Description

Use the peer ebgp-max-hop command to allow to establishing EBGP connections with the peers on indirectly connected networks. Use the undo peer ebgp-max-hop command to cancel the existing configuration.

By default, this feature is disabled. Example Allow to establish an EBGP connection with the peer group names test that is indirectly connected.
[SW7700-bgp]peer test ebgp-max-hop

peer enable

Syntax
peer { group_name | peer_address } enable undo peer { group_name | peer_address } enable

258

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

View BGP view Parameter


group_name: Specify the name of the peer group which specifies the entire peer

group.
peer_address: IP address of a peer, which specifies a certain peer.

Description

Use the peer enable command to enable the specified peer/peer group. Use the undo peer enable command to disable the specified peer/peer group.

By default, BGP peer/peer group is enabled. If the specified peer/peer group is disabled, the router will not exchange routing information with the specified peer/peer group. Example Disable the specified peer.
[SW7700]peer 18.10.0.9 group group1 [SW7700-bgp]undo peer 18.10.0.9 enable

peer filter-policy export

Syntax
peer group_name filter-policy acl-number export undo peer group_name filter-policy acl-number export

View BGP view Parameter


group_name: Specify the name of the peer group. peer_address: Specify the IP address of the peer. acl_number: Specify an IP acl number ranging from 1 to 199. export: Egress filter policy.

Description

Use the peer filter-policy export command to configure the filter-policy list of routes advertised by a peer group. Use the undo peer filter-policy export command to cancel the existing configuration.

By default, a peer/peer group has no access control list (acl). Related commands: peer filter-policy import, ip as-path-acl, peer as-path-acl export and peer as-path-acl import.

BGP Configuration Commands

259

Example Set the filter-policy list of a peer group test.


[SW7700-bgp]peer test filter-policy 3 export

peer filter-policy import

Syntax
peer { group-name | peer-address } filter-policy acl-number import undo peer { group-name | peer-address } filter-policy acl-number import

View BGP view Parameter


group-name: Specify the name of the peer group. peer-address: Specify the IP address of the peer. acl-number: Specify an IP acl number, ranging from 1 to 199. import: Ingress filter policy.

Description Using the peer filter-policy import command, you can configure the filter-policy list of the routes received by a peer/peer group. Using the undo peer filter-policy import command, you can cancel the existing configuration. By default, a peer/peer group has no access control list (acl). Related commands: peer filter-policy export, ip as-path-acl, peer as-path-acl export and peer as-path-acl import. Example Set the filter-policy list of a peer group test.
[SW7700-bgp] peer test as-number 100 [SW7700-bgp] peer test filter-policy 3 import

peer group

Syntax
peer peer_address group group_name [ as-number as-number ] undo peer peer_address group

View BGP view Parameter


group_name: Specify the name of the peer group. peer_address: Specify the IP address of the peer.

260

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Description

Use the peer group command to add a peer to the existing peer group. Use the undo peer group command to delete the specified peer.

When adding a peer to a EBGP peer group without an AS number, you should also specify the peers AS number. While adding a peer to a IBGP peer group or to a EBGP peer group with an AS number, you do not need to specify the AS number for the peer Example Add a peer to the peer group TEST.
[SW7700-bgp]group TEST [SW7700-bgp]peer TEST as-number 2004 [SW7700-bgp]peer 10.1.1.1 group TEST

peer ip-prefix export

Syntax
peer group_name ip-prefix prefixname export undo peer group_name ip-prefix prefixname export

View BGP view Parameter


group_name: Name of peer group. prefixname: Name of the specified ip-prefix. export: Apply the filtering policy on the route transmitted to the specified peer/peer group.

Description

Use the peer ip-prefix export command to configure the route filtering policy of routes advertised by the peer group based on the ip-prefix. Use the undo peer ip-prefix export command to cancel the route filtering policy of the peer group based on the ip-prefix.

By default, the route filtering policy of the peer group is not specified. Related command: ip ip-prefix, peer ip-prefix import. Example Configure the route filtering policy of the peer group based on the ip-prefix 1.
[SW7700-bgp]peer group1 ip-prefix list1 export

peer ip-prefix import

Syntax
peer { group-name | peer-address } ip-prefix prefixname import undo peer { group-name | peer-address } ip-prefix prefixname import

BGP Configuration Commands

261

View BGP view Parameter


group-name: Name of peer group. peer-address: IP address of the peer. prefixname: Name of the specified ip-prefix. import: Apply the filtering policy on the route received by the specified peer/peer

group. Description Use the peer ip-prefix import command to configure the route filtering policy of routes received by the peer/peer group based on the ip-prefix. Use the undo peer ip-prefix import command to cancel the route filtering policy of the peer/peer group based on the ip-prefix. By default, the route filtering policy of the peer/peer group is not specified. For the related commands, see ip ip-prefix, peer ip-prefix export. Example Configure the route filtering policy of the peer group based on the ip-prefix 1.
[SW7700-bgp] peer group1 ip-prefix list1 import

peer next-hop-local

Syntax
peer group_name next-hop-local undo peer group_name next-hop-local

View BGP view Parameter


group_name: Specify the name of the peer group.

Description

Use the peer next-hop-local command to perform the process of the next hop in the route that is advertised to the peer group and take the address of itself as the next hop. Use the undo peer next-hop-local command to cancel the existing configuration.

262

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example When BGP distributes the routes to the peer group test, it will take its own address as the next hop.
[SW7700-bgp]peer test next-hop-local

peer password

Syntax
peer { group-name | peer-address } password { cipher | simple } password undo peer { group-name | peer-address } password

View BGP view Parameter


group-name: Name of a peer group. peer-address: IP address of the peer. cipher: Specifies to display passwords in cipher text. simple: Specifies to display passwords in simple text. password: Defines a password, which is a character string of up to 16 characters

if it is in simple text and up to 24 characters if it is in cipher text. Description Use the peer password command to configure an MD5 authentication password. Use the undo peer password command to cancel MD5 authentication. In BGP, no MD5 authentication is performed in setting up TCP connections by default. BGP uses TCP as its transport layer. For the sake of high security, you can configure MD5 authentication password when setting up TCP connection. In other words, BGP MD5 authentication just sets password for TCP connection, but not for authenticating BGP packets. The authentication is implemented by TCP. peer public-as-only Syntax
peer group-name public-as-only undo peer group-name public-as-only

View BGP view Parameter


group_name: Name of a peer group.

BGP Configuration Commands

263

Description

Use the peer public-as-only command to prevent BGP from carrying the AS number when transmitting BGP update packets. Use the undo peer public-as-only command to configure BGP to carry the AS number when transmitting BGP update packets.

By default, a private AS number is carried when transmitting BGP update packets. Generally, BGP transmits BGP update packets with the AS number (either public AS number or private AS number). To enable some outbound routers to ignore the AS number when transmitting update packets, you can configure not to carry the AS number when transmitting BGP update packets. Example Prevent BGP from carrying the private AS number when transmitting BGP update packets to the peer named test.
[SW7700-bgp]peer test public-as-only

peer reflect-client

Syntax
peer group-name reflect-client undo peer group-name reflect-client

View BGP view Parameter


group_name: Name of peer group.

Description

Use the peer reflect-client command to configure a peer/peer group as the route reflector client. Use the undo peer reflect-client command to cancel the existing configuration.

Use the peer reflect-client command to configure a peer group as the route reflector client. Use the undo peer reflect-client command to cancel the existing configuration. This command is only applicable to a peer group. Related commands: reflect between-clients, reflector cluster-id. Example Configure the peer group test as the route reflector client.
[SW7700-bgp]peer test reflect-client

264

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

peer route-policy export

Syntax
peer group-name route-policy route-policy-name export undo peer group-name route-policy route-policy-name export

View BGP view Parameter


group_name: Name of peer group. peer_address: IP address of the peer. route_policy_name: The specified Route-policy.

Description

Use the peer route-policy export command to assign the Route-policy to the routes advertised to the peer group. Use the undo peer route-policy export command to delete the specified Route-policy.

By default, the peer/peer group has no Route-policy association. Related commands: peer route-policy import. Example Apply the Route-policy named test-policy to the route coming from the peer/peer group test.
[SW7700-bgp]peer test route-policy test-policy export

peer route-policy import

Syntax
peer { group-name | peer-address } route-policy route-policy-name import undo peer { group-name | peer-address } route-policy route-policy-name import

View BGP view Parameter


group-name: Name of peer group. peer-address: IP address of the peer. route-policy-name: The specified Route-policy.

Description Use the peer route-policy import command to assign the Route-policy to the route coming from the peer/peer group.

BGP Configuration Commands

265

Use the undo peer route-policy import command to delete the specified Route-policy. By default, the peer/peer group has no Route-policy association. Related command: peer route-policy export. Example Apply the Route-policy named test-policy to the route coming from the peer/peer group test. [SW7700-bgp] peer test route-policy test-policy import peer route-update-interval Syntax
peer group_name route-update-interval seconds undo peer group_name route-update-interval

View BGP view Parameter


group_name: Specify the name of the configured peer group. seconds: The minimum interval of sending BGP update packets. The range is 0 to

600. By default, the advertisement interval is 5 seconds for an internal peer/peer group, and 30 seconds for an external peer/peer group. Description

Use the peer route-update-interval command to configure the interval for the transmission route of a peer group. Use the undo peer route-update-interval command to restore the interval to the default value.

Example Set the interval for route update packet transmission to 10 seconds in the BGP peer group test.
[SW7700-bgp]peer test as-number 100 [SW7700-bgp]peer test route-update-interval 10

peer timer

Syntax
peer { group_name | peer_address } timer keep-alive keepalive_interval hold holdtime-interval } undo peer { group_name | peer_address } timer

View BGP view Parameter


group_name: Name of peer group.

266

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

peer_address: IP address of the peer. keepalive_interval: Keepalive interval to be specified. The range is 1 to 4294967295. By default, its value is 60 seconds. holdtime_interval: Holdtime interval to be specified. The range is 3 to

4294967295. By default, its value is 180 seconds. Description


Use the peer timer command to configure the timers for a peer/peer group. Use the undo peer timer command to restore the timer to the default value.

The timer configured by using this command has a higher priority than the one configured by using the timer command. Example Configure Keepalive and Holdtime intervals of the peer group test.
[SW7700-bgp]peer test timer keep-alive 60 hold 180

preference

Syntax
preference ebgp-value ibgp-value local-value undo preference

View BGP view Parameter


ebgp-value: Set preference value for routes learned from external peers. ibgp-value: Set preference value for routes learned from internal peers. local-value: Set preference value for routes that originate locally.

The ebgp-value, ibgp-value and local-value parameters are in the range of 1 to 256. The default for ebgp-value and ibgp-value is 256. The default for local-value is 130. Description Use preference command to configure BGP preference. Use the undo preference command to restore the default preference. Three types of routes may be involved in BGP: routes learned from external peers, routes learned from internal peers and routes that originate locally. You can set preference values for the three types of route. You can set different BGP preference values for different sub address families. Currently the system supports unicast and multicast address families.

BGP Configuration Commands

267

Example Disable route learning between peers.


[SW7700-bgp]disable preference

reflect between-clients

Syntax
reflect between-clients undo reflect between-clients

View BGP view Parameter none Description

Use the reflect between-clients command to configure the between-client reflection of a route. Use the undo reflect between-clients command to disable this function.

By default, the reflection between clients is enabled. Related commands: reflector cluster-id, peer reflect-client. Example Disable the reflection between clients.
[SW7700-bgp]undo reflect between-clients

reflector cluster-id

Syntax
reflector cluster-id { cluster-id | address } undo reflector cluster-id

View BGP view Parameter


cluster_id: Specify the cluster ID of the route reflector with the range from 1 to

4294967295.
address: Used as the interface address of the route reflectors cluster ID.

Description

Use the reflector cluster-id command to configure the cluster ID of the route reflector. Use the undo reflector cluster-id command to delete the cluster ID of the route reflector.

268

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

By default, each route reflector uses its Router ID as the cluster ID. Related commands: reflect between-clients, peer reflect-client. Example Set the cluster ID of the route reflector to 80.
[SW7700-bgp]reflector cluster-id 80

refresh bgp

Syntax
refresh bgp { all | peer-address | group group-name } { import | export }

View User view Parameter


all: Reset all the connections with BGP. peer-address: Reset connection with a specified BGP peer. group-name: Reset connection with a specified BGP peer group. import: Refresh the routes learned from the peers export: Refresh routes advertised to the peers.

Description Use the refresh bgp peer-address command to refresh general BGP routes. When BGP routing policy changes, associated route information must be re-computed. This command can refresh general BGP routes. Example Refresh all BGP routes. <SW7700>refresh bgp all reset bgp Syntax
reset bgp { all | peer_address [ flap-info ] }

View User view Parameter


peer_address: Reset connection with a specified BGP peer. all: Reset all BGP connections.

BGP Configuration Commands

269

Description

Use the reset bgp peer_address command to reset the connection of BGP with a specified BGP peer. Use the reset bgp all command to reset all the connections with BGP.

Example Reset all the BGP connections to enable the new configuration (after configuring the new Keepalive interval and Holdtime interval using the timer command).
<SW7700>reset bgp all

reset bgp flap-info

Syntax
reset bgp flap-info [ regular-expression as_regular_expression | as-path-acl acl-number | network_address [ mask ] ]

View User view Parameter


regular-expression as_regular_expression: Reset the flap-info matching the

AS path regular expression.


as-path-acl acl_number: Reset the flap-info to be consistent with a specified

filter list. The range of the parameter acl-number is 1 to 199.


network_address: Reset the flap-info of a record at this IP address. mask: Network mask.

Description Use the reset bgp flap-info command to reset the flap-info of a route. Related command: dampening. Example Reset the flap-info of all the routes that go through filter list 10.
<SW7700>reset bgp flap-info as-path-acl 10

reset bgp group

Syntax
reset bgp group group_name

View User view Parameter


group-name: Specify the name of the peer group.

Description Use the reset bgp group command to reset the connections between BGP and all the members of a group.

270

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related command: peer group. Example Reset BGP connections of all members from group1.
<SW7700>reset bgp group group1

reset dampening

Syntax
reset dampening [ network_address [ mask ] ]

View User view Parameter


network_address: Network IP address related to the clearing attenuation

information.
mask: Network mask.

Description Use the reset dampening command to reset the attenuation information of a route and release the suppression of a suppressed route. Related commands: dampening, display bgp routing-table dampened. Example Reset the route attenuation information of the specified route.
<SW7700>reset dampening 20.1.0.0 255.255.0.0

summary automatic

Syntax
summary automatic undo summary automatic

View BGP view Parameter none Description

Use the summary automatic command to configure auto aggregation of sub-network routes. Use the undo summary automatic command to disable auto aggregation of sub-network routes.

By default, no auto aggregation of sub-network routes is executed.

BGP Configuration Commands

271

After the summary automatic is configured, BGP cannot receive the sub-network routes imported from the IGP, so the amount of the routing information can be reduced. Example Set the auto aggregation of the sub-network routes.
[SW7700-bgp]summary automatic

timer

Syntax
timer keep-alive keepalive_interval hold holdtime_interval undo timer

View BGP view Parameter


keepalive_interval: Set the interval time value for keepalive time. By default,

its value is 60 seconds.


holdtime_interval: Set the interval time value for hold time. By default, its

value is 180 seconds. Description

Use the timer command to configure the Keep-alive and Hold-time timer of BGP. Use the undo timer command to restore the default value of the Keep-alive and Hold-time of the timer.

Example Set the Keep-alive timer to 30 seconds and the Hold-time timer to 90 seconds.
[SW7700-bgp]timer keep-alive 30 hold 90

undo synchronization

Syntax
undo synchronization

View BGP view Parameter None Description Use the undo synchronization command to cancel the synchronization of BGP and IGP. By default, BGP doesnt synchronize with IGP.

272

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

This command means BGP does not synchronize with IGP in the current system. You do not need to configure it for the Switch 7700. Example Cancel the synchronization of BGP and IGP.
[SW7700-bgp]undo synchronization

IP Routing Policy Configuration Commands

This section describes the commands you can use to configure IP Routing Policy. These commands operate across all routing protocols. When the Switch 7700 runs a routing protocol, it is able to perform the functions of a router. The term router in this section can refer either to a physical router or to the Switch 7700 running a routing protocol.

apply as-path

Syntax
apply as-path as_number_1 [ as_number_2 [ as_number_3 ... ] ] undo apply as-path

View Route policy view Parameter


as_number_1... as_number_n: AS number to be added.

Description

Use the apply as-path command to configure AS number to be added in front of the original AS path in Route-policy. Use the undo apply as-path command to cancel the AS sequence number added in front of the original AS path.

By default, no AS number is set. If the match condition of Route-policy is matched, the AS attribute of the transmitting route will be changed. Example
[SW7700-route-policy]apply as-path 200

apply community

Syntax
apply community { { { aa:nn | no-export-sunconfed | no-export | no-advertise } [ additive ] } | additive | none } undo apply community

View Route policy view

IP Routing Policy Configuration Commands

273

Parameter
aa:nn: Community number. no-export-subconfed: The matched route is not sent outside the AS. no-advertise: The matched route is not sent to any peer. no-export: The route is not passed through the AS but is advertised to other sub

ASs.
additive: Additional known community attribute. none: Deleted route community attribute.

Description

Use the apply community command to configure the set BGP community attribute of Route-policy. Use the undo apply community command to cancel the set BGP community attribute.

By default, BGP community attribute is not set. Related commands: ip community-list, if-match community-list, route-policy, display bgp routing-table community. Example Configure one Route-policy apply community, whose node serial number is 16 and match mode is permit, and enter Route policy view to set the match conditions and attribute modifications to be executed.
[SW7700]route-policy applycommunity permit node 16 [SW7700-route-policy]if-match as-path 8 [SW7700-route-policy]apply community no-export

apply cost

Syntax
apply cost value undo apply cost

View Route policy view Parameter


value: Specify the route cost value of route information.

Description

Use the apply cost command to configure the route cost value of route information. This command is one of the apply sub-statements of the Route-policy attribute set. Use the undo apply cost command to cancel the apply sub-statement.

274

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply local-preference, apply origin and apply tag. Example Define one apply sub-statement. When it is used for setting route information attribute, it sets the route metric value of route information to 120.
[SW7700-route-policy]apply cost 120

apply cost-type

Syntax
apply cost-type [ internal | external ] undo apply cost-type

View Route policy View Parameter


internal: Use the cost type of IGP as MED value of BGP to advertise route to

EBGP peer.
external: external cost type of IS-IS.

Description

Use the apply cost-type command to configure the route cost type of route information. This command is one of the apply sub-statements of the Route-policy attribute set. Use the undo apply cost-type command to cancel the apply sub-statement.

By default, route cost type is not set. Example Set the cost type of IGP as MED value of BGP to advertise route to EBGP peer.
[SW7700-route-policy]apply cost-type internal

apply ip next-hop

Syntax
apply ip next-hop ip_address undo apply ip next-hop

View Route policy view Parameter


ip_address: The next-hop address. A maximum of two next-hop addresses can

be specified.

IP Routing Policy Configuration Commands

275

Description

Use the apply ip next-hop command to configure the next hop address of route information. This command is one of the apply sub-statements of the Route-policy attribute set. Use the undo apply ip next-hop command to cancel the apply sub-statement.

By default, no apply sub-statement is defined. Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply local-preference, apply cost, apply origin and apply tag. Example Set the next hop address of route information as 193.1.1.8 when it is used for setting route information attribute.
[SW7700-route-policy]apply ip next-hop 193.1.1.8

apply isis

Syntax
apply isis [ level-1 | level-2 | level-1-2 ] undo apply isis

View Route policy view Parameter


level-1: Set to import the matched route to Level-1 area. level-2: Set to import the matched route to Level-2 area. level-1-2: Set to import the matched route to both Level-1 and Level-2 area.

Description

Use the apply isis command to apply the level of a matched route that is imported to Level-1, Level-2 or Level-1-2. Use the undo apply isis command to cancel the apply sub-statement.

By default, no apply clause is defined. Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply cost, apply origin, apply tag. Example Define a set clause to import the route to level-2.
[SW7700-route-policy]apply isis level-2

apply local-preference

Syntax
apply local-preference local-preference

276

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

undo apply local-preference

View Route policy view Parameter


local_preference: New set local preference.

Description

Use the apply local-preference command to configure to apply the local preference of route information. This command is one of the apply sub-statements of the Route-policy attribute set. Use the undo apply local-preference command to cancel the apply sub-statement.

Related command: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply local-preference, apply origin and apply tag. Example Apply the local preference level of route information as 130 when this apply sub-statement is used for setting route information attribute.
[SW7700-route-policy]apply local-preference 130

apply origin

Syntax
apply origin { igp | egp as_number | incomplete } undo apply origin

View Route policy view Parameter


igp: Set the BGP route information source as internal route egp: Set the BGP route information source as external route as_number: Specifies AS number of external route. incomplete: Setting the BGP route information source as unknown source.

Description

Use the apply origin command to configure to apply the route source. This command is one of the apply sub-statements of the Route-policy attribute set. Use the undo apply origin command to cancel the apply sub-statement.

Related command: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply local-preference, apply cost and apply tag.

IP Routing Policy Configuration Commands

277

Example Define one apply sub-statement. When it is used for setting route information attribute, it sets the route source of BGP route information as igp.
[SW7700-route-policy]apply origin igp

apply tag

Syntax
apply tag value undo apply tag

View Route policy view Parameter


value: Specifies the tag value of route information.

Description

Use the apply tag command to configure to set the tag area of OSPF route information. This command is one of the apply sub-statements of the Route-policy attribute set. Use the undo apply tag command to cancel the apply sub-statement.

Related command: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply local-preference, apply cost and apply origin. Example Define one apply sub-statement. When it is used for setting route information attribute, it sets the tag area of route information to 100.
[SW7700-route-policy]apply tag 100

display ip ip-prefix

Syntax
display ip ip-prefix [ ip-prefix-name ]

View All views Parameter


ip_prefix_name: Specifies displayed address prefix list name.

Description Use the display ip ip-prefix command to view the address prefix list. Related command: ip ip-prefix.

278

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Example Display the information of the address prefix list named to p1.
<SW7700>display ip ip-prefix p1 ip-prefix p1 index 10: permit 192.168.10.10/16 greater-equal 17 less-equal 18

display route-policy

Syntax
display route-policy [ route-policy-name ]

View All views Parameter


route_policy_name: Specifies displayed Route-policy name.

Description Use the display route-policy command to view the configured Route-policy Related command: route-policy. Example Display the information of Route-policy named as policy1.
<SW7700>display route-policy policy1 Route-policy : policy1 Permit 10 : if-match (prefixlist) p1 apply cost 100 matched : 0 denied : 0

filter-policy export

Syntax
filter-policy { acl_number | ip-prefix ip_prefix_name protocol ] } export [

undo filter-policy { acl_number | ip-prefix ip_prefix_name } export [ protocol ]

View Routing protocol view Parameter


acl_number: Number of the access control list used for matching the destination

address field of the routing information.


ip_prefix_name: Address prefix list used for matching the routing information destination address field. protocol: The routing information of which kind of route protocol to be filtered.

IP Routing Policy Configuration Commands

279

Description

Use the filter-policy export command to configure to set the filtering conditions of the routing information advertised by a certain type of routing protocols. Use the undo filter-policy export command to cancel the filtering conditions set.

By default, the advertised routing information is not filtered. It may be necessary that only the routing information that meets special conditions can be advertised. Then, the filter-policy command can be used to set the filtering conditions for the advertised routing information. Only the routing information passing the filter can be advertised. Related command: filter-policy import. Example Define the filtering rules for advertising the routing information of RIP. Only the routing information passing the filtering of address prefix list p1 will be advertised by RIP.
[SW7700-rip]filter-policy ip-prefix p1 export

filter-policy import

Syntax
filter-policy { acl_number | ip-prefix ip-prefix-name | gateway ipprefix-name }* import undo filter-policy { acl_number | ip-prefix ip-prefix-name | gateway ip-prefix-name }* import

View Routing protocol view Parameter


acl_number: The access control list number used for matching the destination address field of the routing information. ip-prefix ip_prefix_name: The prefix address list name. Its matching object is the destination address field of the routing information. gateway ip_prefix_name: The prefix address list name of the neighbor router

address. Its matching object is the routing information advertised by the specified neighbor router. Description

Use the filter-policy gateway import command to filter the received routing information advertised by a specified router. Use the undo filter-policy gateway import command to cancel the setting of the filtering condition. Use the filter-policy import command to set the condition for filtering the routing information.

280

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Use the undo filter-policy import command to cancel the setting of filter condition

By default, the received routing information is not filtered. It may be necessary that only the routing information that meets special conditions can be received. Then, the filter-policy command can be used to set the filtering conditions for the received routing information. Only the routing information passing the filtration can be received. Related command: filter-policy export. Example Define the filtering rule for receiving routing information of RIP. Only the routing information filtered through the address prefix list p1 can be received by RIP.
[SW7700-rip]filter-policy ip-prefix p1 import

if-match

Syntax
if-match { acl acl_number | ip-prefix ip-prefix-name } undo if-match [ acl | ip-prefix ]

View Route policy view Parameter


acl_number: Specify the number of the access control list used for filtration ip_prefix_name: Specify the prefix address list used for filtration

Description

Use the if-match { acl | ip-prefix } command to configure the IP address range to match the Route-policy. Use the undo if-match { acl | ip-prefix } command to cancel the setting of the match rule.

Filtration is performed by quoting an ACL or a prefix address list. Related command: if-match interface, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply cost, apply local-preference, apply origin and apply tag. Example Define one if-match sub-statement. When the sub-statement is used for filtering route information, the route information filtered by the route destination address through address prefix list p1 can pass the if-match sub-statement.
[SW7700-route-policy]if-match ip-prefix p1

if-match as-path

Syntax
if-match as-path acl_number

IP Routing Policy Configuration Commands

281

undo if-match as-path

View Route policy view Parameter


acl_number: AS path list number, ranging from 1 to 199.

Description

Use the if-match as-path command to configure the matched AS path list number of Route-policy. Use the undo if-match as-path command to delete the matched path list number.

By default, AS path list number is not matched. Example An as-path, numbered 2, is defined first which allows the routing information of AS 100 and 200. Then the route-policy named test is defined. The node No.10 of this route-policy defines an if-match sub-statement, which quotes the definition of as-path.
[SW7700]ip as-path acl 2 permit 100:200 [SW7700]route-policy test permit node 10 [SW7700-route-policy]if-match as-path 2

if-match community

Syntax
if-match community { standard-community-number [ whole-match ] | extended_community_number } undo if-match community

View Route policy view Parameter


standard_community_list_number: Standard community list number, ranging

from 1 to 99.
extended_community_list_number: Extended community list number, ranging

from 100 to 199.


whole-match: Fully matching.

Description

Use the if-match community command to configure the community list number to be matched in the Route-policy. Use the undo if-match community command to cancel the configuration of the matched community list number.

282

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

One of the if-match sub-statements of route-policy is used to filter BGP routing information. The if-match condition is specified according to the community attributes of the routing information. Related command: route-policy, ip community-list. Example A community-list numbered as 1 is defined first, allowing the autonomous system number to contain the routing information of 100 and 200. Then, the route-policy named test is defined. The node No.10 of the route-policy defines a match sub-statement, which quotes the definition of the community-list.
[SW7700]ip community-list 1 permit 100:200 [SW7700]route-policy test permit node 10 [SW7700-route-policy]if-match community 1

if-match cost

Syntax
if-match cost value undo if-match cost

View Route policy view Parameter


value: Specifies the required route metric value, ranging from 0 to 4294967295.

Description

Use the if-match cost command to configure one of the match rules of route-policy to match the cost of the routing information. Use the undo if-match cost command to cancel the configuration of the match rule.

By default, no match sub-statement is defined. Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match tag, route-policy, apply ip next-hop, apply local-preference, apply cost, apply origin, apply tag. Example A match sub-statement is defined, which allows the routing information with routing cost 8 to pass this match sub-statement.
[SW7700-route-policy]if-match cost 8

if-match interface

Syntax
if-match interface { interface_name | interface_type interface_number } undo if-match interface

IP Routing Policy Configuration Commands

283

View Route policy view Parameter


interface_type: Specify interface type. interface_number: Specify interface number. interface_name: Specify interface name.

Description

Use the if-match interface command to match the route whose next hop is the designated interface. Use the undo if-match interface command to cancel the setting of matching condition.

By default, no match sub-statement is defined. Related command: if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, route-policy, apply ip next-hop, apply cost, apply local-preference, apply origin, apply tag. Example Define one match sub-statement to match the route whose next hop interface is Vlan-interface 1.
[SW7700-route-policy]if-match interface Vlan-interface 1

if-match ip next-hop

Syntax
if-match ip next-hop { acl acl_number | ip-prefix ip_prefix_name } undo if-match ip next-hop [ ip-prefix ]

View Route policy view Parameter


acl_number: Specify the number of the access control list used for filtration. The range is 1 to 99. ip_prefix_name: Specify the name of the prefix address list used for filtration.

Description

Use the if-match ip next-hop command to configure one of the match rules of route-policy on the next hop address of the routing information. Use the undo if-match ip next-hop command to cancel the setting of the ACL matching condition. Use the undo if-match ip next-hop ip-prefix command to cancel the setting of the address prefix list matching condition.

Filtration is performed by quoting an ACL or a address prefix list.

284

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match cost, if-match tag, route-policy, apply ip next-hop, apply cost, apply local-preference, apply origin, apply tag. Example Define a match sub-statement. It permits the routing information, whose route next hop address passes the filtration of the prefix address list p1, to pass this match sub-statement.
[SW7700-route-policy]if-match ip next-hop ip-prefix p1

if-match tag

Syntax
if-match tag value undo if-match tag

View Route policy view Parameter


value: Specify the value in tag field of OSPF route information.

Description

Use the if-match tag command to match the tag field of OSPF route information. Use the undo if-match tag command to cancel the existing matching rules.

Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, route-policy, apply ip next-hop, apply cost, apply local-preference, apply origin, apply tag. Example Define one match sub-statement and enable the OSPF route information whose value of tag is 8 to pass the match sub-statement.
[SW7700-route-policy]if-match tag 8

ip ip-prefix

Syntax
ip ip-prefix ip-prefix-name [ index index_number ] { permit | deny } network-len [ greater-equal greater-equal | less-equal less_equal ] undo ip ip-prefix ip-prefix-name [ index index-number | permit | deny ]

View System view Parameter


ip_prefix_name: The specified address prefix list name. It identifies one address

prefix list uniquely.

IP Routing Policy Configuration Commands

285

index_number: Identify an item in the prefix address list. The item with smaller

index-number will be tested first.


permit: Specify the match mode of the defined address prefix list items as permit

mode.
deny: Specify the match mode of the defined address prefix list items as deny

mode.
network: The IP address prefix range (IP address). If it is 0.0.0.0 0, all the IP addresses are matched. len: The IP address prefix range (mask length). If it is 0.0.0.0 0, all the IP addresses

are matched.
greater_equal, less_equal: The address prefix range [greater-equal, less-equal] to be matched after the address prefix network len has been matched. The meaning of greater-equal is larger than or equal to , and the meaning of less-equal is less than or equal to. The range is len <= greater-equal <= less-equal <= 32. When only greater-equal is used, it denotes the prefix range [greater-equal, 32]. When only less-equal is used, it denotes the prefix range [len, less-equal].

Description

Use the ip ip-prefix command to configure an address prefix list or one of its items. Use the undo ip ip-prefix command to delete an address prefix list or one of its items.

By default, theres no address prefix list. The address prefix list is used for IP address filtering. An address prefix list may contain several items, and each item specifies one address prefix range. The inter-item filtering relation is Boolean OR, so an item must pass the filtering of this address prefix list. Not passing the filtering of any item means not passing the filtration of this prefix address list. The address prefix range may contain two parts, which are determined by len and [greater-equal, less-equal] respectively. If the prefix ranges of these two parts are both specified, the IP to be filtered must match the prefix ranges of these two parts. If you specify network len as 0.0.0.0 0, it only matches the default route. Example The prefix address list of this address indicates to match the bits 1 to 8 and the bits 17 to 18 for filtering the IP address with the bits 1 to 8 and the bits 17 to 18 of the specified IP network segment 10.0.192.0.
[SW7700]ip ip-prefix p1 permit 10.0.192.0 8 greater-equal 17 less-equal 18

286

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

route-policy

Syntax
route-policy route-policy-name { permit | deny } node { node-number } undo route-policy route-policy-name [ permit | deny | node node-number ]

View System view Parameter


route_policy_name: Specifies the Route-policy name to identify one Route-policy

uniquely.
permit: Specify the match mode of the defined Route-policy node as permit

mode.
deny: Specifies the match mode of the defined Route-policy node as deny mode. node: Node of the route policy. node_number: Index of the node in the route-policy. When this route-policy is

used for routing information filtration, the node with smaller node-number will be tested first. Description

Use the route-policy command to create and enter the Route-policy view. Use the undo route-policy command to delete the established Route-policy.

By default, no Route-policy is defined. The route-policy command is used for route information filtration or route policy. One Route-policy comprises some nodes and each node comprises some match and apply sub-statements. The match sub-statement defines the match rules of this node and the apply sub-statement defines the actions after passing the filtration of this node. The filtering relationship between the match sub-statements of the node is and, that is, all match sub-statements that meet the node. The filtering relation between route-policy nodes is Boolean OR, so to pass the filtering, a node must pass the filtering of this Route-policy. If the information does not pass the filtering of any nodes, it cannot pass the filtering of this route-policy. Related commands: if-match interface, if-match acl, if-match ip-prefix, if-match ip next-hop, if-match cost, if-match tag, apply ip next-hop, apply local-preference, apply cost, apply origin, apply tag. Example Configured one Route-policy policy1, whose node number is 10 and if-match mode is permit, and enter Route policy view.
[SW7700]route-policy policy1 permit node 10 [SW7700-route-policy]

Route Capacity Configuration Commands

287

Route Capacity Configuration Commands


display memory limit

This section describes the commands you can use to configure route capacity on the Switch 7700.

Syntax
display memory limit

Mode All views Parameter None Description Use the display memory limit command to display the memory setting and state information related to the Ethernet switch capacity, including available memory and state information about connections, such as times for disconnecting connections, times for reestablishing connections, and the current state of the system. Example Display the current memory setting and state information.
<SW7700>display memory limit Current memory limit configuration information: system memory safety: 4 system memory limit: 2 auto-establish enabled Free Memory: 17781708 (Byte) The state information about connection: The times of disconnect: 0 The times of reconnect: 0 The current state: Normal

The displayed information is defined in Table 27.


Table 27 Description of Information Displayed by the display memory limit Command
Item system memory safety:4 system memory limit: 2 auto-establish enabled Description The safety value of the Ethernet switch memory is 4Mbytes The lower limit of the Ethernet switch memory is 2Mbytes. The system allows recovering the connection automatically. If automatic recovery is disabled, the auto-establish disabled message is displayed.) The size of the current idle memory is 17781708 bytes, that is, 17,782Mbytes. The times of the connection disconnecting of the Ethernet switch is 0. The times of the connection reestablishment of the Ethernet switch is 0.

Free Memory: 17781708 (Byte) The times of disconnect: 0 The times of reconnect: 0

288

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Table 27 Description of Information Displayed by the display memory limit Command


The current state: Normal The current state is normal.

memory auto-establish disable

Syntax
memory auto-establish disable

View System view Parameter None Description Use the memory auto-establish disable command to disable the routing protocol connection that is forcibly disconnected to recover automatically when the idle memory of the Ethernet switch reaches this value. Thus, connections of all the routing protocols will not recover when the idle memory of the Ethernet switch recovers to a safety value. In this case, you need to restart the routing protocol to recover the connections. By default, when the idle memory of the Ethernet switch recovers to a safety value, connections of all the routing protocols will always recover (when the idle memory of the Ethernet switch reduces to a lower limit, the connection will be disconnected forcibly). Use this command cautiously. Related commands: memory auto-establish enable, memory { safety | limit }, display memory limit. Example Disable memory resume of the current Ethernet switch and recover connections of all the protocols automatically.
[SW7700]memory auto-establish disable

memory auto-establish enable

Syntax
memory auto-establish enable

View System view Parameter None Description Use the memory auto-establish enable command to allow the routing protocol connection that is forcibly disconnected to recover automatically when the idle memory of the Ethernet switch reaches this value.

Route Capacity Configuration Commands

289

By default, when the idle memory of the Ethernet switch recovers to a safety value, connections of all the routing protocols will always recover (when the idle memory of the Ethernet switch reduces to a lower limit, the connection will be disconnected forcibly). Related commands: memory auto-establish disable, memory { safety | limit }, display memory limit. Example Enable memory resume of the current Ethernet switch and recover connections of all the protocols automatically.
[SW7700]memory auto-establish enable

memory

Syntax
memory { safety safety-value | limit limit-value }* undo memory [ safety | limit ]

View System view Parameter


safety safety_value: The safety value of the Ethernet switch idle memory, in Mbytes. Its value range depends on the idle memory of the active Ethernet switch. The default value is 4Mbytes. limit limit_value: The lower limit of the Ethernet switch idle memory, in

Mbytes. Its value range depends on the idle memory of the active Ethernet switch. The default value is 2Mbytes.
default: Set the safety value and lower limit of the Ethernet switch idle memory

to the default value. Description

Use the memory limit limit_value command to configure the lower limit of the Ethernet switch idle memory. When the idle memory of the Ethernet switch is less than this limit, all the routing protocol connections will be disconnected forcibly. The limit_value in the command must be less than the current idle memory safety value or the configuration will fail. Use the memory safety safety_value command to configure the safety value of the Ethernet switch idle memory. If you use the memory auto-establish enable command (the default configuration), the routing protocol connection that is forcibly disconnected will automatically recover when the idle memory of the Ethernet switch reaches this value. The safety_value in the command must be more than the current idle memory lower limit or the configuration will fail. Use the memory safety safety_value limit limit_value command to change both of the safety value and lower limit of the Ethernet switch idle memory. The safety_value must be more than the limit_value or the configuration will fail.

290

CHAPTER 5: USING ROUTING PROTOCOL COMMANDS

Use the memory default command to configure the safety value and the lower limit of the Ethernet switch idle memory to the default configuration.

Related commands: memory auto-establish disable, memory auto-establish enable, display memory limit. Example Set the lower limit of the Ethernet switch idle memory to 1Mbytes and the safety value to 3Mbytes.
[SW7700]memory safety 3 limit 1

USING MULTICAST PROTOCOL COMMANDS

This chapter describes how to use the following commands: GMRP Configuration Commands

debugging gmrp display gmrp statistics display gmrp status gmrp

IGMP Snooping Configuration Commands


display igmp-snooping configuration display igmp-snooping group display igmp-snooping statistics igmp-snooping igmp-snooping host-aging-time igmp-snooping max-response-time igmp-snooping router-aging-time reset igmp-snooping statistics

Multicast Common Configuration Commands


debugging multicast forwarding debugging multicast kernel-routing debugging multicast status-forwarding display multicast forwarding-table display multicast routing-table multicast route-limit multicast routing-enable reset multicast forwarding-table reset multicast routing-table

IGMP Configuration Commands


debugging igmp display igmp group display igmp interface igmp enable

292

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

igmp group-limit igmp group-policy igmp host-join igmp lastmember-query interval igmp max-response-time igmp robust-count igmp timer other-querier-present igmp timer query igmp version reset igmp group

PIM Configuration Commands


bsr-policy c-bsr c-rp debugging pim common debugging pim dm debugging pim sm display pim bsr display pim interface display pim neighbor display pim routing-table display pim rp-info pim pim bsr-boundary pim dm pim sm pim timer hello reset pim neighbor reset pim routing-table source-policy static-rp

GMRP Configuration Commands


debugging gmrp

This section describes how to use the Group Multicast Registration Protocol (GMRP) configuration commands on your Switch 7700.

Syntax
debugging gmrp { event | packet }

GMRP Configuration Commands

293

undo debugging gmrp { event | packet }

View User view Parameter


event: GMRP event. packet: GMRP packet.

Description

Use the debugging gmrp command to enable GMRP debugging. Use the undo debugging gmrp to disable GMRP debugging.

Example Enable GMRP packet debugging.


<SW7700>debugging gmrp packet GMRP: Max number of GMRP entries reached

Table 28 Description of information generated by the command debugging gmrp


event Field GMRP: Max number of GMRP entries reached Description Maximum number of entries reached for GMRP local database

display gmrp statistics

Syntax
display gmrp statistics [ interface interface-list ]

View All views Parameter


interface interface-list: Specifies Ethernet port list, expressed as interface-list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ]}&<1-10>. For meanings and value ranges of interface-type, interface-number and interface-name, refer to the syntax description in Using Port Commands on

page 49. Description Use the display gmrp statistics command to display the statistics information about GMRP. This command is used for displaying the statistics information about GMRP, including the list of ports with GMRP enabled, GMRP status information, GMRP failed registrations and last origin of GMRP packet data unit (PDU). Example Display the statistics information about GMRP on Ethernet 1/0/1.
<SW7700>display gmrp statistics interface Ethernet 1/0/1

294

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

GMRP Gmrp Gmrp Gmrp

statistics on port Ethernet1/0/1 Status : Enabled Failed Registrations: 0 Last Pdu Origin : 0000-0000-0000

display gmrp status

Syntax
display gmrp status

View All views Parameter None Description Use the display gmrp status command to display the status of global GMRP. This command can be used for displaying the enabled/disabled status of global GMRP. Example Display the status of global GMRP.
<SW7700>display gmrp status GMRP is enabled

Table 29 Global GMRP status information


Field GMRP is enabled Description GMRP is enabled globally.

gmrp

Syntax
gmrp undo gmrp

View System view/Ethernet port view Parameter None Description


Use the gmrp command to enable global GMRP or enable GMRP on a port. Use the undo gmrp command to set the GMRP back to the default setting, namely disabled.

By default, GMRP is disabled Executed in system view, this command will enable the global GMRP. After performing this command in Ethernet port view, GMRP will be enabled on a port.

IGMP Snooping Configuration Commands

295

Before enabling GMRP on a port, you shall enable GMRP globally. Related commands: display gmrp status, display gmrp statistics. Example Enable GMRP globally.
[SW7700]gmrp

IGMP Snooping Configuration Commands


display igmp-snooping configuration

This section describes how to use the Internet Group Management Protocol (IGMP) configuration commands on your Switch 7700.

Syntax
display igmp-snooping configuration

View All views Parameter None Description Use the display igmp-snooping configuration command to view the IGMP Snooping configuration information. This command is used to display the IGMP Snooping configuration information of the switch. The information displayed includes whether IGMP Snooping is enabled, router port timeout, maximum response timeout of a query and the member port timeout. Related command: igmp-snooping. Example Display the IGMP Snooping configuration information of the switch.
<SW7700>display igmp-snooping configuration Enable IGMP-Snooping. The router port timeout is 300 second(s). The max response timeout is 50 second(s). The member port timeout is 500 second(s).

The information above tells us that: IGMP Snooping is enabled; the router port timer is set to be 300 seconds; the max response timer is set to be 50 seconds; the aging timer of multicast group member is set to be 500 seconds. display igmp-snooping group Syntax
display igmp-snooping group [ vlan vlanid ]

View All views

296

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Parameter
vlan vlanid: Specifies the VLAN where the multicast group to be viewed is

located. When the parameter is omitted, the command will display the information about all the multicast groups on the VLAN. Description Use the display igmp-snooping group command to view the IP multicast groups and MAC multicast groups under VLAN. This command displays the IP multicast group and MAC multicast group information of a VLAN or all the VLAN where the Ethernet switch is located. It displays the information such as VLAN ID, router port, IP multicast group address, member ports in the IP multicast group, MAC multicast group, MAC multicast group address, and the member ports in the MAC multicast group. Example Display the multicast group information about VLAN2.
<SW7700>display igmp-snooping group vlan 2 ***************Multicast group table*************** Vlan(id):2. Router port(s):Ethernet1/0/1 IP group(s):the following ip group(s) match to one mac group. IP group address:230.45.45.1 Member port(s):Ethernet1/0/12 MAC group(s): MAC group address:01-00-5e-2d-2d-01 Member port(s):Ethernet1/0/12

We can know from the information listed above that :


There is a multicast group in VLAN 2; The router port is Ethernet 1/0/1; The address of the multicast group is 230.45.45.1; The member of the IP multicast group is Ethernet 1/0/12; MAC multicast group is 0100-5e2d-2d01; The member of the MAC multicast group is Ethernet 1/0/12

display igmp-snooping statistics

Syntax
display igmp-snooping statistics

View All views Parameter None Description Use the display igmp-snooping statistics command to view the statistics information on IGMP Snooping.

IGMP Snooping Configuration Commands

297

This command displays the statistics information about IGMP Snooping of Ethernet switch. It displays the information such as number of received general IGMP query packets, received IGMP specific query packets, received IGMP Version 1 and Version 2 report packets, received IGMP leave packets and error packets, and sent IGMP specific query packets. Related command: igmp-snooping. Example Display statistics information about IGMP Snooping.
<SW7700>display igmp-snooping statistics Received IGMP general query packet(s) number:0. Received IGMP specific query packet(s) number:0. Received IGMP V1 report packet(s) number:0. Received IGMP V2 report packet(s) number:0. Received IGMP leave packet(s) number:0. Received error IGMP packet(s) number:0. Sent IGMP specific query packet(s) number:0.

igmp-snooping

Syntax
igmp-snooping { enable | disable } undo igmp-snooping

View System, then VLAN view Parameter


enable: Enable IGMP Snooping. disable: Disables IGMP Snooping; By default, the switch disables IGMP Snooping

feature. Description

Use the igmp-snooping command to enable/disable IGMP Snooping. To enable IGMP snooping, you must execute the igmp-snooping enable command in system view, then execute it again in vlan view. Use the undo igmp-snooping command to restore the default setting.

This command is used to enable or disable IGMP Snooping on the switch. Example Enable IGMP Snooping.
[SW7700]igmp-snooping enable

igmp-snooping host-aging-time

Syntax
igmp-snooping host-aging-time seconds undo igmp-snooping host-aging-time

298

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

View System view Parameter


seconds: Specifies the port aging time of the multicast group member, ranging

from 200 to 1000 and measured in seconds; By default, 260. Description

Use the igmp-snooping host-aging-time command to configure the port aging time of the multicast group members. Use the undo igmp-snooping host-aging-time command to restore the default value.

This command sets the aging time of the multicast group member so that the refresh frequency can be controlled. When the group members change frequently, the aging time should be comparatively short, and vice versa. Related command: igmp-snooping. Example Set the aging time to 300 seconds.
[SW7700]igmp-snooping host-aging-time 300

igmp-snooping max-response-time

Syntax
igmp-snooping max-response-time seconds undo igmp-snooping max-response-time

View System view Parameter


seconds: Maximum response time for a query ranging from 1 to 25 and measured in seconds; By default, 10.

Description

Use the igmp-snooping max-response-time command to configure the maximum response time for a query. Use the undo igmp-snooping max-response-time command to restore the default value.

The set maximum response time decides the time limit for the switch to respond to IGMP Snooping general query packets. Related commands: igmp-snooping, igmp-snooping router-aging-time. Example Configure to respond the IGMP Snooping packet within 50s.
[SW7700]igmp-snooping max-response-time 50

IGMP Snooping Configuration Commands

299

igmp-snooping router-aging-time

Syntax
igmp-snooping router-aging-time seconds undo igmp-snooping router-aging-time

View System view Parameter


seconds: Specifies the router port aging time, ranging from 1 to 1000 measured in seconds; By default, 105.

Description

Use the igmp-snooping router-aging-time command to configure the router port aging time of IGMP Snooping. Use the undo igmp-snooping router-aging-time command to restore the default value.

The port here refers to the Ethernet switch port connected to the router. The Layer-2 Ethernet switch receives general query packets from the router via this port. The timer should be set to about 2.5 times of the general query period of the router. Related commands: igmp-snooping, igmp-snooping max-response-time. Example Set the aging time of the IGMP Snooping router port to 500 seconds.
[SW7700]igmp-snooping router-aging-time 500

reset igmp-snooping statistics

Syntax
reset igmp-snooping statistics

View User view Parameter None Description Use the reset igmp-snooping statistics command to reset the IGMP Snooping statistics information. Related command: igmp-snooping. Example Clear IGMP Snooping statistics information.
<SW7700>reset igmp-snooping statistics

300

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Multicast Common Configuration Commands


debugging multicast forwarding

This section describes how to use the Multicast Common configuration commands on your Switch 7700.

Syntax
debugging multicast forwarding undo debugging multicast forwarding

View User view Parameter None Description

Use the debugging multicast forwarding to enable multicast packet forwarding debugging functions. Use the undo debugging multicast forwarding to disable the debugging functions.

By default, the debugging function is disabled. debugging multicast kernel-routing Syntax


debugging multicast kernel-routing undo debugging multicast kernel-routing

View User view Parameter None Description

Use the debugging multicast kernel-routing to enable multicast kernel routing debugging functions. Use the undo debugging multicast kernel-routing to disable the debugging functions.

debugging multicast status-forwarding

Syntax
debugging multicast status-forwarding undo debugging multicast status-forwarding

View User view

Multicast Common Configuration Commands

301

Parameter None Description

Use the debugging multicast status-forwarding to enable multicast forwarding status debugging functions. Use the undo debugging multicast status-forwarding to disable the debugging functions.

display multicast forwarding-table

Syntax
display multicast forwarding-table [ group-address [ mask { mask | mask-length } ] | source-address [ mask { mask | mask-length } ] | incoming-interface register ]*

View All views Parameter


group-address: Multicast group address, used to specify a multicast group, ranging from 224.0.0.0 to 239.255.255.255. source-address: Unicast IP address of the multicast source. incoming-interface: Incoming interface of the multicast forwarding table. register: Register interface of PIM-SM.

Description Use the display multicast forwarding-table to view the information of IP multicast forwarding table. Related command: display multicast routing-table. Example View the multicast forwarding table information.
<SW7700>display multicast forwarding-table

display multicast routing-table

Syntax
display multicast routing-table [ group-address [ mask { mask | mask-length } ] | source-address [ mask { mask | mask-length } ] | incoming-interface { interface-type interface-number | register } ]*

View All views Parameter


group-address: Multicast group address, used to specify a multicast group and display the corresponding routing table information of the group. The value ranges from 224.0.0.0 to 239.255.255.255.

302

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

source-address: Unicast IP address of the multicast source. incoming-interface: Incoming interface of the multicast route entry. register: Register interface of PIM-SM.

Description Use the display multicast routing-table to view the information of IP multicast routing table. This command displays the multicast routing table information, while the display multicast forwarding-table command displays the multicast forwarding table information. Example View the route entry information corresponding to multicast group 225.1.1.1 in the multicast routing table.
<SW7700>display multicast routing-table 225.1.1.1

multicast route-limit

Syntax
multicast route-limit limit undo multicast route-limit

View System view Parameter


limit: Limits the capacity of multicast routing table, in the range of 0 to 512.

Description

Use the multicast route-limit command to limit the capacity of multicast routing table. When the preset capacity is exceeded, the router will discard new (S, G) protocol and data packets. Use the undo multicast route-limit command to restore the limit to the default value.

By default, the capacity of multicast routing table is set to 512. If the existing route entries exceed the capacity value you configured during using this command, the system will not delete the existing entries, but prompts the information Existing route entries exceed the configured capacity value. The new configuration overwrites the old one if you run the command for a second time. Example Limit multicast routing table capacity at 256.
[SW7700]multicast route-limit 256

Multicast Common Configuration Commands

303

multicast routing-enable

Syntax
multicast routing-enable undo multicast routing-enable

View System view Parameter None Description


Use the multicast routing-enable to enable IP multicast routing. Use the undo multicast routing-enable to disable IP multicast routing.

By default, IP multicast routing is disabled. The system will not forward any multicast packet when IP multicast routing is disabled. Related commands: pim dm, pim sm. Example Enable IP multicast routing.
<SW7700>system-view [SW7700]multicast routing-enable

reset multicast forwarding-table

Syntax
reset multicast forwarding-table [ statistics ] { all | { group-address [ mask { group-mask | group-mask-length } ] | source-address [ mask { source-mask | source-mask-length } ] | incoming-interface interface-type interface-number } * }

View User view Parameter


statistics: If it is selected, the system clears the statistic information of MFC

forward entries. Otherwise, the system clears MFC forward entries.


all: All MFC forward entries. group-address: Specifies group address. group-mask: Specifies Mask of group address group-mask-length: Specifies mask length of group address. source-address: Specifies source address. source-mask: Specifies mask of source address.

304

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

source-mask-length: Specifies mask length of source address. incoming-interface: Specifies incoming interface for the forward entry. interface-type interface-number: Interface type and interface number.

Description

Use the reset multicast forwarding-table command to clear MFC forwarding entries or statistic information of MFC forwarding entries. You can type in source address first and group address after in the command, as long as they both are valid addresses. The system prompts error information if you type in invalid addresses.

Related commands: reset pim routing-table, reset multicast routing-table and display multicast forwarding-table. Example Clear the forwarding entry with address of 225.5.4.3 from the MFC forwarding table.
<SW7700>reset multicast forwarding-table 225.5.4.3

Clear statistic information of the forwarding entry with address of 225.5.4.3 from the MFC forwarding table.
<SW7700>reset multicast forwarding-table statistics 225.5.4.3

reset multicast routing-table

Syntax
reset multicast routing-table { all | { group-address [ mask { group-mask | group-mask-length } ] | source-address [ mask { source-mask | source-mask-length } ] | { incoming-interface interface-type interface-number } } * }

View User view Parameter


all: All route entries in the core multicast routing table. group-address: Specifies group address. group-mask: Specifies Mask of group address group-mask-length: Specifies mask length of group address. source-address: Specifies source address. source-mask: Specifies mask of source address. source-mask-length: Specifies mask length of source address. incoming-interface: Specifies incoming interface for the forward entry.

IGMP Configuration Commands

305

interface-type interface-number: Interface type and interface number.

Description

Use the reset multicast routing-table command to clear route entries from the core multicast routing table, as well as MFC forwarding entries. You can type in source address first and group address after in the command, as long as they both are valid addresses. The system prompts error information if you type in invalid addresses.

Related commands: reset pim routing-table, reset multicast forwarding-table and display multicast forwarding-table. Example Clear the route entry with address of 225.5.4.3 from the core multicast routing table.
<SW7700>reset multicast routing-table 225.5.4.3

Clear statistic information of the forward entry with address of 225.5.4.3 from the MFC forwarding table.
<SW7700>reset multicast forwarding-table statistics 225.5.4.3

IGMP Configuration Commands


debugging igmp Syntax
debugging igmp { all | event | host | packet | timer } undo debugging igmp { all | event | host | packet | timer }

View User view Parameter


all: Enables all the debugging information for IGMP functions. event: Enables debugging information for IGMP events. host: Enables debugging information for IGMP hosts packet: Enables debugging information for IGMP packets. timer: Enables debugging information for IGMP timers.

Description

Use the debugging igmp command to enable IGMP debugging functions. Use the undo debugging igmp command to disable the debugging functions.

By default, IGMP debugging functions are disabled.

306

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Example Enable all IGMP debugging functions


<SW7700>debugging igmp all

display igmp group

Syntax
display igmp group [ group-address | interface interface-type interface-number ]

View Any view Parameter


group-address: Address of the multicast group. interface-type interface-number: Interface type and interface number of the router, used to specify the specific interface.

Description Using display igmp group command to view the member information of the IGMP multicast group. You can specify to show the information of a group or the member information of the multicast group on an interface. The information displayed contains the multicast groups which are joined by the downstream hosts through IGMP or through command line. Related command: igmp host-join. Example View the member information of multicast group in the system.
<SW7700>display igmp group LoopBack0 (20.20.20.20): Total 3 IGMP Groups reported: Group Address Last Reporter Uptime Expires 225.1.1.1 20.20.20.20 00:02:04 00:01:15 225.1.1.3 20.20.20.20 00:02:04 00:01:15 225.1.1.2 20.20.20.20 00:02:04 00:01:17

Table 30 Output Display of the display igmp group Command


Field Group address Last Reporter Uptime Expires Description Multicast group address The last host reporting to join in the multicast group Time passed since multicast group is discovered (hh: mm: ss) Specifies when the member will be removed from the multicast group (hh: mm: ss).

display igmp interface

Syntax
display igmp interface [ interface-type interface-number ]

IGMP Configuration Commands

307

View Any view Parameter


interface-type interface-number: Interface type and interface number of the

router, used to specify the interface. If the parameters are omitted, information about all the interfaces running IGMP will be displayed. Description Using display igmp interface command to view the IGMP configuration and running information on an interface. Example View the IGMP configuration and running information of all interfaces.
<SW7700>display igmp interface VLAN-interface1: IGMP is enabled on interface Current IGMP version is 2 IGMP query interval is 60 seconds IGMP querier timeout is 120 seconds IGMP max query response time is 10 seconds IGMP querying router is 10.110.91.129 No IGMP group reported

igmp enable

Syntax
igmp enable undo igmp enable

View VLAN interface view Parameter None Description


Use the igmp enable command to enable IGMP on an interface. Use the undo igmp enable command to disable IGMP on the interface.

By default, IGMP is not enabled. The igmp enable command can be executed only if the multicast function is enabled. After multicast is enabled, you can initiate the IGMP feature configuration. Related command: multicast routing-enable Example Enable IGMP on Vlan-interface 10.
[SW7700-Vlan-interface10]igmp enable

308

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

igmp group-limit

Syntax
igmp group-limit number undo igmp group-limit

View VLAN interface view Parameter


number: Number of multicast groups, in the range of 0 to 1024.

Description

Use the igmp group-limit command to limit multicast groups on an interface. Use the undo igmp group-limit command to restore the default setting.

If the existing IGMP groups exceed the quantity limit you configured during using this command, the system will not delete the existing entries. The new configuration overwrites the old one if you run the command for a second time. Example Limit the maximum IGMP groups at Vlan-interface10 to 100. [SW7700-Vlan-interface10] igmp group-limit 100 igmp group-policy Syntax
igmp group-policy acl-number [ 1 | 2 | port { interface_type interface_ num | interface_name } [ to { interface_type interface_ num | interface_name } ] ] undo igmp group-policy [ port { interface_type interface_ num | interface_name } [ to { interface_type interface_ num | interface_name } ] ]

View VLAN interface view Parameter


acl-number: Number of the basic ACL number, defining a multicast group range.

The value ranges from 2000 to 2999.


1: IGMP version 1. 2: IGMP version 2. If IGMP version is not specified, version 2 will be used as default. port: Packets received and sent by the port(s) and applied to the conditions set by

the ACL will be filtered. And the port(s) must belong to the VLAN interface being configured by this command.

IGMP Configuration Commands

309

Description Using igmp group-policy command, you can set the filter of multicast groups on an interface to control the accessing to the IP multicast groups. Using undo igmp group-policy command, you can remove the filter configured. By default, no filter is configured, that is, a host can join any multicast group. If you do not want the hosts on the network that the interface is on to join some multicast groups and receive the packets from the multicast groups, you can use this command to limit the range of the multicast groups serviced by the interface. Related command: igmp host-join. Example Configure the ACL 2000.
[SW7700]acl number 2000 [SW7700-acl-basic-2000]rule permit source 225.0.0.0 0.255.255.255

Configure so that only the hosts contained in the ACL 2000 connected to the VLAN-interface10 can be added to the multicast group, which is configured to use IGMP version 2.
[SW7700-vlan-interface10]igmp group-policy 2000 2

igmp host-join

Syntax
igmp host-join group-address port { interface_type interface_ num | interface_name } [ to { interface_type interface_ num | interface_name } ] undo igmp host-join group-address port { interface_type interface_ num | interface_name } [ to { interface_type interface_ num | interface_name } ]

View VLAN interface view Parameter


group-address: Multicast address of the multicast group that an interface will

join.
port: Specifies the port in the VLAN interface.

Description

Use the igmp host-join command to enable a port in the VLAN interface of an ethernet switch to join a multicast group. Use the undo igmp host-join command to disable the configuration.

By default, an interface does not join any multicast group. Related command: igmp group-policy

310

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Example Add port Ethernet 2/0/1 in VLAN-interface10 to the multicast group at 225.0.0.1.
[SW7700-vlan-interface10]igmp host-join 225.0.0.1 port Ethernet 2/0/1

igmp lastmember-query interval

Syntax
igmp lastmember-queryinterval seconds undo igmp lastmember-queryinterval

View VLAN interface view Parameter


seconds: Time interval before IGMP query router sends the IGMP group query message after it receives the IGMP Leave message from the host. It is in the range of 1 to 5 seconds. By default, it is 1 second.

Description

Use the igmp lastmember-queryinterval command to set the time interval before IGMP query router sends the IGMP group query message after it receives the IGMP Leave message from the host. Use the undo igmp lastmember-queryinterval command to restore the default value.

In the shared network, that is, a same network segment including multiple hosts and multicast routers, the query router is responsible for maintaining the IGMP group membership on the interface. When the IGMP v2 host leaves a group, it sends a IGMP Leave message. When receiving the IGMP Leave message, the IGMP query router must send the IGMP group query message for a specified number of times (by the robust-value parameter in the igmp robust-count command, with default value as 2) in a specified time interval (by the seconds parameter in the igmp lastmember-queryinterval command, with default value as 1 second). If other hosts which are interested in the specified group receive the IGMP query message from the IGMP query router, they send back the IGMP Membership Report message within the specified maximum response time interval. If it receives the IGMP Membership Report message within the defined period (equal to robust-value seconds), the IGMP query router continue to maintain the membership of this group. When receiving no IGMP Membership Report message from any hosts within the defined period, the IGMP query router considers it a timeout and stops membership maintenance for the group. This command is only available on the IGMP query router running IGMP v2. For the host running IGMP v1, this command cannot take effect because the host cannot send the IGMP Leave message when it leaves a group. Related command: igmp robust-count and display igmp interface. Example Set the query interval on Vlan-interface10 as 3 seconds.

IGMP Configuration Commands

311

[SW7700-Vlan-interface10]igmp lastmember-queryinterval 3

igmp max-response-time

Syntax
igmp max-response-time seconds undo igmp max-response-time

View VLAN interface view Parameter


seconds: Maximum response time in the IGMP query messages in second in the

range from 1 to 25. By default, the value is 10 seconds. Description Use the igmp max-response-time command to configure the maximum response time contained in the IGMP query messages. Use the undo igmp max-response-time command to restore the default value. The maximum query response time determines the period for a router to quickly detect that there are no more directly connected group members in a LAN.
Related command: display igmp group

Example Set the maximum response time carried in host-query message to 8 seconds.
[SW7700-vlan-interface10]igmp max-response-time 8

igmp robust-count

Syntax
igmp robust-count robust-value undo igmp robust-count

View VLAN interface view Parameter


robust-value: IGMP robust value, number of sending the IGMP group query

message after the IGMP query router receives the IGMP Leave message from the host. It is in the range of 2 to 5. The default is 2. Description

Use igmp robust-count command to set the number of sending the IGMP group query message after the IGMP query router receives the IGMP Leave message from the host. Use the undo igmp robust-count command to restore the default value.

In the shared network, that is, a same network segment including multiple hosts and multicast routers, the query router is responsible for maintaining the IGMP

312

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

group membership on the interface. When the IGMP v2 host leaves a group, it sends a IGMP Leave message. When receiving the IGMP Leave message, the IGMP query router must send the IGMP group query message for specified times (by the robust-value parameter in the igmp robust-count command, with default value as 2) in a specified time interval (by the seconds parameter in the igmp lastmember-queryinterval command, with default value as 1 second). If other hosts which are interested in the specified group receive the IGMP query message from the IGMP query router, they will send back the IGMP Membership Report message within the specified maximum response time interval. If it receives the IGMP Membership Report message within the defined period (equal to robust-value seconds), the IGMP query router continue to maintain the membership of this group. When receiving no IGMP Membership Report message from any hosts within the defined period, the IGMP query router considers it as timeout and stops membership maintenance for the group. This command is only available on the IGMP query router running IGMP v2. For the host running IGMP v1, this command cannot take effect for the host may not send the IGMP Leave message when it leaves a group. Related command: igmp lastmember-queryinterval and display igmp
interface

Example Set the robust value at the Vlan-interface 10 as 3.


[SW7700-Vlan-interface10]igmp robust-count 3

igmp timer other-querier-present

Syntax
igmp timer other-querier-present seconds undo igmp timer other-querier-present

View VLAN interface view Parameter


seconds: IGMP querier present timer value in second ranging from 1 to 131070. By default, the value is twice the value of IGMP query message interval, i.e., 120 seconds.

Description Use the igmp timer other-querier-present command to configure the timer of presence of the IGMP querier. Use the undo igmp timer other-querier-present command to restore the default value. On a shared network, where there are multiple multicast routers on the same network segment, the query router (querier for short) takes charge of sending query messages periodically on the interface. If other non-queriers receive no query messages within the valid period, the router will consider the previous query to be invalid and the router itself becomes a querier.

IGMP Configuration Commands

313

In IGMP version 1, the selection of a query is determined by the multicast routing protocol. In IGMP version 2, the router with the lowest IP address on the shared network segment acts as the querier. Related commands: igmp timer query and display igmp interface Example Set querier to expire after 300 seconds.
[SW7700-vlan-interface10]igmp timer other-querier-present 300

igmp timer query

Syntax
igmp timer query seconds undo igmp timer query

View VLAN interface view Parameter


seconds: The interval, in seconds, at which a router transmits IGMP query messages in the range from 1 to 65535. By default, the value is 60 seconds.

Description

Use the igmp timer query command to configure the interval at which a router interface sends IGMP query messages. Use the undo igmp timer query command to restore the default value.

A multicast router periodically sends out IGMP query messages to attached segments to find hosts that belong to different multicast groups. The query interval can be modified according to the practical conditions of the network. Related command: igmp timer other-querier-present Example Configure to transmit the host-query message every 60 seconds via VLAN-interface2.
[SW7700-vlan-interface2]igmp timer query 60

igmp version

Syntax
igmp version { 1 | 2 } undo igmp version

View VLAN interface view Parameter


1: IGMP Version 1. 2: IGMP Version 2. By default, IGMP Version 2 is used.

314

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Description

Use the igmp version command to specify the version of IGMP that a router uses. Use the undo igmp version command to restore the default value.

All routers on a subnet must support the same version of IGMP. After detecting the presence of IGMP Version 1 system, a router cannot automatically switch to Version 2. Example Run IGMP Version 1 on VLAN-interface10.
[SW7700-vlan-interface10]igmp version 1

reset igmp group

Syntax
reset igmp group { all | interface interface-type interface-number { all | group-address [ group-mask ] } }

View User view Parameter


all: All IGMP groups. interface interface-type interface-number: Interface type and interface

number.
group-address: IGMP group address. group-mask: Mask of IGMP group address.

Description

Use the reset igmp group command to delete an existing IGMP group from the interface. The deleted group can added again on the interface.

Example Delete all IGMP groups on all the interfaces.


<SW7700>reset igmp group all

Delete all IGMP groups on the Vlan-interface10.


<SW7700>reset igmp group interface Vlan-interface10 all

Delete the group 225.0.0.1 from the Vlan-interface10.


<SW7700>reset igmp group interface Vlan-interface10 225.0.0.1

Delete the IGMP groups ranging from 225.1.1.0 to 225.1.1.255 on the Vlan-interface10.
<SW7700>reset igmp group interface Vlan-interface10 225.1.1.0 255.255.255.0

PIM Configuration Commands

315

PIM Configuration Commands


bsr-policy

This section describes how to use the Protocol Independent Multicast (PIM) configuration commands on your Switch 7700. Syntax
bsr-policy acl-number undo bsr-policy

View PIM view Parameter


acl-number: ACL number imported in BSR filtering policy, in the range of 2000 to

2999. Description

Use the bsr-policy command to limit the range of legal BSRs to prevent BSR proofing. Use the undo bsr-policy command to restore the default setting so that no range limit is set and all received messages are taken as legal.

In the PIM SM network using BSR (bootstrap router) mechanism, every router can set itself as C-BSR (candidate BSR) and take the authority to advertise RP information in the network once it wins in the contention. To prevent malicious BSR proofing in the network, the following two measures need to be taken:

Prevent the router from being spoofed by hosts though faking legal BSR messages to modify RP mapping. BSR messages are of multicast type and their TTL is 1, so this type of attacks often hit edge routers. Fortunately, BSRs are inside the network, while assaulting hosts are outside, therefore neighbor and RPF checks can be used to stop this type of attacks. If a router in the network is manipulated by an attacker, or an illegal router is accessed into the network, the attacker may set itself as C-BSR and try to win the contention and gain authority to advertise RP information among the network. Since the router configured as C-BSR shall propagate BSR messages, which are multicast messages sent hop by hop with TTL as 1, among the network, then the network cannot be affected as long as the peer routers do not receive these BSR messages. One way is to configure bsr-policy on each router to limit legal BSR range, for example, only 1.1.1.1/32 and 1.1.1.2/32 can be BSR, thus the routers cannot receive or forward BSR messages other than these two. Even legal BSRs cannot contest with them.

Problems may still exist if a legal BSR is attacked, though these two measures can effectively guarantee high BSR security. The source parameter in the rule command is translated as BSR address in the bsr-policy command. Related commands: acl and rule

316

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Example Configure BSR filtering policy on routers, only 1.1.1.1/32 can be BSR.
[SW7700-pim]bsr-policy 1 [SW7700-pim]quit [SW7700]acl number 2000 [SW7700-acl-basic-2000]rule 0 permit source 1.1.1.1 0

c-bsr

Syntax
c-bsr interface-type interface-number hash-mask-len [ priority ] undo c-bsr

View PIM view Parameter


interface-type interface-number: Interface type and interface number of a router. The candidate BSR is configured on the interface. PIM-SM must be enabled on the interface first. hash-mask-len: Length of the mask. The value ranges from 0 to 32. priority: Priority of the candidate BSR. The larger the value of the priority, the

higher the priority of the BSR. The value ranges from 0 to 255. The default value is 0. Description

Use the c-bsr to configure a candidate BSR. Use the undo c-bsr to remove the candidate BSR configured.

By default, no candidate BSR is set. When using this command to configure the candidate BSR, the larger bandwidth should be guaranteed since a great amount of information will be exchanged between BSR and other devices in the PIM domain. Related command: pim sm. Example Configure the Ethernet switch as C-BSR with priority 2 (and the C-BSR address is designated as the IP address of VLAN-interface10).
[SW7700] pim [SW7700-pim]c-bsr vlan-interface 10 24 2

c-rp

Syntax
c-rp vlan-interface-type vlan-interface-number [ group-policy acl-number | priority priority-value ]* undo c-rp { interface-type interface-number | all }

PIM Configuration Commands

317

View PIM view Parameter


interface-type interface-number: Specified interface with the IP address

advertised as a candidate RP address.


acl-number: Number of the basic ACL that defines a group range, which is the

service range of the advertised RP. The value ranges from 2000 to 2999.
priority-value: Priority value of candidate RP, in the range of 0 to 255. By default, it is 0. The greatest value corresponds to the lowest priority level all: Remove all candidate RP configurations.

Description

Use the c-rp to configure the router to advertise itself as a candidate RP. Use the undo c-rp to remove the configuration.

By default, no candidate RP is configured. When configuring the candidate RP, a relatively large bandwidth should be reserved for the router and other devices in the PIM domain. Related command: c-bsr. Example Configure the Switch 7700 to advertise to the BSR that it is the C-RP in the PIM. The standard ACL 2005 defines the groups related to the RP. The address of C-RP is designated as the IP address of VLAN-interface10.
[SW7700]acl number [SW7700-acl-basic-2005]rule permit source 225.0.0.0 0.255.255.255 [SW7700]pim [SW7700-pim]c-rp vlan-interface 10 group-list 2005

crp-policy

Syntax
crp-policy acl-number undo crp-policy

View PIM view Parameter


acl-number: ACL number imported in C-RP filtering policy, ranging from 2000 to

2999. Description

Use the crp-policy command to limit the range of legal C-RP, as well as target service group range of each C-RP, prevent C-RP proofing.

318

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Use the undo crp-policy command to restore the default setting so that no range limit is set and all received messages are taken as legal.

In the PIM SM network using BSR mechanism, every router can set itself as C-RP (candidate rendezvous point) servicing particular groups. If elected, a C-RP becomes the RP servicing the current group. In BSR mechanism, a C-RP router unicasts C-RP messages to the BSR, which then propagates the C-RP messages among the network by BSR message. To prevent C-RP spoofing, you need to configure crp-policy on the BSR to limit legal C-RP range and their service group range. Since each C-BSR has the chance to become BSR, you must configure the same filtering policy on each C-BSR router. This command uses the ACLs numbered between 2000 and 2999. The source parameter in the rule command is translated as C-RP address in the crp-policy command, and the destination parameter as the service group range of this C-RP address. For the C-RP messages received, only when their C-RP addresses match the source address and their server group addresses are subset of those in ACL, can the be considered as matched. Related commands: acl and rule Example Configure C-RP filtering policy on the C-BSR routers, allowing only 1.1.1.1/32 as C-RP and to serve only for the groups 225.1.0.0/16.
[SW7700-pim]crp-policy 100 [SW7700-pim]quit [SW7700]acl number 2000 [SW7700-acl-adv-2000]rule 0 permit source 1.1.1.1 0 destination 225.1.0.0 0.0.255.255

debugging pim common

Syntax
debugging pim common { all | event | packet | timer } undo debugging pim common { all | event | packet | timer }

View User view Parameter


all: all the common debugging information of PIM. event: debugging information of common PIM event. packet: debugging information of PIM hello packet. timer: debugging information of common PIM timer.

Description

Use the debugging pim common to enable common PIM debugging functions. Use the undo debugging pim common to disable the debugging functions.

PIM Configuration Commands

319

By default, common PIM debugging functions are disabled. debugging pim dm Syntax
debugging pim dm { alert | all | mrt | timer | warning | { recv | send } { all | assert | graft | graft-ack | join | prune } } undo debugging pim dm { alert | all | mrt | timer | warning | { recv | send } { all | assert | graft | graft-ack | join | prune } }

View User view Parameter


alert: interoperation event debugging information of PIM-DM all: all the debugging information of PIM-DM. mrt: debugging information of PIM-DM multicast routing table. timer: debugging information of PIM-DM timer. warning: debugging information of PIM-DM warning message. recv: debugging information of PIM-DM receiving packets. send: debugging information of PIM-DM sending packets. all | assert | graft | graft-ack | join | prune: packets type.

Description

Use the debugging pim dm to enable PIM-DM debugging functions. Use the undo debugging pim dm to disable the debugging functions.

By default, PIM-DM debugging functions are disabled. debugging pim sm Syntax


debugging pim sm { all | mbr | register-proxy | mrt | timer | warning | { recv | send } { assert | graft | graft-ack | join | prune } } undo debugging pim sm { all | mbr | register-proxy | mrt | timer | warning | { recv | send } { assert | graft | graft-ack | join | prune } }

View User view Parameter


mbr: debugging information of PIM-SM multicast border router event. register-proxy: debugging information of PIM-SM IO registry proxy. mrt: debugging information of PIM-SM multicast routing table.

320

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

timer: debugging information of PIM-SM timer. warning: debugging information of PIM-SM warning message. recv: debugging information of PIM-SM receiving packets. send: debugging information of PIM-SM sending packets. assert | graft | graft-ack | join | prune: packets type.

Description

Use the debugging pim sm to enable PIM-SM debugging functions. Use the undo debugging pim sm to disable the debugging functions.

By default, PIM-SM debugging functions are disabled. display pim bsr Syntax
display pim bsr

View All views Parameter None Description Use the display pim bsr to display the information about BSR. This command is used for displaying the information about BSR, including the information about the elected BSR and the information advertised by the local RP candidates. Related command: c-bsr, c-rp. Example
<SW7700>display pim bsr Current BSR Address: 192.168.1.1 Priority: 0 Expires: 1:52

display pim interface

Syntax
display pim interface [ interface-type interface-number ]

View All views Parameter


interface-type: Specifies the interface type. interface-number: Specifies interface number.

PIM Configuration Commands

321

Description Use the display pim interface to display the PIM configuration information about an interface. If the interface type and number are not specified, the PIM configuration information about all the interfaces will be displayed, otherwise the information about the specified interface will be displayed. Example
<SW7700>display pim interface Address Interface Ver/Mode 8.8.8.8 VLAN-interface1v2/S 1 192.168.1.1 VLAN-interface2v2/S 0 Nbr Cnt Query Intvl DR 30 8.8.8.8 30 192.168.1.1

Table 31 Output Description of the display pim interface Command


Field Mode Query Intvl DR Nbr Cnt Description Interface mode (DM or PM) Hello packet interval Designated router Number of adjacent routers

display pim neighbor

Syntax
display pim neighbor [ interface interface-type interface-number ]

View All views Parameter


interface-type interface-number: Interface type and interface number, used

to specify the interface. Description Use the display pim neighbor to view the PIM neighbor information. This command is used for displaying the information about the PIM neighbors discovered by the Ethernet switch interface. When the parameters are configured, only the PIM neighbors of the specified interface will be displayed. Example
<SW7700>display pim neighbor Neighbor Address Interface 8.8.8.6 VLAN-interface1 Uptime Expires 1637 89

Table 32 Output description about PIM neighbors


Field Neighbor Address Interface Uptime Expires Description Neighbor address Interface where the neighbor has been discovered Time passed since the multicast group has been discovered Specifies when the member will be removed from the group

322

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

display pim routing-table

Syntax
display pim routing-table [ { { *g [ group-address [ mask { mask-length | mask } ] ] | **rp [ rp-address [ mask { mask-length | mask } ] ] } | { group-address [ mask { mask-length | mask } ] | source-address [ mask { mask-length | mask } ] } * } | incoming-interface { interface-type interface-num | interface-name | null } | { dense-mode | sparse-mode } ] *

View All views Parameter


**rp: (*, *, RP) route entry. *g: (*, G) route entry. group-address: Address of the multicast group. source-address: IP address of the multicast source. incoming-interface: Router entry with the specified incoming interface.

Description Use the display pim routing-table to view the contents of the PIM multicast routing table. Related command: display multicast routing-table. Example View the contents of the PIM multicast routing table on the router.
<SW7700>display pim routing-table PIMSM Routing Table Total 0 (*,*,RP), 0 (*,G), 2 (S,G) (192.168.1.2, 224.2.178.130), Protocol 0x20: PIMSM, Flag 0x4: SPT UpTime: 23:59, Timeout after 196 seconds Upstream interface: VLAN-interface2, RPF neighbor: NULL Downstream interface list: NULL (192.168.1.2, 224.2.181.90), Protocol 0x20: PIMSM, Flag 0x4: SPT UpTime: 23:59, Timeout after 196 seconds Upstream interface: VLAN-interface2, RPF neighbor: NULL Downstream interface list: NULL Total 2 entries listed

display pim rp-info

Syntax
display pim rp-info [ group-address ]

View All views

PIM Configuration Commands

323

Parameter
group-address: Specify the group address to be showed. If no multicast group is specified, the RP information about all multicast groups will be displayed.

Description Use the display pim rp-info to view the RP information of multicast group. In addition, this command can also show the BSR and static RP information. Example
<SW7700>display pim rp-info PIM-SM RP-SET information: BSR is: 192.168.1.1 Group/MaskLen: 224.0.0.0/4 RP 192.168.1.1, Version 2 priority: 0 uptime(from last update): 29:11, to expire in: 2:02

pim

Syntax
pim undo pim

View System view Parameter None Description


Use the pim to enter the PIM view. Use the undo pim to clear the configurations in PIM view.

The global parameters of PIM can only be configured in PIM view. Example Enable multicast and enter the PIM view.
<SW7700>system-view [SW7700]multicast routing-enable [SW7700]pim [SW7700-pim]

pim bsr-boundary

Syntax
pim bsr-boundary undo pim bsr-boundary

View Interface view

324

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

Parameter None Description

Use the pim bsr-boundary to configure an interface to be the PIM domain border. Use the undo pim bsr-boundary to remove the border.

By default, no domain border is set. You can use this command to set border of bootstraps messages, that is to say, bootstrap messages cannot pass interfaces that are configured with pim bsr-boundary command while other PIM messages can. In this way, the network is divided into different BSR domains. It should be noted that this command cannot set up multicast boundaries. It only sets up a PIM domain bootstrap message border. Related command: c-bsr. Example Configure domain border on VLAN-interface10.
[SW7700-vlan-interface10]pim bsr-boundary

pim dm

Syntax
pim dm undo pim dm

View Interface view Parameter None Description


Use the pim dm to enable PIM-DM. Use the undo pim dm to disable PIM-DM.

By default, PIM-DM is disabled. Once enabled PIM-DM on an interface, PIM-SM cannot be enabled on the same interface and vice versa. Example Enable PIM DM on VLAN-interface10 of the Ethernet switch.
[SW7700]multicast routing-enable [SW7700-vlan-interface10]pim dm

PIM Configuration Commands

325

pim neighbor-limit

Syntax
pim neighbor-limit limit undo pim neighbor-limit

View VLAN interface view Parameter


limit: Limits of PIM neighbors on the interface, in the range of 0~128.

Description

Use the pim neighbor-limit command to limit the PIM neighbors on an interface. No neighbor can be added any more when the limit is reached. Use the undo pim neighbor-limit command to restore the default setting.

By default, the PIM neighbors on the interface are limited to 128. If the existing PIM neighbors exceed the configured value during configuration, they will not be deleted. Example Limit the PIM neighbors on the Vlan-interface10 to 50.
[SW7700-Vlan-interface10]pim neighbor-limit 50

pim neighbor-policy

Syntax
pim neighbor-policy acl-number undo pim neighbor-policy

View VLAN interface view Parameter


acl-number: Basic ACL number, in the range of 2000 to 2999.

Description

Use the pim neighbor-policy command to filter the PIM neighbors on the current interface. Use the undo pim neighbor-policy command to remove the filter.

Only the routers that match the filtering rule in the ACL can serve as a PIM neighbor of the current interface. The new configuration overwrites the old one if you run the command for a second time. Example Configure that 10.10.1.2 can serve as a PIM neighbor of the Vlan-interface1, but not 10.10.1.1.

326

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

[SW7700-Vlan-interface1]pim neighbor-policy 1 [SW7700-Vlan-interface1]quit [SW7700]acl number 2000 [SW7700-acl-basic-2000]rule permit source 10.10.1.2 0 [SW7700-acl-basic-2000]rule deny source 10.10.1.1 0

pim sm

Syntax
pim sm undo pim sm

View Interface view Parameter None Description


Use the pim sm to enable the PIM-SM protocol on an interface. Use the undo pim sm to disable the PIM-SM protocol.

By default, PIM-SM is disabled. Once enabled PIM-SM on an interface, PIM-DM cannot be enabled on the same interface and vice versa. Example Enable PIM-SM on VLAN-interface10.
[SW7700-vlan-interface10]pim sm

pim timer hello

Syntax
pim timer hello seconds undo pim timer hello

View Interface view Parameter


seconds: Interval of sending Hello messages in second ranging from 1 to 18000.

By default, the interval value is 30 seconds. Description

Use the pim timer hello to configure the interval of sending PIM router Hello messages. Use the undo pim timer hello to restore the default interval value.

Example Configure to transmit Hello packet via VLAN-interface10 every 40 seconds.


[SW7700-vlan-interface10]pim timer hello 40

PIM Configuration Commands

327

reset pim neighbor

Syntax
reset pim neighbor { all | { neighbor-address | interface vlan-interface vlan-interface-number } * }

View User view Parameter


all: All PIM neighbors neighbor-address: Specifies neighbor address.

interface Vlan-interface Vlan-interface-number: Specifies VLAN interface. Description

Use the reset pim neighbor command to clear a PIM neighbor.

Related command: display pim neighbor Example Clear the PIM neighbor 25.5.4.3.
<SW7700>reset pim neighbor 25.5.4.3

reset pim routing-table

Syntax
reset pim routing-table { all | { group-address [ mask { group-mask | group-mask-length } ] | source-address [ mask { source-mask | source-mask-length } ] | { incoming-interface { interface-type interface-number | null } } } * }

View User view Parameter


all: All PIM neighbors group-address: Specifies group address. mask group-mask: Specifies group mask. mask-length group-mask-length: Specifies mask length of the group address. source-address: Specifies source address. mask source-mask: Specifies source mask. mask-length source-mask-length: Specifies mask length of the group address. incoming-interface: Specifies incoming interface for the route entry in PIM

routing table.
Vlan-interface Vlan-interface-number: Specifies VLAN interface.

328

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

null: Specifies the incoming interface of the route entry as null.

Description

Use the reset pim routing-table command to clear a PIM route entry.

You can type in source-address first and group-address after in the command, as long as they are valid. Error information will be given if you type in invalid addresses. If in this command, the group-address is 224.0.0.0/24 and source-address is the RP address (where group address can have a mask, but the resulted IP address must be 224.0.0.0, and source address has no mask), then it means only the (*, *, RP) item will be cleared. If in this command, the group-address is any a group address, and source-address is 0 (where group address can have a mask, and source address has no mask), then only the (*, G) item will be cleared. This command clears multicast route entries from PIM routing table, as well as the corresponding route entries and forward entries in the multicast core routing table and MFC. Related commands: reset multicast routing-table, reset multicast forwarding-table and display pim routing-table. Example Clear the route entries with group address 225.5.4.3 from the PIM routing table.
<SW7700>reset pim routing-table 225.5.4.3

source-policy

Syntax
source-policy acl-number undo source-policy

View PIM view Parameter


acl-number: Basic or advanced ACL, in the range of 2000 to 3999.

Description Using source-policy command, you can set to filter the source (and group) address of multicast data packets. Using undo static-rp command, you can remove the configuration. If resource address filtering is configured, as well as basic ACLs, then the router filters the resource addresses of all multicast data packets received. Those not matched will be discarded. If resource address filtering is configured, as well as advanced ACLs, then the router filters the resource and group addresses of all multicast data packets received. Those not matched will be discarded.

PIM Configuration Commands

329

When this feature is configured, the router filters not only multicast data, but the multicast data encapsulated in the registration packets. The new configuration overwrites the old one if you run the command for a second time. Example Set to receive the multicast data packets from source address 10.10.1.2, but discard those from 10.10.1.1.
[SW7700]multicast routing-enable [SW7700]pim [SW7700-pim]source-policy 1 [SW7700-pim]quit [SW7700]acl number 2000 [SW7700-acl-basic-2000]rule permit source 10.10.1.2 0 [SW7700-acl-basic-2000]rule deny source 10.10.1.1 0

static-rp

Syntax
static-rp rp-address [ acl-number ] undo static-rp

View PIM view Parameter


rp-address: Static RP address, only being legal unicast IP address. acl-number: Basic ACL, used to control the range of the multicast group served

by the static RP, which ranges from 2000 to 2999. If an ACL is not specified at configuration, static RP will serve all multicast groups; if an ACL is specified, static RP will only serve the multicast group passing the ACL. Description

Use the static-rp command to configure static RP. Use the undo static-rp command to remove the configuration.

Static RP functions as the backup of dynamic RP so as to improve the network robustness. If the RP elected by BSR mechanism is valid, static RP will not work. All routers in the PIM domain should be configured with this command and be specified with the same RP address. The new configuration overwrites the old one if you run the command for a second time. Related command: display pim rp-info Example Configure 10.110.0.6 as a static RP.
[SW7700]multicast routing-enable

330

CHAPTER 6: USING MULTICAST PROTOCOL COMMANDS

[SW7700]pim [SW7700-pim]static-rp 10.110.0.6

USING QOS/ACL COMMANDS

This chapter describes how to use the following commands: ACL Configuration Command List

acl acl mode display acl config display acl mode display acl running-packet-filter display time-range packet-filter reset acl counter rule time-range

QoS Configuration Commands List


display mirroring-group display priority-trust display qos cos-local-precedence- map display qos-interface all display qos-interface line-rate display qos-interface traffic-bandwidth display qos-interface traffic-limit display qos-interface traffic-priority display qos-interface traffic-red display qos-interface traffic-redirect display qos-interface traffic-statistic line-rate mirroring-group priority priority trust qos qos cos-local-precedence- map reset traffic-statistic

332

CHAPTER 7: USING QOS/ACL COMMANDS

traffic-bandwidth traffic-limit traffic-priority traffic-red traffic-redirect traffic-statistic

Logon users ACL Control Command


acl snmp-agent community snmp-agent group snmp-agent usm-user

ACL Configuration Command List


acl

This section describes how to use the ACL configuration commands on your Switch 7700. Syntax
acl { number acl-number | name acl-name [ advanced | basic | link | user ] } [ match-order { config | auto } ] undo acl { number acl-number | name acl-name | all }

View System view Parameter


number acl-number: ACL number, ranging from: 2000 to 2999: Basic ACL. 3000 to 3999: Advanced ACL. 4000 to 4999: Layer-2 ACL. 5000 to 5999: User defined ACL name acl-name: Specifies an ACL with a character string, beginning with English letters [a-z, A-Z] only, excluding space and quotation marks, and not case sensitive. The all and any keywords are not allowed. advanced: Advanced ACL. basic: Basic ACL. link: Layer-2 ACL.

user: User-defined ACL.


config: Follow the user configuration order to match ACL rules.

ACL Configuration Command List

333

auto: Follow the depth-first order to match ACL rules. all ( for the undo command): Configures to delete all the ACLs (including

numbered and named ACLs). Description

Use the acl command to configure a numbered or named ACL, and enter the corresponding ACL view. Use the undo acl command to cancel all the rules of a numbered or named ACL or all the ACLs.

By default, the ACLs are matched in config order. Use the acl command to create an ACL and specify its name with acl-name and its type with the keywords advanced, basic, user, or link. For both numbered and named ACL, you can use the rule command to add rules for them after entering ACL view. (Use the quit command to exit ACL view.) An ACL may contain multiple rules and the traffic classification rules concern different ranges, which brings forward the issue of match order when a data packet matches more than one rule. Use the match-order command to follow the user configuration order (as defaulted) or depth-first order (matching the rule with smaller range first) to match the rules. After specifying the match order of an ACL, you cannot change it, unless you delete all its rules and specify the order again. Note that the match order is user defined and can only be effective for the data that is treated by the software of the switch. On the Switch 7700, each ASIC supports up to 128 ACLs. Therefore, on a 7- or 8-slot chassis, with six 48-port I/O modules (and two ASICS on each module), you can configure up to 1536 ACLs. On a 4-slot chassis, with three 48-port I/O modules, you can configure up to 768 ACLs. For related configurations, refer to the command rule. User-defined ACLs can only be activated on the 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK I/O modules. Example Configure to follow depth-first order to match the rules of ACL 2000.
[SW7700]acl number 2000 match-order auto

acl mode

Syntax
acl mode { ip-based | link-based } undo acl mode

View System view

334

CHAPTER 7: USING QOS/ACL COMMANDS

Parameter
ip-based: Configures to use L3 traffic classification rules. In this case only L3 rules

take effect.
link-based: Configures to use L2 traffic classification rules. In this case only L2

rules take effect. Description

Use the acl mode command to select the ACL mode used by the switch between L2 and L3 traffic rules. Use the undo acl mode command to restore the ACL mode used by the switch.

For the L2 and L3 traffic classification rules configured globally, there is an issue about discriminate usage. You can use this command to select between the L2 and L3 traffic classification rules. This command is not effective on the 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK I/O modules. Example Configures to run L2 traffic classification rule.
[SW7700]acl mode link-based

display acl config

Syntax
display acl config { all | acl-number | acl-name }

View All views Parameter


all: Configures to display all the ACLs (including numbered and named ACLs). acl-number: Specifies the sequence number of the ACL. acl-name: Specifies the name of the ACL to be displayed with a character string

starting with English letters ([a-z, A-Z]) only and excluding space or quotation mark. Description Use the display acl config command to view the detail configuration information about the ACL, including all the statements and sequence numbers and how many packets and bytes matched these statements. The matched information is the information treated by switchs CPU. The matched information of transmitted data can be displayed by the display qos-info traffic-statistic command. Example Display the content of all the ACLs.
<SW7700>display acl config all

ACL Configuration Command List

335

Basic acl 2010, 1 rule, rule 1 permit 10.0.0.1 0 (0 times matched) Basic acl 2020, 1 rule, rule 2 permit 20.0.0.1 0 (0 times matched) Basic acl std1, 2 rules, rule 1 permit 20.0.0.1 0 (0 times matched) rule 2 permit 30.0.0.1 0 (0 times matched)

display acl mode

Syntax
display acl mode

View All views Parameter None Description Use the display acl mode command to view the ACL mode chosen by the switch. Example Display the ACL mode chosen by the switch.
<SW7700>display acl mode ACL mode: ip-based

display acl running-packet-filter

Syntax
display acl running-packet-filter { all | interface { interface-name | interface-type interface-num } }

View All views Parameter


all: Displays all the ACLs (including numbered and named ACLs). interface { interface-name | interface-type interface-num }: Specifies a

port of the switch. For detailed information, refer to the Using Port Commands on page 49. Description Use the display acl running-packet-filter all command to view the information about the running state of the ACL. The displayed information includes ACL name, rule name and running state. Example Display the ACL running state on all the interfaces.
<SW7700>display acl running-packet-filter all

336

CHAPTER 7: USING QOS/ACL COMMANDS

acl std1 rule 0 acl std1 rule 1

running running

The display information shows all the activated ACLs of the switch. display time-range Syntax
display time-range [ all | name ]

View All views Parameter


name: Specifies the name of the time range.

Description Use the display time-range command to view the configuration and status of the current time range. You will see the active or inactive state outputs. Note that the system has a delay of about 1 minute when updating the ACL state, while the display time-range command applies the current time. Therefore, when display time-range displays that a time range is active, the ACL using it may not have been activated. This is normal. Example Display the configuration of all the time ranges.
<SW7700>display time-range all Current time is 14:36:36 4-3-2003 Thursday Time-range : hhy ( Inactive ) from 08:30 2-5-2005 to 18:00 2-19-2005 Time-range : hhy1 ( Inactive ) from 08:30 2-5-2003 to 18:00 2-19-2003

Display the time range named tm1.


<SW7700>display time-range tm1 Current time is 14:37:31 4-3-2003 Thursday Time-range : tm1 ( Inactive ) from 08:30 2-5-2005 to 18:00 2-19-2005

packet-filter

Syntax for 48-port 10/100BASE-T Auto-sensing FE, 8-port 1000BASE-X GE, 8-port 10/100/1000BASE-T GE, and 24-port 100BASE-FX MMF FE I/O Modules:
packet-filter inbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } [ not-care-for-interface ] undo packet-filter inbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

ACL Configuration Command List

337

Syntax for 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK I/O Modules
packet-filter inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* } undo packet-filter inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* }

NOTE: Activating both IP ACL and Layer-2 ACL is supported by 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK I/O modules. However, the sum of the bytes number defined by the IP ACL and the Layer-2 ACL can not exceed 32 bytes. View QoS view. Parameter
inbound: Filters the traffic received by the Ethernet port. ip-group { acl-number | acl-name }: Activates the IP ACLs. IP ACLs include basic and advanced ACLs. acl-number specifies the sequence number of the ACL, ranging from 2000 to 3999. acl-name specifies the ACL name with a character

string starting with a to z, A to Z, excluding spaces and quotation marks.


link-group { acl-number | acl-name }: activates the Layer-2 ACLs. acl-number specifies the ACL number, ranging from 4000 to 4999. acl-name

specifies the ACL name with a character string started with a to z, A to Z, excluding spaces and quotation marks.
user-group { acl-number | acl-name }: activates the user-defined ACL. acl-number specifies the ACL number, ranging from 5000 to 5999. acl-name

specifies the ACL name with a character string started with a to z or A to Z, excluding spaces and quotation marks.
rule rule: Specifies the rule in the ACL to be activated, ranging from 0 to 127. If it is not specified, all the rules in the ACL are activated. not-care-for-interface: For non-48-port interface modules, the

packet-filtering function occurs on the interface card where the current port resides after the parameter is chosen. On the 48-port interface, if the number of the current port is 1 to 24, the packet filtering takes effect on port 1 to port 24 after the parameter is chosen. If the number of the current port is 25 to 48, the packet filtering takes effect on port 25 to port 48 after the parameter is chosen. Description

Use the packet-filter command to activate the ACL. Use the undo packet-filter command to disable the ACL.

NOTE: ARP packets are allowed to pass by default on the Switch 7700. You cannot use the packet-filter command to filter ARP packets, even though you have

338

CHAPTER 7: USING QOS/ACL COMMANDS

used the rule command to define a Layer 2 ACL, in which the parameter protocol is defined as ARP. Example Activate ACL 2000.
[SW7700-qoss-Ethernet3/0/1]packet-filter inbound ip-group 2000

reset acl counter

Syntax
reset acl counter { all | acl-number | acl-name }

View User view Parameter


all: All the ACLs (including numbered and named ACLs). acl-number: Specifies an ACL by its number. acl-name: Specifies an ACL with a character string, beginning with English letters [a-z, A-Z] only, excluding space and quotation marks, and not case sensitive. The all and any keywords are not allowed.

Description Use the reset acl counters command to reset the statistics information of the ACL and reset the counters of packet and byte matching the ACL. Example Clear the statistics information of ACL 2000.
<SW7700>reset acl counters 2000

rule

Syntax Define or delete a rule for basic ACL:


rule [ rule-id ] { permit | deny } [ source source-addr source-wildcard | any ] [ fragment ] [ time-range name ] undo rule rule-id [ source ] [ fragment ] [ time-range ]

Define or delete a rule for advanced ACL:


rule [ rule-id ] { permit | deny } protocol [ source source-addr source-wildcard | any ] [ destination dest-addr dest-mask | any ] [ source-port operator port1 [ port2 ] ] [ destination-port operator port1 [ port2 ] ] [ icmp-type type-code ] [ established ] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragment ] [ time-range name ] undo rule rule-id [ source ] [ destination ] [ source-port ] [ destination-port ] [ precedence ] [ tos ] [ dscp ] [ fragment ] time-range ]

ACL Configuration Command List

339

Define or delete a rule for a Layer-2 ACL:


rule [ rule-id ] { permit | deny } [ protocol-type ] [ format-type ] ingress { { [ source-vlan-id ] [ source-mac-addr ] | any } egress { [ dest-mac-addr ] [ destination-vlan-id ] | any } [ time-range name ] undo rule rule-id

Define or delete a rule for user-defined ACL:


rule [ rule-id ] { permit | deny } { rule-string rule-mask offset }&<1-8> [ time-range name ] undo rule rule-id

NOTE: User-defined ACLs can only be activated on 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK modules. View ACL view Parameter
rule-id: Specifies a rule of an ACL with a number in the range of 0 to 127. permit: Indicates to let the matched packets through. deny: Indicates to reject the matched packets to pass through. time-range name: Name of a time range, during which a rule takes effect.

The following parameters are attributes carried by the data packets. The ACL rules are defined according to the values of these parameters.

Parameters for a basic ACL:

source-addr source-wildcard | any: source-addr source-wildcard is the

source IP address and source address wildcard, expressed in dotted decimal notation. any represents any source address.
fragment: Indicates that the rule takes effect on fragmented packets only and will be ignored for other packets.

Parameters for an advanced ACL:

protocol: This parameter is to define protocol type, which can be indicated by

name, or digit. This parameter can be icmp, igmp, tcp, udp, ip, gre, ospf or ipinip. If this parameter takes ip, it means all the IP protocols. This parameter can be 1 ~ 255 if indicated by digit.
source source-addr source-wildcard | any: source-addr source-wildcard is the source IP address and source address wildcard, expressed in dotted decimal notation. any represents any source address. destination dest-addr dest-wildcard | any: dest-addr dest-wildcard is

the destination IP address and destination address wildcard, expressed in dotted decimal notation. any represents any destination address.

340

CHAPTER 7: USING QOS/ACL COMMANDS

source-port operator port1 [ port2 ]: This parameter is to define the source TCP or UDP port number. Here, operator represents port operation character,

including eq (equal to), gt (greater than), lt (less than), neq (not equal to), and range (in certain range). This parameter is available only when protocol parameter takes TCP or UDP. port1 [ port2 ]: TCP or UDP port number of packets, expressed with characters or numbers. The numbers are in the range of 0 to 65535 and refer to mnemonic symbol table for character values.
destination-port operator port1 [ port2 ]: This parameter is to define the destination TCP or UDP port number. The meaning of operator port1 [port2] is same as upper parameter. icmp-type type-code: Used when protocol is specified as icmp. icmp-type icmp-code specifies an ICMP packet. icmp-type specifies the ICMP packet type with a number in the range of 0 to 255 or characters. icmp-code, ranging from 0

to 255, is used for icmp when the ICMP packet type is not specified with characters.
established: Used when protocol is tcp to indicate that the rule takes effect on the first SYN packet to establish TCP connection. precedence precedence: Specifies IP precedence with a number in the range of

0 to 7 or a name.
dscp dscp: Classifies the data packets with a number in the range of 0 to 63 or a

name.
tos tos: Classifies the data packets with a number in the range of 0 to 15 or a

name.
fragment: Indicates that the rule takes effect on fragmented packets only and will be ignored for other packets.

The switch does not support to deliver rules that configured with icmp-type type code, tos tos, fragment parameters to hardware. The TCP/UDP port number has the following restrictions:

The operator gt means the port number is greater than a specified port number. The parameter after gt can only be 32767, that is to designate port number within the range of [32768,65535] ( or notated as 32768-65535). The operator lt means the port number is less than a specified port number. The parameter after lt can only be the nth power of 2, i.e., 2^n ( neN, ne[1,15] ), for instance: lt 2, lt 512. If the operator is neg, the system delivery will fail and prompt Not support!, because the chip does not support the operator neg. If the operator is range, the system will deliver normally only when the sequent parameters port 1 and port 2 meet the following requirements (suppose that: port-range= port2-port1+1): port-range must be the power of 2. port1 must be the integral multiple of port-range.

ACL Configuration Command List

341

Parameters for a Layer 2 ACL:

protocol-type: (Optional) Protocol type carried by Ethernet frame, can be:ip,

arp, rarp, ipx, nbx. ARP packets are allowed to pass by default on the Switch 7700. You cannot configure filtering of ARP packets. If you have configured to choose ARP as the protocol type when defining Layer2 ACL rules, you cannot activate this ACL to make it effective by using the packet-filter command. format-type: 802.3/802.2, 802.3, ether_ii, snap.
ingress { { source-vlan-id | source-mac-addr }* | any }: The source information of a packet, source-vlan-id represents source VLAN of the packet, source-mac-addr represents source MAC address of the packet, any represents

all the packets received from all ports.


egress { dest-mac-addr | any }: The destination information of a packet, dest-mac-addr represents the packet's destination MAC address. any represents

all the packets forwarded from all ports.

Parameters for user-defined ACL

{ rule-string rule-mask offset }&<1-8>: rule-string is a character string

of a rule defined by a user. It only consists of hexadecimal numbers of even digits. rule-mask offset is used to extract the packet information. Here, rule-mask is rule mask, used for logical AND operation with data packets, and offset determines to perform AND operation from which bytes apart from the packet header. rule-mask offset extracts a character string from the packet and compares it with the user-defined rule-string to get and process the matched packets. &<1-8> indicates that you can define up to 8 such rules at a time. Description

Use the rule command to add a subrule to an ACL. Use the undo rule command to cancel a subrule from an ACL.

You can define several subrules for an ACL. If you include parameters when using the undo rule command, the system only deletes the corresponding content of the subrule. Related command: acl Example Add a rule to an advanced ACL.
[SW7700-acl-adv-3000]rule 1 permit tcp established source 1.1.1.1 0 destination 2.2.2.2 0

Add a rule to a basic ACL.


[SW7700-acl-basic-2000]rule 1 permit source 1.1.1.1 0 fragment

Add a rule to an L2 ACL.


[SW7700-acl-link-4000]rule 1 permit ingress 1 egress any

342

CHAPTER 7: USING QOS/ACL COMMANDS

time-range

Syntax
time-range time-name [ start-time to end-time days-of-the-week [ from start-time start-date ] [ to end-time end-date ] | from start-time start-date ] [ to end-time end-date ] ] undo time-range time-name [ start-time to end-time days-of-the-week [ from start-time start-date ] [ to end-time end-date ] | from start-time start-date ] [ to end-time end-date ] ]

View System view Parameter


time-name: Name of a special time range to be referenced. start-time: Start time of the special time range, format as hh:mm. end-time: End time of the special time range, format as hh:mm. days-of-the-week: Determines on which day(s) of a week in the special time

range a command takes effect. The command takes effect everyday within the time range, if this parameter is omitted. You can specify this parameter with any of the following values:

Numbers (ranging from 0 to 6); Monday, Tuesday, Wednesday, Thursday, Friday, Saturday or Sunday; working-day, representing 5 working days, from Monday to Friday; off-day, representing Saturday and Sunday;

from start-date: Start date of the special time range, determining effective days

of the time range with the end-date, format as hh:mm MM-DD-YYYY.


to end-date: End date of the special time range, determining effective days of

the time range with the start-date, format as hh:mm MM-DD-YYYY. If the above two parameters are omitted, there is no limit to the effective date. Description

Use the time-range command to configure a time range. Use the undo time-range command to delete a time range.

If you input the parameter when using the undo time-range command, the system will delete the corresponding content of the time range according to the parameter input. Example Configure a time range being effective since zero hour on January 1, 2000 and forever.
[SW7700]time-range test from 0:0 1-1-2000

QoS Configuration Commands List

343

QoS Configuration Commands List


display mirroring-group

This section describes how to use the Quality of Service (QoS) configuration commands on your Switch 7700.

Syntax
display mirroring-group [ groupid ]

View All views Parameter


groupid: mirroring group number, range from 1 to 20.

Description Use the display mirroring-group command to view the parameter settings of port mirror. The displayed information includes the port to be monitored, direction of the monitored packets, observing port, and so on. Related command: mirroring-group. Example Display parameter settings of port mirror.
[SW7700]display mirroring-group mirroring-group 1 inbound Ethernet6/0/1 mirrored-to Ethernet6/0/2

display priority-trust

Syntax
display priority-trust

View All views Parameter None Description Use the display priority-trust command to view the settings of priority used for putting the packet into the sending queue. Related command: priority-trust. Example Display the settings of priority used for putting the packet into the sending queue.
<SW7700>display priority-trust Priority trust mode: local-precedence

display qos cos-local-precedencemap

Syntax
display qos cos-local-precedence-map

344

CHAPTER 7: USING QOS/ACL COMMANDS

View All views Parameter None Description Use the display qos cos-local-precedence-map command to view COS->Local-precedence map. Example Display COS->Local -precedence map.
<SW7700>display qos cos-local-precedence-map cos-local-precedence-map: cos : 0 1 2 3 4 5 6 7 -------------------------------------------------------------------local-precedence : 2 0 1 3 4 5 6 7

display qos-interface all

Syntax
display qos-interface [ interface-name | interface-type interface-num ] all

View All views Parameter interface-name | interface-type interface-num: Specifies a port of the switch. For more information, refer to the Using Port Commands on page 331. Description Use the display qos-interface all command to view the QoS setting of all the ports. If you do not input the port parameters, the command will display all the QoS settings on the switch, including rate limit and line rate etc. If you set the port parameters, the configuration information about the specified port will be displayed. Example Display the QoS settings of all the ports.
<SW7700>display qos-interface all Ethernet1/0/2: traffic-limit Input: Matches: access-list 2000 rule 0 Target rate: 4 Mbps

running

display qos-interface line-rate

Syntax
display qos-interface [ interface-name | interface-type interface-num ] line-rate

QoS Configuration Commands List

345

View Any view Parameter


interface-name | interface-type interface-num: Interface of the switch, for a detailed description see Using Port Commands on page 49.

Description Use the display qos-interface line-rate command to view the traffic rate limitations of the interface output. If you do not specify interface parameters, you will view the traffic rate limitations of all interfaces output. If you enter interface parameters, you will view the parameter settings of traffic rate limitations of the specified interfaces output. Example Display the parameter configuration of interface traffic rate limitation.
[SW7700-Ethernet3/0/4]display qos-interface line-rate Ethernet3/0/2: line-rate Line rate: 3 Mbps Ethernet3/0/4: line-rate Line rate: 5 Mbps

Table 33 Field Description


Field Ethernet3/0/2: line-rate Line rate: 3 Mbps Description Rate limitation configuration at interface Ethernet3/0/2: The maximum sum of all the packets rates at the Ethernet3/0/2 interface is 3Mbps

display qos-interface traffic-bandwidth

Syntax
display qos-interface [ interface-name | interface-type interface-num ] traffic-bandwidth

View All views Parameter


interface-name | interface-type interface-num: Specifies a port of the switch. For more information, refer to the Using Port Commands on page 331.

Description Use the display qos-interface traffic-bandwidth command to view the settings of bandwidth. Related command: traffic-bandwidth. Example Display the settings of traffic bandwidth assurance.
<SW7700>display qos-interface traffic-bandwidth

346

CHAPTER 7: USING QOS/ACL COMMANDS

display qos-interface traffic-limit

Syntax
display qos-interface [ interface-name | interface-type interface-num ] traffic-limit

View All views Parameter


interface-name | interface-type interface-num: Specifies a port of the

switch. For more information, refer to the Using QoS/ACL Commands on page 331. Description Use the display qos-interface traffic-limit command to view the settings of rate limit. The information displayed includes the ACL of the traffic to be limited, the limited average rate and the settings of some related policing action. Related commands: traffic-limit. Example Display the settings of traffic limit.
<SW7700>display qos-interface traffic-limit Ethernet1/0/1: traffic-limit Input: Matches: access-list 2000 rule 0 running Target rate: 10 Mbps Ethernet1/0/2: traffic-limit Input: Matches: access-list 2000 rule 0 running Target rate: 100 Mbps

display qos-interface traffic-priority

Syntax
display qos-interface [ interface-name | interface-type interface-num ] traffic-priority

View All views Parameter


interface-name | interface-type interface-num: Specifies a port of the

switch. Description Use the display qos-interface traffic-priority command to view the settings of traffic priority. This command is used for displaying the settings of traffic priority. The information displayed includes the ACL corresponding to the traffic tagged with priority, priority type and value. Related command: traffic-priority.

QoS Configuration Commands List

347

Example Display the settings of traffic priority.


<SW7700>display qos-interface traffic-priority traffic-priority Matches: access-list std1 rule 0 running Priority action: dscp ef Matches: access-list std1 rule 1 running Priority action: dscp ef

display qos-interface traffic-red

Syntax
display qos-interface [ interface-name | interface-type interface-num ] traffic-red

View All views Parameter


interface-name | interface-type interface-num: Specifies a port of the

switch. Description Use the display qos-interface traffic-red command to view the settings of RED operation. Related command: traffic-red. Example Display the settings of RED.
<SW7700>display qos-interface traffic-red

display qos-interface traffic-redirect

Syntax
display qos-interface [ interface-name | interface-type interface-num ] traffic-redirect

View Any view Parameter


interface-name | interface-type interface-num: Interface of the switch, for

more detail, see Using Port Commands on page 49. Description Use the display qos-interface traffic-redirect command to view the settings of the redirection parameters. The displayed content includes the corresponding ACLs of the traffic to be redirected, the redirected interfaces, etc. Related command: traffic-redirect. Example Display the redirection parameter configuration.

348

CHAPTER 7: USING QOS/ACL COMMANDS

<SW7700>display qos-interface traffic-redirect traffic-redirect Matches: acl std1 rule 0 running Redirected to: interface Ethernet5/0/2 Matches: acl std1 rule 1 running Redirected to: interface Ethernet5/0/2

Table 34 Field Explanation


Field traffic-redirect Matches: acl std1 rule 0 running Redirected to: interface Ethernet5/0/2 Explanation Packet redirection configuration: Matches: acl std1 rule 0 running Redirected to: interface Ethernet5/0/2 means the packets that match with subrule 0 of the ACL std1 will be redirected to the interface Ethernet5/0/2. Matches: acl std1 rule 1 running Redirected to: interface Ethernet5/0/2 means the packets that match with subrule1 of the ACL std1 will be redirected to the interface Ethernet5/0/2.

Matches: acl std1 rule 1 running Redirected to: interface Ethernet5/0/2

display qos-interface traffic-statistic

Syntax
display qos-interface [ interface-name | interface-type interface-num ] traffic-statistic

View All views Parameter


interface-name | interface-type interface-num: Specifies a port of the

switch. Description Use the display qos-interface traffic-statistic command to view the traffic statistics information. This command is used for displaying the traffic statistics information. The information displayed includes the ACL corresponding to the traffic to be counted and the number of packets counted. Related command: traffic-statistic. Example Display the traffic statistics information.
<SW7700>display qos-interface traffic-statistic traffic-statistic Matches: access-list std1 rule 0 running 0 packets Matches: access-list std1 rule 1 running 0 packets

QoS Configuration Commands List

349

line-rate

Syntax
line-rate target-rate undo line-rate

View Ethernet interface view Parameter


target-rate: The total limited rate of the packets sent by interfaces, ranging

from 1 to 1000, in Mbps. Description Use the line-rate command to limit the total rate of the packets delivered by interfaces. Use the undo line-rate command to cancel the limit rate . NOTE: Only the 20-Port 10/100/1000BASE-T and 20-Port 1000BASE-X-SFP I/O modules support the port rate limitation. Example Set the rate limitation of interface GigabitEthernet7/0/1 to 10 Mbps.
[SW7700-qosb-GigabitEthernet7/0/1]line-rate 10

mirroring-group

Syntax
mirroring-group groupId { inbound | outbound } mirroring-port-list &<1-8> mirrored-to monitor-port undo mirroring-group groupId

View System view Parameter


groupId: mirroring group number, range from 1 to 20. inbound: Indicates the direction of the monitored packets. inbound means to

monitor the packets received through the port.


outbound: Indicates the direction of the monitored packets. outbound means to

monitor the packets sent from the port.


mirroring-port-list&<1-8>: Ethernet port list, containing multiple Ethernet ports and expressed as port-list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }. For detailed information about interface_type, interface_num and interface_name, refer to corresponding descriptions of interface command in

Using Port Commands on page 49. &<1-8> means that you can input the preceding parameters up to 8 times.
mirrored-to monitor-port: Indicates the monitor port.

350

CHAPTER 7: USING QOS/ACL COMMANDS

Description

Use the mirroring-group command to configure the mirroring group of the switch. Use the undo mirroring-group command to cancel the configuration of mirroring group.

The Switch 7700 implements the mirroring function by configuring a mirroring group. Every mirroring group has one monitor port and a group of monitored ports. The packets received or sent by monitored ports will monitored by monitor port. The direction of the monitored packets can be also specified. A port mirroring configuration has the following limitations:

The monitor port and the monitored ports must be the ports in the same interface card. For the 48-ports FE interface card, the monitor port and the monitored ports must be within port 1 to port 24 or within port 25 to port 48.

Example Configure mirroring group 1, ethernet3/0/1 to ethernet3/0/3 as the monitored port, ethernet3/0/4 as monitor port, and receiving packets at the ports will be monitored.
[SW7700]mirroring-group 1 inbound ethernet3/0/1 to ethernet3/0/3 mirrored-to ethernet3/0/4

priority

Syntax
priority priority-level undo priority

View Ethernet Port views Parameter


priority-level: Specifies the priority level of the port, ranging from 0 to 7.

Description

Use the priority command to configure the priority of Ethernet port. Use the undo priority command to restore the default port priority.

By default, the priority level of the port is 0. If an untagged packet is received on the port, the switch tags the packet and assigns a 802.1p priority which matches the port's priority setting. When the packet is transmitted it assumes the 802.1Q characteristics of the transmitting port. If the transmitting port is tagged 801.Q, the packet retains the 802.1p priority it received from the inbound port. If the transmitting port is not tagged 802.1Q, the packet is transmitted with no 802.1Q tag and no 802.1p priority.

QoS Configuration Commands List

351

If a tagged packet is received on the port with or without 802.1p priority, no action is taken and the priority is carried through the switch. If the transmitting port is tagged 801.Q, the packet is transmitted with its original 802.1p priority. If the transmitting port is not tagged 802.1Q, the packet is transmitted with no 802.1Q tag and no 802.1p priority. Example Set the priority of Ethernet1/0/1 port to 7.
[SW7700-Ethernet1/0/1]priority 7

priority trust

Syntax
priority trust { dscp | ip-precedence | cos | local-precedence }

View System view Parameter


dscp: Sets the queue scheduling based on dscp priority. ip-precedence: Sets the queue scheduling based on IP precedence. cos: Sets the queue scheduling based on cos priority. local-precedence: Sets the queue scheduling based on local-precedence.

Description Use the priority trust command to add the packet to the corresponding sending queue based on the priority set for queue scheduling. By default, switch chooses the local preference as the base priority. This command is not supported by the 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK modules. For these modules, the packets are added to the port output queue by 802.1p priority only. The Switch 7700 only supports strict precedence queue scheduling mode, but it can choose different levels of precedence when it puts the packets into the port output queue. The Switch 7700 supports 8 output queues with different priorities. The packets in the higher-priority queue will be transmitted first. The switch puts the packets into the corresponding output queues according to their priorities as follows: 1 Based on dscp priority: The dscp priorities cover the range from 0 to 63. The packets with priorities ranging from 0 to 7 will be put into the queue 0, the packets with priorities ranging from 8 to 15 will be put into the queue 1, so on and so forth. 2 Based on ip-precedence: The ip-precedence cover the range from 0 to 15. The packets with priorities ranging from 0 to 1 will be put into the queue 0, the packets with priorities ranging from 2 to 3 will be put into the queue 1, so on and so forth.

352

CHAPTER 7: USING QOS/ACL COMMANDS

3 Based on cos priority: The cos priorities cover the range from 0 to 7. The packets with priority 0 will be put into the queue 0, so on and so forth. 4 Based on local-precedence: The local-precedence priorities cover the range from 0 to 7. The packets with priority 0 will be put in the queue 0, so on and so forth. You can configure the packet priority basis for the queue scheduling in accordance with the actual situation. Example Configure the queue scheduling based on dscp priority.
[SW7700]priority trust dscp

qos

Syntax
qos

View Ethernet interface view Parameter None Description Use the qos command to enter QoS view and perform the QoS configuration. NOTE: Switch 7700 I/O modules support different QoS functions. You can use ? to query the supported QoS configurations after entering different QoS views. Example Enter QoS view and query the QoS configuration supported by the interface card.
[SW7700-GigabitEthernet7/0/1]qos [SW7700-qosb-GigabitEthernet7/0/1]? Qosb view commands: display Display current system information line-rate Limit the rate of the outbound packets of the interface packet-filter Filter packets based on acl ping Ping function quit Exit from current command view reset Reset operation tracert Trace route function traffic-limit Limit the rate of the packets traffic-priority Specify new priority of the packets traffic-redirect Redirect the packets traffic-statistic Count the packets undo Cancel current setting

QoS Configuration Commands List

353

qos cos-local-precedencemap

Syntax
qos cos-local-precedence-map cos0-map-local-prec cos1-map-local-prec cos2-map-local-prec cos3-map-local-prec cos4-map-local-prec cos5-map-local-prec cos6-map-local-prec cos7-map-local-prec undo qos cos-local-precedence-map

View System view Parameter


cos0-map-local-prec: Specifies the mapping value of COS 0->local-prec, which ranges from 0 to 7. cos1-map-local-prec: Specifies the mapping value of COS 1->local-prec, which ranges from 0 to 7. cos2-map-local-prec: Specifies the mapping value of COS 2->local-prec, which ranges from 0 to 7. cos3-map-local-prec: Specifies the mapping value of COS 3->local-prec, which ranges from 0 to 7. cos4-map-local-prec: Specifies the mapping value of COS 4->local-prec, which ranges from 0 to 7. cos5-map-local-prec: Specifies the mapping value of COS 5->local-prec, which ranges from 0 to 7. cos6-map-local-prec: Specifies the mapping value of COS 6->local-prec, which ranges from 0 to 7. cos7-map-local-prec: Specifies the mapping value of COS 7->local-prec, which ranges from 0 to 7.

Description

Use the qos cos-local-precedence-map command to configure COS ->Local-precedence map. Use the undo qos cos-local-precedence-map command to restore its default value.

By default, the system provides the default COS ->Local-precedence mapping relationship.
Table 35 The default COS ->Local-precedence map
COS 2 0 1 3 Local Precedence 0 1 2 3

354

CHAPTER 7: USING QOS/ACL COMMANDS

Table 35 The default COS ->Local-precedence map


4 5 6 7 4 5 6 7

If needed, you can change COS->Local-precedence map using the command. Example Configure COS->Local-precedence map.
[SW7700]qos cos-local-precedence-map 0 1 2 3 4 5 6 7

After the configuration, the COS->Local-precedence map is shown in Table 1-6.


Table 36
COS 0 1 2 3 4 5 6 7

COS->Local-precedence map
Local Precedence 0 1 2 3 4 5 6 7

reset traffic-statistic

Syntax for 48-port 10/100BASE-T Auto-sensing FE, 8-port 1000BASE-X GE, 8-port 10/100/1000BASE-T GE, and 24-port 100BASE-FX MMF FE Modules
reset traffic-statistic { inbound | outbound } { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

Syntax for 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK Modules
reset traffic-statistic inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* }

Activating both IP ACL and link ACL is supported by 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK modules. However, the sum of the bytes number defined by the IP ACL the link ACL cannot exceed 32 bytes. View QoS view Parameters
ip-group { acl-number | acl-name } [ rule rule ]: Specifies a basic or advanced ACL. acl-number: Specifies the ACL sequence number, ranging from

QoS Configuration Commands List

355

2000 to 3999. acl-name: Specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule: Specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered.
link-group { acl-number | acl-name } [ rule rule ]: Specifies a Layer-2 ACL. acl-number: Specifies the ACL sequence number, ranging from 5000 to 5999, acl-name: Specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule:

Specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered.
user-group { acl-number | acl-name }: activate the user-defined ACL. acl-number specifies the ACL number, ranging from 5000 to 5999. acl-name

specifies the ACL name with a character string that starts with a to z or A to Z, excluding spaces and quotation marks. Description Use the reset traffic-statistic command to reset the traffic statistics information.
Table 37 Comparison of Statistics Information reset Commands
Command reset acl counter Function Reset the statistics information of the ACL which is used in the case of filtering or classifying the data treated by the software of switch. The case includes: ACL cited by route policy function, ACL used for control logon user, etc. The ACL number ranges from 2000 to 3999. Reset statistic information of traffic. This command is used in the case of filtering or classifying the data transmitted by the hardware of switch. Commonly, this command is used to reset the statistics information of the traffic-statistic command.

reset traffic-statistic

Example Clear the statistics information about ACL 2000.


[SW7700-Ethernet1/0/1]reset traffic-statistic ip-group 2000

traffic-bandwidth

Syntax
traffic-bandwidth outbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } min-guaranteed-bandwidth max-guaranteed-bandwidth weight undo traffic-bandwidth outbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

View Ethernet port view Parameter


outbound: specify the traffic sent by the Ethernet port. ip-group { acl-number | acl-name } [ rule rule ]: Specifies a basic or advanced ACL. acl-number: Specifies the ACL sequence number, ranging from 2000 to 3999. acl-name: Specifies the ACL name with a character string starting with

356

CHAPTER 7: USING QOS/ACL COMMANDS

English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule: Specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered.
link-group { acl-number | acl-name } [ rule rule ]: Specifies a Layer-2 ACL. acl-number: Specifies the ACL sequence number, ranging from 4000 to 4999, acl-name: Specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule: Specifies

a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered.
min-guaranteed-bandwidth: Reserves the minimum bandwidth in the unit of

Kbit/s, ranging from 0 to 8388608. The value must be multiple of 64kbit/s.


max-guaranteed-bandwidth: Sets the maximum bandwidth in the unit of Kbit/s,

ranging from 0 to 8388608. The value must be multiple of 64kbit/s.


weight: Bandwidth weight, ranging from 1 to 100. The value indicates the percentage of bandwidth weight. The weight parameter is used for a case in

which there are many traffic streams on one port. For example, if there are two traffic streams on one port, the minimum bandwidths are both set to 2M, the maximum bandwidths are both set to 8M, one stream weight is set to 40%, other is set to 80%, and the port bandwidth is 10M. So the port cant satisfy the requirement of the total maximum bandwidth of 16M. After assurance the minimum bandwidth of the two traffic streams, the port remains 6 M bandwidth. If the bandwidths demanded by the two traffic streams do not exceed the minimum bandwidth configured, the bandwidth of the two traffic streams are the actual bandwidth they demand. If the bandwidths demanded by the two traffic streams exceed the minimum bandwidth configured, the 6M bandwidth will distribute to the two traffic streams according the ratio of weight (40%:80%=1:2). Supposing the bandwidth of the first traffic demand is A, the bandwidth of the second traffic demand is B, then A=2M+ (10M-2*2M)*40%/(40%+80%)=4M, B=2M+ (10M-2*2M)*80%/(40%+80%)=6M. The case that many traffic configured on the port: suppose there are N traffic streams on the port, the port bandwidth is Bp, the minimum bandwidth of i traffic streatm is Bimin, the maximum bandwidth of i traffic stream is Bimax, and weight is Wi. If the bandwidths demanded by the traffic streams exceed the minimum bandwidth configured and the sum of Bimax exceeds Bp, the actual bandwidth of i traffic stream Bi= Bimin+(Bp-)*Wi/. Description

Use the traffic-bandwidth command to reserve QoS bandwidth. Use the undo traffic-bandwidth command to cancel the reserved QoS bandwidth.

This command assures the specified traffic stream the minimum bandwidth and maximum bandwidth and configures a weight parameter.

QoS Configuration Commands List

357

Example Set reserve minimum bandwidth 64k and maximum bandwidth 128k, weight is 20.
[SW7700-Ethernet3/0/1]traffic-bandwidth outbound ip-group 1 64 128 20

traffic-limit

Syntax for 48-port 10/100BASE-T Auto-sensing FE, 8-port 1000BASE-X GE, 8-port 10/100/1000BASE-T GE, and 24-port 100BASE-FX MMF FE Modules
traffic-limit { inbound | outbound } { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } target-rate undo traffic-limit { inbound | outbound } { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

Syntax for 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, 1-port 10GBASE-R-XENPAK Modules


traffic-limit inbound { user-group { acl-number | acl-name } [ rule rule ] | ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* } target-rate [ exceed action ] undo traffic-limit inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* }

Activating both an IP ACL and a link ACL is supported by 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, 1-port 10GBASE-R-XENPAK modules. However, the sum of the bytes number defined by the IP ACL and the link ACL cannot exceed 32 bytes. View QoS view Parameter
inbound: specify the traffic received by the Ethernet port. outbound: specify the traffic sent by the Ethernet port. ip-group { acl-number | acl-name } [ rule rule ]: Specifies a basic or advanced ACL. acl-number specifies the ACL sequence number, ranging from 2000 to 3999. acl-name specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule specifies a rule of an ACL, ranging from 0 to 127. If you do not set this

parameter, all the rules will be considered.


link-group { acl-number | acl-name } [ rule rule ]: Specifies a Layer-2 ACL. acl-number specifies the ACL sequence number, ranging from 4000 to 4999, acl-name specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule

specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered.

358

CHAPTER 7: USING QOS/ACL COMMANDS

target-rate: Specifies the normal rate, range from 64 to 8388608, measured in

kbps, and the value should be a multiple of 64k.


exceed action: (Optional) The action taken when the traffic exceeds the threshold. Only the 20-Port 10/100/1000BASE-T. and20-port 1000BASE-X-SFP modules support this parameter. The action can be:

drop: Drops the packets. remark-dscp value: Sets a new DSCP value.

Description

Use the traffic-limit command to enable ACL traffic identification and perform limiting the rate of the traffic matching the specified ACL (whose action is permit). Use the undo traffic-limit command to cancel the rate limit.

Example Limit the rate of the traffic matching the ACL 2000 rules, whose action is permit. The normal traffic rate is set to 128kbps.
[SW7700-qoss-Ethernet3/0/1]traffic-limit inbound ip-group 2000 128

traffic-priority

Syntax for 48-port 10/100BASE-T Auto-sensing FE, 8-port 1000BASE-X GE, 8-port 10/100/1000BASE-T GE, and 24-port 100BASE-FX MMF FE Modules
traffic-priority outbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } { { dscp dscp-value | ip-precedence pre-value } | local-precedence pre-value }* undo traffic-priority outbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

Syntax for 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, 1-port 10GBASE-R-XENPAK Modules


traffic-priority { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* } { { dscp dscp-value | ip-precedence pre-value | local-precedence pre-value | cos cos-value } undo traffic-priority inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* }

Activating both an IP ACL and a link ACL is supported by 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, 1-port 10GBASE-R-XENPAK modules. However, the sum of the bytes number defined by the IP ACL and the link ACL cannot exceed 32 bytes. View QoS view

QoS Configuration Commands List

359

Parameter
inbound: Performs priority marking to the packets received by the interface. Only

20-Port 10/100/1000BASE-T and 20-Port 1000BASE-X-SFP I/O modules interface cards support this parameter.
outbound: Performs priority marking to the packets sent by the interface. 20-Port

10/100/1000BASE-T and 20-Port 1000BASE-X-SFP I/O modules do not support this parameter.
ip-group { acl-number | acl-name } [ rule rule ]: Specifies a basic or advanced ACL. acl-number specifies the ACL sequence number, ranging from 2000 to 3999. acl-name specifies the ACL name with a character string starting of up to 32 English letters ([a-z, A-Z]), excluding spaces and quotation marks. rule rule specifies a rule of an ACL, ranging from 0 to 127. If you do not set this

parameter, all rules will be considered.


link-group { acl-number | acl-name } [ rule rule ]: Specifies a Layer-2 ACL. acl-number specifies the ACL sequence number, ranging from 4000 to 4999, acl-name specifies the ACL name with a character string of up to 32 English letters ([a-z, A-Z]), excluding spaces and quotation marks. rule rule specifies a

rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all rules will be considered.
user-group { acl-number | acl-name }: Activates the user-defined ACL. acl-number: Specifies the ACL number, ranging from 5000 to 5999. acl-name:

Specifies the ACL name with a character string that starts with a to z or A to Z.
dscp dscp-value: Specifies DSCP preference, ranging from 0 to 63. ip-precedence pre-value: Specifies IP preference. pre-value specifies the IP

preference, ranging from 0 to 7.


local-precedence pre-value: Specifies the local preference, ranging from 0 to

7.
cos: Specifies the COS preference, ranging from 0 to 7.

Description

Use the traffic-priority command to activate an CL and tag the traffic priority (whose action is permit). Use the undo traffic-priority command to cancel the traffic priority settings.

This command can mark three priorities (dscp/IP preference, and cos) for the packets. The switch can put the packets into egress queue according to the cos value (namely the 802.1p preference) or local preference. If both 802.1p preference and local preference are set, the switch will use the 802.1p preference first. Related command: display qos-interfacee traffic-priority.

360

CHAPTER 7: USING QOS/ACL COMMANDS

Example Mark the priority for the packets that match the permit rules of ACL 2000. It sets the local preference to 0:
[SW7700-qoss-Ethernet3/0/1]traffic-priority outbound ip-group 2000 local-precedence 0

traffic-red

Syntax
traffic-red outbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } qstart qstop probability undo traffic-red outbound { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

View Ethernet port view Parameter


outbound: specify the traffic sent by the Ethernet port. ip-group { acl-number | acl-name } [ rule rule ]: Specifies a basic or advanced ACL. acl-number specifies the ACL sequence number, ranging from 2000 to 3999. acl-name specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule specifies a rule of an ACL, ranging from 0 to 127. If you do not set this

parameter, all the rules will be considered.


link-group { acl-number | acl-name } [ rule rule ]: Specifies a Layer-2 ACL. acl-number specifies the ACL sequence number, ranging from 4000 to 4999, acl-name specifies the ACL name with a character string starting with English letters ([a-z, A-Z]) and excluding space and quotation mark. rule rule specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered. qstart: Start random discarding queue length, if the queue is shorter than the value, no packet will be dropped, ranging from 0 to 262128. The value must be multiple of 16kbit/s. qstop: Specifies the upper limit to random dropping action. If the queue is longer than the value, all the packets arriving later will be dropped, ranging from 0 to 262128. The value must be multiple of 16kbit/s. probability: Specifies the dropping probability between the qstart and qstop

values, ranging from 0 to 100 (percent). Description


Use the traffic-red command to configure RED parameters. Use the undo traffic-red command to cancel the RED configuration.

QoS Configuration Commands List

361

Example Set Start random discarding queue length 64k and Stop random discarding queue length 128k, Probability of discarding is 20.
[SW7700-Ethernet3/0/1]traffic-red outbound ip-group 1 64 128 20

traffic-redirect

Syntax
traffic-redirect inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } { cpu | interface { interface-name | interface-type interface-num } } undo traffic-redirect inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

View QoS view Parameter


inbound: Performs traffic redirection to the packets received by the interface. ip-group { acl-number | acl-name } [ rule rule ]: the basic or advanced ACLs; acl-number is the sequence number of ACLs, ranging from 2000 to 3999; acl-number is the name of ACLs, character string, which must start with an letter (a-z or A-Z), and there should not be a space or quotation mark in it; rule rule

specifies a subitem of an ACL, ranging from 0 to 127, it represents all the subitems of the ACL if not specified.
link-group { acl-number | acl-name } [ rule rule ]: The Layer 2 ACL; acl-number is the sequence number of an ACL, ranging from 4000 to 4999; acl-name is the name of an ACL, character string, which must start with an letter (a-z or A-Z), excluding spaces or quotation marks; rule rule specifies the subitem

of an ACL, ranging from 0 to 127, it represents all the subitems of the ACL if not specified.
user-group { acl-number | acl-name } [ rule rule ]: activates the user-defined ACL; acl-number is the sequence number of an ACL, ranging from 5000 to 5999; acl-name is the name of an ACL, a character string, which must start with an letter (a-z or A-Z), excluding spaces or quotation marks; rule rule specifies the subitem of an ACL, ranging from 0 to 127, it represents all the subitems of the ACL if not specified. cpu: Redirects to CPU. interface { interface-name | interface-type interface-num }: Redirects the packets to the specified Ethernet interface, interface-type is the interface type which can be GigabitEthernet only; interface-num is the number of

interface and represents a complete interface name together with interface-type;


interface-name is equal to interface-type plus interface-num.

362

CHAPTER 7: USING QOS/ACL COMMANDS

Description Use the traffic-redirect command to activate an ACL and perform redirection (the command is only effective to permit rule). Use the undo traffic-redirect command, you can remove the redirection. Related command: display qos-interface traffic-redirect Only the 20-Port 10/100/1000BASE-T, 20-Port 1000BASE-X-SFP I/O, and 1-port 10GBASE-R-XENPAK I/O modules support the packet redirecting configuration. Example Perform redirection of the packets that match with the permit rule of ACL 2000. Redirect the packets to interface GigabitEthernet0/1.
[SW7700-qosb-GigabitEthernet7/0/1]traffic-redirect inbound ip-group 2000 interface gigabitethernet7/0/2

traffic-statistic

Syntax for 48-port 10/100BASE-T Auto-sensing FE, 8-port 1000BASE-X GE, 8-port 10/100/1000BASE-T GE, and 24-port 100BASE-FX MMF FE I/O Modules
traffic-statistic { inbound | outbound } { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] } undo traffic-statistic { inbound | outbound } { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }

Syntax for 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, 1-port 10GBASE-R-XENPAK I/O Modules
traffic-statistic inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* } undo traffic-statistic inbound { user-group { acl-number | acl-name } [ rule rule ] | { ip-group { acl-number | acl-name } [ rule rule ] | link-group { acl-number | acl-name } [ rule rule ] }* }

Combined activating of IP ACL and link ACL is supported by 20-Port 10/100/1000BASE-T, 20-port 1000BASE-X-SFP, and 1-port 10GBASE-R-XENPAK I/O modules. But the sum of the bytes number defined by IP ACL and that defined by the link ACL can not exceed 32 bytes; otherwise the ACL can not be activated View QoS view Parameter
inbound: specify the traffic received by the Ethernet port. outbound: specify the traffic sent by the Ethernet port. ip-group { acl-number | acl-name } [ rule rule ]: Specifies a basic or advanced ACL. acl-number specifies the ACL sequence number, ranging from

Logon Users ACL Control Command

363

2000-3999. acl-name specifies the ACL name with a character string starting with letters (a-z or A-Z]) and excluding spaces and quotation marks. rule rule specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered.
link-group { acl-number | acl-name } [ rule rule ]: Specifies a Layer-2 ACL. acl-number specifies the ACL sequence number, ranging from 4000 to 4999, acl-name specifies the ACL name with a character string starting with letters (a-z or A-Z) and excluding space and quotation mark. rule rule specifies a rule of an ACL, ranging from 0 to 127. If you do not set this parameter, all the rules will be considered. user-group { acl-number | acl-name }: activate the user-defined ACL. acl-number Specifies the ACL number, ranging from 5000 to 5999. acl-name

Specifies the ACL name with a character string starting with letters (a to z or A to Z), excluding spaces and quotation marks. Description

Use the traffic-statistic command to activate the ACL to recognize and count the traffic (whose action is permit). Use the undo traffic-statistic command to cancel the traffic statistics.

The statistics information of traffic-statistic command includes the matched times of the transmitted data by switch. User can use display traffic-statistic command to display the statistics information. Related command: display qos-interface traffic-statistic. Example Count the packets matching the ACL 2000 rules with action permit.
[SW7700-qoss-Ethernet3/0/1]traffic-statistic inbound ip-group 2000

Logon Users ACL Control Command


acl

This section describes how to use the Logon users ACL control commands on your Switch 7700. Syntax
acl acl-number { inbound | outbound } undo acl { inbound | outbound }

View User-interface view Parameter


acl-number: Specifies a basic ACL with a number in the range of 2000 to 2999. inbound: Perform ACL control over the users that telnet to the local switch. outbound: Perform ACL control over the users that telnet to other switches from the local switch.

364

CHAPTER 7: USING QOS/ACL COMMANDS

Description Use the acl command to call an ACL and perform ACL control over the TELNET users. This command calls numbered basic ACL only. Example Performs ACL control over the users that telnet to the local switch. (ACL 2000 has been defined.)
[SW7700]user-interface vty 0 4 [SW7700-user-interface-vty0-4]acl 2000 inbound

snmp-agent community

Syntax
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number ] undo snmp-agent community community-name

View System view Parameter


community-name: Community name character string. mib-view view-name: MIB view name. read: Indicate that MIB object can only be read. write: Indicate that MIB object can be read and written. acl acl-number: the number of basic ACL, ranging from 2000 to 2999.

Description

Use the snmp-agent community command to configure the community name, and perform the ACL control over the network management user through the parameter acl acl-number. Use the undo snmp-agent community command to cancel the configuration of community name.

Example Configures MyCompany as the community name, allows read-only access to the switch by the name, meanwhile, performs the ACL control to the network management user by ACL 2000. (ACL 2000 has been defined.)
[SW7700]snmp-agent read community MyCompany acl 2000

snmp-agent group

Syntax
snmp-agent group { v1 | v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] undo snmp-agent group { v1 | v2c } group-name

Logon Users ACL Control Command

365

snmp-agent group v3 group-name [ authentication | privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] undo snmp-agent group v3 group-name [ authentication | privacy ]

View System view Parameter


v1: Configure to use V1 safe mode. v2c: Configure to use V2c safe mode. v3: Configure to use V3 safe mode. groupname: Group name, ranging from 1 to 32 bytes. auth: If this parameter is added to configuration command, the system will

authenticate but not encrypt SNMP data packets.


privacy-mod: Configure to authenticate and encrypt the SNMP data packets. This

parameter is supported only in the extended version of the software.


read-view: Configures to allow read-only view settings. readview: Read-only view name, ranging from 1 to 32 bytes. write-view: Configure to allow read-write view settings. writeview: Name of read-write view, ranging from 1 to 32 bytes. notify-view: Configure to allow notify view settings. notifyview: Specify the notify view name, ranging from 1 to 32 bytes. acl acl-number: Specify the number of a basic ACL, ranging from 2000 to 2999 priv-password: Specify the password for authentication and encryption. This parameter is supported only in the extended version of the software.

Description

Use the snmp-agent group command to configure a new SNMP group, and perform the ACL control to the group through the parameter acl acl-number. Use the undo snmp-agent group command to cancel the SNMP group.

Example Creates a new SNMP group: MyCompany, and perform the ACL control to the group through ACL 2001. (ACL 2001 has been defined.)
[SW7700]snmp-agent group v1 MyCompany acl 2001

366

CHAPTER 7: USING QOS/ACL COMMANDS

snmp-agent usm-user

Syntax
snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ] undo snmp-agent usm-user { v1 | v2c } user-name group-name snmp-agent usm-user v3 user-name group-name [ authentication-mode { md5 | sha } auth-password ] [ acl acl-number ] undo snmp-agent usm-user v3 user-name group-name { local | engineid engineid-string }

View System view Parameter


username: Specify the user name, ranging from 1 to 32 bytes. groupname: Specify the group name corresponding to that user, a character string

at the length ranging from 1 to 32 bytes.


v1: Configure to use V1 safe mode. v2c: Configure to use V2c safe mode. v3: Configure to use V3 safe mode. authentication-mode: Specify the safety level as authentication required. md5: Specify the authentication protocol HMAC-MD5-96. sha: Specify the authentication protocol HMAC-SHA-96. auth-password: Specify the authentication password with a character string, ranging from 1 to 64 bytes. local: Local entity user. engineid: Specify the related engine ID of the user. acl acl-number: the number of a basic ACL, ranging from 2000 to 2999.

Description

Use the snmp-agent usm-user command to add a new user to an SNMP group, and perform the ACL control to the user through the parameter acl acl-number. Use the undo snmp-agent usm-user command to cancel a user from corresponding SNMP group,meanwhile delete the configuration of the users ACL control.

Logon Users ACL Control Command

367

Example Add a user John for MyGroup (an SNMP group), configure to authenticate with HMAC-MD5-96 and set authentication password as hello, meanwhile perform the ACL control to the user through ACL 2000 (ACL 2000 has been defined).
[SW7700]snmp-agent usm-user v3 John MyGroup authentication-mode md5 hello acl 2000

368

CHAPTER 7: USING QOS/ACL COMMANDS

USING STP COMMANDS

This chapter describes how to use the following commands: MSTP Configuration Commands

active region-configuration check region-configuration display stp display stp region-configuration instance region-name reset stp revision-level stp stp bpdu-protection stp bridge-diameter stp edged-port stp instance cost stp instance port priority stp instance root primary stp instance root secondary stp interface stp interface edged-port stp interface instance cost stp interface instance port priority stp interface loop-protection stp interface mcheck stp interface point-to-point stp interface root-protection stp interface transit-limit stp loop-protection stp max-hops stp mcheck stp mode

370

CHAPTER 8: USING STP COMMANDS

stp pathcost-standard stp point-to-point stp priority stp region-configuration stp root-protection stp tc-protection stp timer forward-delay stp timer hello stp timer max-age stp transit-limit vlan-mapping modulo

MSTP Configuration Commands

This section describes how to use the Multiple Spanning Tree Protocol (MSTP) configuration commands on your Switch 7700. Cisco products adopt a private key to encrypt the configuration digest of MSTP, therefore the link between Cisco products and the Switch 7700 defaults to RSTP.

active region-configuration

Syntax
active region-configuration

View MST region view Parameter None Description Use the active region-configuration command to activate the configurations of MST region. This command is used for manually activate the configurations of MST region. Configuring the related parameters, especially the VLAN mapping table, of the MST region, will lead to the recalculation of spanning tree and network topology flapping. To bate such flapping, MSTP applies the configured parameters and launches recalculation of the spanning tree only when you activate the configured MST region parameters or enable MSTP. After you have entered this command, MSTP will apply the MST region parameters that you configured to the system and recalculate the spanning tree. Related commands: instance, region-name, revision-level, vlan-mapping modulo, check region-configuration. Example Manually activate MST region configurations.
[SW7700-mst-region] active region-configuration

MSTP Configuration Commands

371

check region-configuration

Syntax
check region-configuration

View MST region view Parameter None Description Use the check region-configuration command to view the configuration information (including switch region name, revision level, and VLAN mapping table) that is to be activated. MSTP defines that the user must ensure the correct region configurations, especially the VLAN mapping table configuration. The switches can be configured in the same region only if their region names, VLAN mapping tables, and MSTP revision levels are configured exactly the same. The switch may not be configured in the expected region due to any slight deviation. You can use this command to display the MST region configuration information to be activated to know to which MST regions the switch belongs and check if the MST region configurations are correct. Related commands: instance, region-name, revision-level, vlan-mapping modulo, active region-configuration. Example Display the configuration information about the region.
[SW7700-mst-region] check region-configuration Admin. Configuration: Format selector :0 Region name :00b010000001 Revision level :0 Instance 0 16 Vlans Mapped 1 to 9, 11 to 4094 10

Table 38 The display Information


Field Format selector Region name Revision level Instance Vlans Mapped Region name of MST region MSTP revision level of MST region VLAN mapping table of MST region Description

display stp

Syntax
display stp [ instance instance-id ] [ interface interface-list ] [ brief ][slot slot-number ]

View All views

372

CHAPTER 8: USING STP COMMANDS

Parameter
instance-id: Specifies the spanning tree instance ID, ranging from 0 to 16. interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times. brief: Configure to display the state and protection type of the port only, instead

of any other information.


slot: Displays spanning tree information for the ports in the specified slot.

Description Use the display stp command to view the state information and statistics information of the spanning tree. The MSTP state and statistics information can help analyze and maintain the network topology and maintain the normal operation of MSTP. If no STI ID or port list is specified, the command will display the spanning tree information of all the instances on all the ports in port number order. If the instance ID is specified, the command will display the spanning tree information of the specified instance on all the port in port number order. If only the port list is specified, the command will display the information about all the STIs on the port in port number order. If both the STI ID and port list are specified, the command will displays the spanning tree information of the specified instance on the specified port in instance ID order. MSTP state information include: 1 Global CIST parameter: Protocol operation mode, switch priority in the CIST instance, MAC address, Hello Time, Max Age, Forward Delay, Max Hops, CIST common root, external path cost of the switch to the CIST common root, region root, internal path cost of the switch to the CIST common root, CIST root port of the switch, and whether to enable BPDU protection. 2 CIST port parameter: Port state, role, priority, path cost, designated bridge, designated port, edge port/non-edge port, whether connected to the point-to-point link, port transit limit, whether to enable Root protection, whether being a region edge port, Hello Time, Max Age, Forward Delay, Message-age time, and Remaining-hops. 3 Global MSTIs parameter: MSTI instance ID, bridge priority of the instance, region root, internal path cost, MSTI root port, and MASTER bridge. 4 MSTIs port parameter: Port state, role, priority, path cost, designated bridge, and Remaining Hops. Statistics information: Count of TCN, CONFIG BPDU, RST, and MST BPDU transmitted/received via the port. Related command: reset stp.

MSTP Configuration Commands

373

Example Display the state and statistics information about the spanning tree.
<SW7700<> display stp instance 0 interface ethernet5/0/1 yp ryjrtmry5/0/10 brief MSTID Port Role STP State Protection 0 Ethernet0/1 DESI FORWARDING none 0 Ethernet0/2 DESI FORWARDING none 0 Ethernet0/3 DESI FORWARDING none 0 Ethernet0/4 DESI FORWARDING none 0 Ethernet0/5 DESI FORWARDING none 0 Ethernet0/6 DESI FORWARDING none 0 Ethernet0/7 DESI FORWARDING none 0 Ethernet0/8 DESI FORWARDING none 0 Ethernet0/9 DESI FORWARDING none 0 Ethernet0/10 DESI FORWARDING none

The above information indicates that the MSTIDs of the Ethernet5/0/1 through Ethernet5/0/10 are all 0, that is, all these ports belong to CIST.
Table 39 The display Information
Field MSTID Port STP State Protection Description MST instance ID of the port Port number STP State of the port, which can be up or down. Protection of the port, which can be protected or none

display stp region-configuration

Syntax
display stp region-configuration

View All views Parameter None Description Use the display stp region-configuration command to view the effective MST region configurations . MST region configuration information includes: format selector, region name, region revision level, and associations between VLANs and STIs. All these configurations together determine to which MST region a switch belongs. Related command: stp region-configuration. Example Display the MST region configuration information.
<SW7700>display stp region-configuration Oper. Configuration: Format selector :0

374

CHAPTER 8: USING STP COMMANDS

Region name Revision level Instance 0 1 2

:3Com :0

Vlans Mapped 21 to 4094 1 to 10 11 to 20

Table 40 The display Information


Field Format selector Region name Revision level Instance Vlans Mapped Region name of MST region MSTP revision level of MST region VLAN mapping table of MST region Description

instance

Syntax
instance instance-id [ vlan vlan-list ] undo instance instance-id [ vlan vlan-list ]

View MST region view Parameter


instance-id: Specifies the spanning tree instance ID, ranging from 0 to 16. vlan-list: Specifies the VLAN list, ranging from 1 to 4094.

Description

Use the instance command to map the specified VLAN list to the specified STI. Use the undo instance command to cancel the specified VLAN list from the specified STI, the removed VLAN will then be mapped to the CIST (that is, the Instance 0). If no VLAN is specified in the undo command, all the VLANs associated with the specified STI will be mapped to CIST.

By default, all the VLANs are mapped to CIST, that is, the Instance 0. MSTP describes the association between VLANs and STIs with the VLAN mapping table. You can use this command to configure this table. Every VLAN can be mapped to an STI as per your configuration. A VLAN cannot be mapped to different instances at the same time. The latter configured association will replace the former one. Related commands: region-name, revision-level, check region-configuration, vlan-mapping modulo, active region-configuration. Example Map VLAN 2 to STI 1.
[SW7700-mst-region] instance 1 vlan 2

MSTP Configuration Commands

375

region-name

Syntax
region-name name undo region-name

View MST region view Parameter


name: Specifies the MST region name of the switch with a character string not

exceeding 32 bytes. Description


Use the region-name command to configure the MST region name of a switch. Use the undo region-name command to restore the default MST region name.

By default, the MST region name of the switch is the first MAC address in hexadecimal notation. The switch region name, together with VLAN mapping table of the MST region and MSTP revision level, is used for determining the region to which the switch belongs. Related commands: instance, revision-level, check region-configuration, vlan-mapping modulo, active region-configuration. Example Set the MST region name of the switch as 3Com.
[SW7700-mst-region] region-name 3Com

reset stp

Syntax
reset stp [ interface interface-list ]

View User view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times.

Description Use the reset stp command to reset the spanning tree statistics information.

376

CHAPTER 8: USING STP COMMANDS

The spanning tree statistics information includes TCN, Config BPDU, RST, and MST BPDU, received and transmitted on the port. Among them, STP BPDU and TCN BPDU are counted on CIST. When the spanning tree ID and port list are specified, the command clears the statistics information of the specified spanning tree on the specified port. If no port is specified, the command clears the statistics information of the specified spanning tree on all the ports. If no spanning tree is specified, the command clears the statistics information of all the spanning trees. Related command: display stp. Example Clear the statistics information on the ports from Ethernet5/0/1 through Ethernet5/0/3.
<SW7700>reset stp interface Ethernet5/0/1 to Ethernet5/0/3

revision-level

Syntax
revision-level level undo revision-level

View MST region view Parameter


level: Specifies the MSTP revision level, ranging from 0 to 65535. By default, MSTP revision level takes 0.

Description

Use the revision-level command to configure MSTP revision level of the switch. Use the undo revision-level command to restore the default revision-level.

MSTP revision level, together with region name and VLAN mapping table, is used to determine the MST region to which the switch belongs. Related commands: instance, region-name, check region-configuration, vlan-mapping modulo and active region-configuration. Example Set the MSTP revision level of the switch MST region to 5.
[SW7700-mst-region] revision-level 5

stp

Syntax
stp { enable | disable } undo stp

MSTP Configuration Commands

377

View System view, Ethernet port view Parameter


enable: Enables global or port MSTP or STP. disable: Disables global or port MSTP or STP.

Description

Use the stp command to enable or disable MSTP on a device or a port. Use the undo stp command to restore the default MSTP state on a device or a port.

By default, MSTP is disabled on the switch. After MSTP is enabled, the switch determines to run MSTP in STP-compatible mode or MSTP mode per your configurations. The switch serves as a transparent bridge after MSTP is disabled. After MSTP is enabled, it will dynamically maintain the spanning tree state of the corresponding VLAN according to the received configuration BPDU until it is disabled. Related commands: stp mode, stp interface. Example Enable MSTP globally.
[SW7700]stp enable

Disable MSTP on Ethernet5/0/1.


[SW7700-Ethernet5/0/1]stp disable

stp bpdu-protection

Syntax
stp bpdu-protection undo stp bpdu-protection

View System view Parameter None Description

Use the stp bpdu-protection command to enable the BPDU protection on the switch. Use the undo stp bpdu-protection command to restore the default state of BPDU protection.

By default, BPDU protection is disabled.

378

CHAPTER 8: USING STP COMMANDS

Generally, the access ports of the access layer devices are directly connected to user terminals (such as a PC) or file servers. In this case, the access ports are set to edge ports to implement a fast state transition. However, when such access ports receive configuration BPDU, the system automatically sets them to non-edge ports and recalculates the spanning tree, which makes the network topology flap. These ports do not receive any STP configuration BPDU in normal cases. If someone maliciously attacks the switch with fake configuration BPDU, the network will flap. MSTP provides BPDU protection function to avoid an attack. After being configured with BPDU protection, the switch disables the edge port through MSTP, which receives a BPDU, and notifies the network manager at the same time. These ports can be reenabled by the network manager only. Example Enable BPDU protection on the switch.
[SW7700]stp bpdu-protection

stp bridge-diameter

Syntax
stp bridge-diameter bridgenum undo stp bridge-diameter

View System view Parameter


bridgenum: Ranges from 2 to 7 and defaults to 7.

Description

Use the stp bridge-diameter command to configure the switching network diameter. Use the undo stp bridge-diameter command to restore the default network diameter.

The network diameter refers to the maximum count of switches on the path between any two terminal devices. The stp bridge-diameter command configures the switching network diameter and determines the three MSTP time parameters hello time, forward delay, and max age. This configuration takes effect on CIST only but makes no change for MSTI. The spanning tree convergence can be speeded up, when Hello Time, Forward Delay, and Max Age are well configured. These parameters are related to the network scale. You can configure the network scale to get the time parameters. Upon the user-configured bridge-diameter parameter, MSTP will automatically set Hello Time, Forward Delay, and Max Age to moderate values. When bridge-diameter defaults to 7, the time parameters also take their respective default values.

MSTP Configuration Commands

379

Related commands: stp timer forward-delay, stp timer hello, stp timer max-age. Example Set the diameter of the switching network to 5.
[SW7700]stp bridge-diameter 5

stp edged-port

Syntax
stp edged-port { enable | disable } undo stp edged-port

View Ethernet port view Parameter


enable: Configure the current port as an edge port. disable: Configure the current port as a non-edge port.

Description

Use the stp edged-port enable command to configure the current Ethernet port as an edge port. Use the stp edged-port disable command to configure the current Ethernet port as a non-edge port. Use the undo stp edged-port command to restore the default state, that is, non-edge port.

By default, all the switch ports are configured as non-edge port. If the current Ethernet port is connected to other switch, you can use the stp edged-port disable or no stp edged-port command to configure it as a non-edge port. The stp edged-port enable command is used for configuring the port as an edge port. A port is considered as an edge port when it is directly connected to the user terminal, instead of any other switches or shared network segments. The edge port will not cause loop upon network topology changes. You can configure a port as an edge port, so that it can transit to forwarding state fast. For this purpose, please configure the Ethernet port directly connected to the user terminal as an edge port. Because the edge port is not connected to any other switches, it will not receive the configuration BPDUs from them. Before BPDU PROTECTION is enabled on the switch, the port received a BPDU runs as a non-edge port, even if it is configured as edge port. Related command: stp interface edged-port. Example Configure Ethernet5/0/1 as an edge port.

380

CHAPTER 8: USING STP COMMANDS

[SW7700-Ethernet5/0/1]stp edged-port enable

stp instance cost

Syntax
stp instance instance-id cost cost undo stp instance instance-id cost

View Ethernet port view Parameter


instance instance-id: Specifies the spanning tree instance ID, ranging from 0 to 16. The Instance 0 represents CIST. cost cost: Specifies the port path cost, ranging from 1 to 200000.

Description

Use the stp instance cost command to configure the port path cost on the specified STI for the current port. Use the undo stp instance cost command to restore the path cost on the specified STI.

By default, the path costs of a port on different STIs take the values associated with the port speeds. For more description, refer to the table offered in the configuration guideline of the stp interface instance cost command. You may specify the instance-id parameter as 0 to configure CIST path cost of the port. The path cost has effect on the port role selection. A port can be configured with different path costs on different MSTIs. Thus the traffic from different VLANs can run over different physical links, thereby implementing the VLAN-based load-balancing. MSTP will recalculate the port role and transit its state, upon the port path cost changes. Related commands: stp interface instance cost. Example Set the path cost of Ethernet5/0/3 on STI 2 to 200.
[SW7700-Ethernet5/0/3]stp instance 2 cost 200

stp instance port priority

Syntax
stp instance instance-id port priority priority undo stp instance instance-id port priority

View Ethernet port view Parameter


instance instance-id: Specifies the spanning tree instance ID, ranging from 0 to 16. The Instance 0 represents CIST.

MSTP Configuration Commands

381

port priority priority: Specifies the port priority, ranging from 0 to 240, with

a step length of 16, e.g., 0, 16, and 32. By default, the priorities of a port on the STIs are 128. Description

Use the stp instance port priority command to configure the priority of a port on a specified STI. Use the undo stp instance port priority command to restore the default priority of the port on the specified STI.

You may specify the instance-id parameter as 0 to configure CIST priority of the port. The port priority has effect on the port role selection. A port can be configured with different priorities on different MSTIs. Thus the traffic from different VLANs can run over different physical links, thereby implementing the VLAN-based load-balancing. MSTP will recalculate the port role and transit its state, upon the port priority changes. Related command: stp interface instance port priority. Example Set the priority of Ethernet5/0/3 on STI 2 to 16.
[SW7700-Ethernet5/0/3]stp instance 2 port priority 16

stp instance root primary

Syntax
stp instance instance-id root primary [ bridge-diameter bridgenum [ hello-time centi-senconds ] ] undo stp instance instance-id root

View System view Parameter


instance instance-id: Specifies the spanning tree instance ID, ranging from 0

to 16. Specify it as 0 to configure the root bridge of CIST.


root primary: Configure the current switch as the primary root of the

designated STI.
bridge-diameter bridgenum: Specify the network diameter of the spanning

tree, ranging from 2 to 7.


hello-time centi-seconds: Specifies the Hello Time of the spanning tree,

ranging from 100 to 1000 and measured in centiseconds. Description

Use the stp instance root primary command to configure the current switch as the primary root of the designated STI. Use the undo stp instance root command to cancel the current switch for the primary root of the designated STI.

382

CHAPTER 8: USING STP COMMANDS

By default, the switch does not server as a root bridge. You can configure a root bridge for every STI without concerning the switch priority. When configuring the root bridge, you may also specify the network diameter of the designated switching network, so that the switch will calculate and get three time parameter values (Hello time, Forward Delay and Max Age). The Hello time got in this way may not be as good as expected. You can specify the hello-time centi-seconds parameter to overwrite it. Normally, you are recommended to set the network diameter to get the other two time parameter of the switch accordingly. CAUTION: In a switching network, you can configure only one root bridge for each STI and one or more secondary switches. Do not configure more than one root bridge for an STI at the same time, otherwise, the calculation result will be unpredictable. After a switch is configured as primary root switch or secondary root switch, you cannot modify the bridge priority of the switch. Example Designate the current switch as the root bridge of STI 1 and specifies the diameter of the switching network as 4 and the Hello Time as 500 centiseconds:
[SW7700]stp instance 1 root primary bridge-diameter 4 hello-time 500

stp instance root secondary

Syntax
stp instance instance-id root secondary [ bridge-diameter bridgenum [ hello-time centi-seconds ] ] undo stp instance instance-id root

View System view Parameter


instance instance-id: Specifies the spanning tree instance ID, ranging from 0 to 16. Specify it as 0 to configure CIST. root secondary: Configure the current switch as the secondary root of the

designated STI.
bridge-diameter bridgenum: Specify the network diameter of the spanning

tree, ranging from 2 to 7.


hello-time centi-seconds: Specify the Hello Time of the spanning tree,

ranging from 100 to 1000 and measured in centiseconds. Description

Use the stp instance root secondary command to configure the current switch as the secondary root bridge of a specified STI. Use the undo stp instance root command to cancel the current switch for the secondary root bridge of a specified STI.

By default, the switch does not server as a secondary root bridge.

MSTP Configuration Commands

383

You can configure one or more secondary root bridges in an STI. If the primary root is down or powered off, the secondary root will take its place. Among several secondary root bridges, the one with the smallest MAC address takes the place of the failed primary root. When configuring the secondary root bridge, you may also specify the switching network diameter and the Hello Time of the switch, so that the other two parameters, Forward Delay and Max Age, of the switch can be determined. After a switch is configured as primary root switch or secondary root switch, you cannot modify the bridge priority of the switch. Example Configure the current switch as the secondary root bridge of STI 4 and specify the diameter of the switching network as 5 and the Hello Time of the switch as 300 centiseconds.:
[SW7700]stp instance 4 root secondary bridge-diameter 5 hello-time 300

stp interface

Syntax
stp interface interface-list { enable | disable }

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using Port Commands on page 49 &<1-10> means that the preceding parameters can be entered up to 10 times. enable: Enables MSTP on the port. disable: Disables MSTP on the port.

Description Use the stp interface command to enable/disable MSTP on a switch port in system view. By default, if MSTP is enabled globally, it is enabled on every port; if MSTP is disabled globally, it is also disabled on every port. When MSTP is disabled, the corresponding port stays in forwarding state and does not take part in any STI calculation. A loop may be generated, if you disable MSTP on the port. Related command: stp mode, stp.

384

CHAPTER 8: USING STP COMMANDS

Example Enable MSTP on Ethernet5/0/1 in system view.


[SW7700]stp interface Ethernet5/0/1 enable

stp interface edged-port

Syntax
stp interface interface-list edged-port {enable | disable } undo stp interface interface-list edged-port

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times. enable: Configure the current port as an edge port. disable: Configure the current port as a non-edge port.

Description

Use the stp interface edged-port enable command to configure a port as an edge port in system view. Use the stp interface edged-port disable command to configure a port as a non-edge port in system view. Use the undo stp interface edged-port command to restore the non-edge port, as defaulted.

By default, all the switch ports are configured as non-edge port. A port is considered as an edge port when it is directly connected to the user terminal, instead of any other switches or shared network segments. The edge port will not cause loop upon network topology changes. Accordingly, you can configure a port as an edge port, so that it can transit to forwarding state fast. For this purpose, please configure the Ethernet port directly connected to the user terminal as an edge port. If the current Ethernet port is connected to other switch, you can use the stp interface edged-port disable or no stp interface edged-port command to configure it as a non-edge port. The stp interface edged-port enable command is used for configuring the port as an edge port. Because the edge port is not connected to any other switches, it will not receive the configuration BPDUs from them. Before BPDU PROTECTION is enabled on the switch, the port received a BPDU runs as a non-edge port, even if it is configured as edge port. Related command: stp edged-port.

MSTP Configuration Commands

385

Example Configure Ethernet5/0/3 as an edge port in system view.


[SW7700]stp interface Ethernet5/0/3 edged-port enable

stp interface instance cost

Syntax
stp interface interface-list instance instance-id cost cost undo stp interface interface-list instance instance-id cost

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times. instance instance-id: Specifies the spanning tree instance ID, ranging from 0

to 16. The Instance 0 represents CIST.


cost cost: Specifies the path cost of the port, ranging from 1 to 200000.

Description

Use the stp interface instance cost command to configure the path cost of the specified port on the specified STI in system view.,. Use the undo stp interface instance cost command to restore the path cost to default value.

By default, the path cost of the port on every STI is associated with the port speed. For details, refer to the table in the configuration guideline. You may specify the instance-id parameter as 0 to configure CIST path cost of the port. The path cost has effect on the port role selection. A port can be configured with different path costs on different MSTIs. Thus the traffic from different VLANs can run over different physical links, thereby implementing the VLAN-based load-balancing. MSTP will recalculate the port role and transit its state, upon the port path cost changes. The default values of the path cost varies with the different port speeds, as described in the following table.
Table 41 Cost corresponding to the port speed
Link speed 10Mbps 100Mbps Recommended value 2,000 200 Recommended value range 200- 20000 20-2000 Value range 1-200000 1-200000

386

CHAPTER 8: USING STP COMMANDS

Table 41 Cost corresponding to the port speed


1Gbps 10G/s Above 10G/s 20 2 1 2-200 2-20 1-2 1-200000 1-200000 1-200000

Related command: stp instance cost. Example Set the path cost of Ethernet5/0/3 on STI 2 to 400 in system view:
[SW7700]stp interface Ethernet5/0/3 instance 2 cost 400

stp interface instance port priority

Syntax
stp interface interface-list instance instance-id port priority priority undo stp interface interface-list instance instance-id port priority

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using

Port Commands on page 49 &<1-10> means that the preceding parameters can be entered up to 10 times.
instance instance-id: Specifies the spanning tree instance ID, ranging from 0 to 16. The Instance 0 represents CIST. port priority priority: Specifies the port priority, ranging from 0 to 240 with a step length of 16, for example, 0, 16 and 32. By default, the port has a priority of 128 on every STI.

Description

Use the stp interface instance port priority command to configure the priority of the specified port on the specified STI in system view. Use the undo stp interface instance port priority command to restore the default priority.

You may specify the instance-id parameter as 0 to configure CIST priority of the port. The port priority has effect on the port role selection. A port can be configured with different priorities on different MSTIs. Thus the traffic from different VLANs can run over different physical links, thereby implementing the VLAN-based load-balancing. MSTP will recalculate the port role and transit its state, upon the port priority changes. Related command: stp instance port priority.

MSTP Configuration Commands

387

Example Set the priority of Ethernet5/0/3 on STI 2 to 16 in system view.


[SW7700]stp interface Ethernet5/0/3 instance 2 port priority 16

stp interface loop-protection

Syntax
stp interface interface-list loop-protection undo stp interface interface-list loop-protection

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times.

Description

Use the stp interface loop-protection command to enable loop protection on the switch in system view. Use the undo stp interface loop-protection command to restore the default loop protection state.

By default, loop protection is disabled. Related command: stp loop-protection. Example Enable loop protection on the Ethernet5/0/1.
[SW7700]stp interface Ethernet5/0/1 loop-protection

stp interface mcheck

Syntax
stp interface interface-list mcheck

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in Using

Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times.

388

CHAPTER 8: USING STP COMMANDS

Description Use the stp interface mcheck command to perform an mcheck operation on the port in system view. If a port of an MSTP switch on a switching network has ever been connected to an STP switch, the port will automatically transit to operate in STP-compatible mode. However, when the STP switch is removed, the port stays in STP-compatible mode and cannot automatically transit back to MSTP mode. In this case, you can perform the mcheck operation to transit the port to MSTP mode by force. Related command: stp mcheck, stp mode. Example Set mcheck parameter of Ethernet5/0/3 in system view.
[SW7700]stp interface Ethernet5/0/3 mcheck

stp interface point-to-point

Syntax
stp interface interface-list point-to-point { force-true | force-false | auto } undo stp interface interface-list point-to-point

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in the Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times. force-true: Indicates the Ethernet port connected to a point-to-point link. force-false: Indicates the Ethernet port not connected to a point-to-point link. auto: Configure to automatically check if the link to the Ethernet port is a

point-to-point link. Description

Use the stp interface point-to-point command to configure a port (not) to be connected to a point-to-point link in system view. Use the undo stp interface point-to-point command to restore the default state of the link to the Ethernet port.

By default, the parameter defaults to auto, that is, MSTP checks if the link to the Ethernet port is a point-to-point link. The port not connected with the point-to-point link cannot transit fast.

MSTP Configuration Commands

389

The master ports of the link aggregation and the ports operating in full-duplex mode are connected to the point-to-point link. You are recommended to keep the default settings and let MSTP detect the link state automatically. This configuration takes effect on the CIST and all the MSTIs. The settings of a port whether to connect the point-to-point link will be applied to all the STIs where the port belongs. Note that a temporary loop may be redistributed if you configure a port not physically connected with the point-to-point link as connected to such a link by force. Related command: stp point-to-point. Example Configure Ethernet5/0/3 to be connected to the point-to-point link in system view.
[SW7700]stp interface Ethernet5/0/3 point-to-point force-true

stp interface root-protection

Syntax
stp interface interface-list root-protection undo stp interface interface-list root-protection

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in the Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times.

Description

Use the stp interface root-protection command to enable Root protection on the switch in system view. Use the undo stp interface root-protection command to restore the default Root protection state.

By default, Root protection is disabled. In case of configuration error or malicious attack, the legal primary root may receive the BPDU with a higher priority and then loose its place, which causes network topology change errors. Due to the illegal change, the traffic supposed to travel over the high-speed link may be pulled to the low-speed link and congestion will occur on the network. Root protection function is used against such problem. The port configured with Root protection only plays a role of designated port on every instance. Whenever such port receives a higher-priority BPDU, that is, it is about to turn into non-designated port, it will be set to listening state and not forward packets any more (as if the link to the port is disconnected). If the port has not received any

390

CHAPTER 8: USING STP COMMANDS

higher-priority BPDU for a certain period of time thereafter, it will resume the normal state. Related command: stp root-protection. Example Enable Root protection on the Ethernet5/0/1.
[SW7700]stp interface Ethernet5/0/1root-protection

stp interface transit-limit

Syntax
stp interface interface-list transit-limit packetnum undo stp interface interface-list transit-limit

View System view Parameter


interface-list: Ethernet port list, containing multiple Ethernet ports and expressed as interface _list = { { interface_type interface_num | interface_name } [ to { interface_type interface_num | interface_name } ] }&<1-10>. For detail descriptions of interface_type, interface_num and interface_name parameters, refer to the corresponding descriptions in the Using Port Commands on page 49. &<1-10> means that the preceding parameters can be entered up to 10 times. packetnum: Specifies the amount limit to the transmitted packets, ranging from 1

to 255 (expressed as a counter value without any units). By default, the transmission limit on every port is 3. Description

Use the stp interface transit-limit command to configure an amount limit to the configuration BPDU transmitted via a port during the Hello Time in system view. Use the undo stp interface transit-limit command to restore the default limit in system view.

The larger the value is, the more packets can be transmitted in a time unit, yet the more switch resources will be occupied. With a moderate value, the amount of the BPDUs transmitted during Hello Time via every port can be limited and MSTP will not occupy too many bandwidth resources when the network topology flaps. Related command: stp transit-limit. Example Set a limit of 5 to the packets transmitted via Ethernet5/0/3 in system view.
[SW7700]stp interface Ethernet5/0/3 transit-limit 5

stp loop-protection

Syntax
stp loop-protection

MSTP Configuration Commands

391

undo stp loop-protection

View Ethernet port view Parameter None Description


Use the stp loop-protection command to enable loop protection function. Use the undo stp loop-protection command to restore the restore setting.

By default, the loop protection function is not enabled. Example Enable loop protection function in Ethernet5/0/1.
[SW7700-Ethernet5/0/1]stp loop-protection

stp max-hops

Syntax
stp max-hops hop undo stp max-hops

View System view Parameter


hop: Specifies the max hops, ranging from 1 to 40. By default, MST region Max

Hops is 20. Description

Use the stp max-hops command, you can configure the Max Hops of an MST region. Use the undo stp max-hops command to restore the default Max Hops.

On CIST and MSTIs, the Max Hops configured on the region root determines the max switching network diameter supported by the local MST region. As the BPDU traveling from the spanning tree root, each time when it is forwarded by a switch, the max hops will be reduced by 1. The switch discards the configuration BPDU with 0 hops left, thereby limiting the network scale inside the region. If the current switch is a CIST root bridge or MSTI root bridge in an MST region, the Max Hops configured on it will be the network diameter of the spanning tree to limit its scale in the local MST region. The Max Hops configured on the root bridge in an MST region will be adopted by other switches in the same region. Example Set the Max Hops of an MST region to 35.
[SW7700]stp max-hops 35

392

CHAPTER 8: USING STP COMMANDS

stp mcheck

Syntax
stp mcheck

View Ethernet port view Parameter None Description Use the stp mcheck command to perform an mcheck on the current port. If a port of an MSTP switch on a switching network has ever been connected to an STP switch, the port will automatically transit to operate in STP-compatible mode. However, when the STP switch is removed, the port stays in STP-compatible mode and cannot automatically transit back to MSTP mode. In this case, you can perform mCheck operation to transit the port to MSTP mode by force. Related command: stp mode, stp interface mcheck. Example Set mcheck parameter for Ethernet5/0/1.
[SW7700-Ethernet5/0/1]stp mcheck

stp mode

Syntax
stp mode { stp | mstp } undo stp mode

View System view Parameter


stp: Configure the MSTP operation mode as STP-compatible. mstp: Configure the MSTP operation mode as MSTP.

Description

Use the stp mode command to configure the MSTP operation mode of the switch. Use the undo stp mode command to restore the default MSTP operation mode.

By default, switches work in MSTP mode MSTP and RSTP are compatible and they can recognize the packets of each other. However, STP cannot recognize MSTP packets. To implement the compatibility, MSTP provides two operation modes, STP-compatible mode and MSTP mode. In STP-compatible mode, the switch sends STP BPDU packets via every port and serves as a region itself. In MSTP mode, the switch ports send MSTP BPDU packets

MSTP Configuration Commands

393

(when connected to the STP switch) and the switch provides multiple spanning tree function. Related command: stp mcheck, stp, stp interface, stp interface mcheck. Example Set MSTP operation mode as STP-compatible.
[SW7700]stp mode stp

stp pathcost-standard

Syntax
stp pathcost-standard { dot1d-1998 | dot1t } undo stp pathcost-standard

View System view Parameter


dot1d-1998: Configures support for dot1d-1998 path cost standard. dot1t: Configures support for dot1t path cost standard.

Description

Use the stp pathcost-standard command on a Switch 7700 that is directly connected to an older switch that supports only the dot1d-1998 path cost standard. Use the undo stp pathcost-standard command to restore support for the default path cost standard.

By default, the switch uses the dot1t path cost standard. Example Configure the switch to support the dot1d-1998 path cost standard.
[SW7700] stp pathcost-standard dot1d-1998

stp point-to-point

Syntax
stp point-to-point { force-true | force-false | auto } undo stp point-to-point

View Ethernet port view Parameter


force-true: Indicates the Ethernet port connected to a point-to-point link. force-false: Indicates the Ethernet port not connected to a point-to-point link. auto: Configure to automatically check if the link to the Ethernet port is a

point-to-point link.

394

CHAPTER 8: USING STP COMMANDS

Description

Use the stp point-to-point command to configure the current Ethernet port (not) to connect with point-to-point link. Use the undo stp point-to-point command to configure the link state to the default state in which MSTP automatically detects if the link to the Ethernet port is point-to-point link.

By default, the switch adopts auto mode. The port not connected with the point-to-point link cannot transit fast. The master ports of the link aggregation and the ports operating in full-duplex mode are connected to the point-to-point link. You are recommended to keep the default settings and let MSTP detect the link state automatically. This configuration takes effect on the CIST and all the MSTIs. The settings of a port whether to connect the point-to-point link will be applied to all the STIs where the port belongs. Note that a temporary loop may be redistributed if you configure a port not physically connected with the point-to-point link as connected to such a link by force. Related command: stp interface point-to-point. Example Configure Ethernet5/0/3 to be connected to the point-to-point link.
[SW7700-Ethernet5/0/3]stp point-to-point force-true

stp priority

Syntax
stp instance instance-id priority priority undo stp instance instance-id priority

View System view Parameter


instance-id: Ranges from 0 to 16. priority: Specifies the switch priority, ranging from 0 to 61440 with a step

length of 4096. That is, 16 priorities are available for the switch including 0, 4096, 8192, etc. By default, the switch priority is 32768. Description

Use the stp priority command to configure the bridge priority in the specified STI. Use the undo stp priority command to restore the default value of bridge priority.

The switch priority takes part in the spanning tree calculation. It is configured separately for every STI. Different STIs can be configured with different priorities. If specifying the instance ID as 0, the command can configure the CIST priority.

MSTP Configuration Commands

395

Example Set the bridge priority of the switch in STI 1 to 4096.


[SW7700]stp instance 1 priority 4096

stp region-configuration

Syntax
stp region-configuration undo stp region-configuration

View System view Parameter None Description


Use the stp region-configuration command to enter MST region view. Use the undo stp region-configuration command to restore the default MSTP region configurations.

By default, the three MST region parameters take the default values. The MST region name of the switch is the first MAC address, all the VLANs are mapped to CIST, and MSTP revision level takes 0. You can enter MST region view, using the stp region-configuration command. And then you can configure the parameters including region name, revision level, and VLAN mapping table of the region. Example Enter MST region view.
[SW7700]stp region-configuration [SW7700-mst-region]

stp root-protection

Syntax
stp root-protection undo stp root-protection

View Ethernet port view Parameter None Description

Use the stp root-protection command to enable Root protection the switch. Use the undo stp root-protection command to restore the default state of Root protection.

396

CHAPTER 8: USING STP COMMANDS

By default, Root protection is disabled. In case of configuration error or malicious attack, the legal primary root may receive the BPDU with a higher priority and then loose its place, which causes network topology change errors. Due to the illegal change, the traffic supposed to travel over the high-speed link may be pulled to the low-speed link and congestion will occur on the network. MSTP provides Root protection function to protect the root bridge: The port configured with Root protection only plays a role of designated port on every instance. Whenever such port receives a higher-priority BPDU, it will be set to listening state and not forward packets any more (as if the link to the port is disconnected). If the port has not received any higher-priority BPDU for a certain period of time thereafter, it will resume the normal state. Related command: stp interface root-protection. Example Enable Root protection on the Ethernet5/0/1 port of the switch.
[SW7700-Ethernet5/0/1]stp root-protection

stp tc-protection

Syntax
stp tc-protection { enable | disable } undo stp tc-protection

View System view Parameter


enable: Implements protection for the switch from disruption by large numbers of topology change packets. disable: Removes topology change protection

Description

Use the stp tc-protection command to allow the switch to implement large numbers of topology changes every 10 seconds. Use the undo stp tc-protection command to allow the switch to implement topology changes as they arrive.

By default, topology change protection is enabled. Example Configure the switch to implement topology changes every 10 seconds.
[SW7700] stp tc-protection enable

stp timer forward-delay

Syntax
stp timer forward-delay centi-seconds undo stp timer forward-delay

MSTP Configuration Commands

397

View System view Parameter


centi-seconds: Specifies Forward Delay, ranging from 400 to 3000 and measured in centiseconds. By default, the Forward Delay of the switch is 1500 centiseconds.

Description

Use the stp timer forward-delay command to configure Forward Delay for the switch. Use the undo stp timer forward-delay command to restore the default Forward Delay.

To avoid a temporary loop, MSTP defines a medium state, Learning, when the port switches from the Discarding state to Forwarding state. There is also a delay before state switchover to guarantee the synchronous switchover with the remote switch. The Forward Delay configured on the root bridge determines the state transition time. The root bridge will determine the state transition time according to the configured values, while the other switches will apply the forward delay configured on it. When configuring Hello time, Forward Delay and Max Age, please guarantee the following equations: 2 * (Forward Delay - 1.0 seconds) >= Max Age Max Age >= 2 * (Hello Time + 1.0 seconds) Only if the above-mentioned formulas are equal can the MSTP normally operate on the entire network, otherwise, the network may flap frequently. You are recommended to use the stp instance root primary command to specify the diameter of the switching network, so that MSTP can automatically calculate and give the moderate values for the time parameters. Related commands: stp timer hello, stp timer max-age, stp
bridge-diameter.

Example Set the Forward Delay of the device to 2000 centiseconds.


[SW7700]stp timer forward-delay 2000

stp timer hello

Syntax
stp timer hello centi-seconds undo stp timer hello

View System view

398

CHAPTER 8: USING STP COMMANDS

Parameter
centi-seconds: Specifies Hello Time value with an integer in the range of 100 to

1000 in units of centiseconds. By default, the Hello Time of the switch is 200 centiseconds. Description

Use the stp timer hello command to configure Hello Time of the switch. Use the undo stp timer hello command to restore the default Hello Time.

The STP defines to transmit configuration BPDU regularly at an interval specified with Hello Time to keep the spanning tree stable. If the switch receives no BPDU packets for a period of time, it will recalculate the spanning tree upon the BPDU timeouts. The root bridge transmits BPDU packets at an interval as you configured, while other switches apply the Hello Time configured on the root bridge. When configuring Hello time, Forward Delay and Max Age, remember to guarantee the following equations: 2 * (Forward Delay -1.0 seconds) >= Max Age Max Age >= 2 * (Hello Time + 1.0 seconds) Only if the above-mentioned formulas are equal can the MSTP normally operate on the entire network, otherwise, the network may flap frequently. You are recommended to use the stp instance root primary command to specify the diameter of the switching network, so that MSTP can automatically calculate and give the moderate values for the time parameters. Related commands: stp timer forward-delay, stp timer max-age, stp
bridge-diameter.

Example Set Hello Time of the switch 300 centiseconds.


[SW7700]stp timer hello 300

stp timer max-age

Syntax
stp timer max-age centi-seconds undo stp timer max-age

View System view Parameter


centiseconds: Specifies the Max Age, ranging from 600 to 4000 and measured with centiseconds. By default, the Max Age of the switch is 2000 centiseconds.

Description

Use the stp timer max-age command to configure the Max Age of the switch. Use the undo stp timer max-age command to restore the default Max Age.

MSTP Configuration Commands

399

MSTP can detect the link fault and automatically resume the forwarding state of the redundant link. On the CIST, the switch checks if the configuration BPDU received via the port expires according to the Max Age. If the BPDU expires, the STI has to be calculated again. Max Age takes no effect on MSTIs. If the current switch is CIST root bridge, it will check if the configuration BPDU expires according to the configured Max Age. Otherwise, the switch adopts the Max Age configured on the CIST root bridge. When you configure Hello time, Forward Delay and Max Age, ensure the following formulas equal: 2 * (Forward Delay -1.0 seconds) >= Max Age Max Age >= 2 * (Hello Time + 1.0 seconds) Only if the above-mentioned formulas are equal can the MSTP normally operate on the entire network, otherwise, the network may flap frequently. You are recommended to use the stp instance root primary command to specify the diameter of the switching network, so that MSTP can automatically calculate and give the moderate values for the time parameters. Related commands: stp timer forward-delay, stp timer hello, stp
bridge-diameter.

Example Set Max Age of the device to 1000 centiseconds.


[SW7700]stp timer max-age 1000

stp transit-limit

Syntax
stp transit-limit packetnum undo stp transit-limit

View Ethernet port view Parameter


packetnum: Specifies the amount limit to the transmitted packets, ranging from 1

to 255 (expressed as a counter value without any units). By default, the value is 3. Description

Use the stp transit-limit command to configure an amount limit to the configuration BPDU transmitted via a port during the Hello Time. Use the undo stp transit-limit command to restore the default limit.

The larger the value is, the more packets can be transmitted in a time unit, yet the more switch resources will be occupied. With a moderate value, the amount of the BPDUs transmitted during Hello Time via every port can be limited and MSTP will not occupy too many bandwidth resources when the network topology flaps. Related command: stp interface transit-limit.

400

CHAPTER 8: USING STP COMMANDS

Example Set a limit of 5 to the packets transmitted via Ethernet5/0/1.


[SW7700-Ethernet5/0/1]stp transit-limit 5

vlan-mapping modulo

Syntax
vlan-mapping modulo modulo

View MST region view Parameter


modulo: Specifies the modulus, ranging from 1 to 16.

Description Use the vlan-mapping modulo command to map a VLAN list to an STI. By default, all the VLANs are mapped to CIST, namely Instance 0. MSTP describes the association between VLANs and STIs with the VLAN mapping table. You can use this command to configure this table. Every VLAN can be mapped to an STI as per your configuration. A VLAN cannot be mapped to different MSTI at the same time. The latter configured association will replace the former one. The vlan-mapping modulo modulo command designates VLAN for every STI fast. It maps the VLAN to an STI whose ID is (VLAN ID-1)%modulo+1. (Note: (VLAN ID-1) %modulo performs modulo operation on (VLAN ID-1). Taking the operation modulo 16 as an example, vlan 1 maps to MSTI 1, vlan 2 maps to MSTI2 ...vlan 16 maps to MSTI16, vlan 17 maps to MSTI 1, and so on.) Related commands: region-name, revision-level, display configuration, active configuration. Example Map VLAN to STI modulo 16.
[SW7700-mst-region]vlan-mapping modulo 16

USING AAA AND RADIUS COMMANDS

This chapter describes how to use the following commands: 802.1x Configuration Commands

display dot1x dot1x dot1x authentication-method dot1x dhcp-launch dot1x max-user dot1x port-control dot1x port-method dot1x quiet-period dot1x retry dot1x supp-proxy-check dot1x timer dot1x timer handshake-period reset dot1x statistics

AAA Configuration Commands


access-limit attribute cut connection display connection display domain display local-user domain idle-cut local-user local-user password-display-mode password radius-scheme service-type state

402

CHAPTER 9: USING AAA AND RADIUS COMMANDS

RADIUS Protocol Configuration Commands


accounting optional data-flow-format display local-server statistics display radius display radius statistics display stop-accounting-buffer key local-server primary accounting primary authentication radius scheme reset stop-accounting-buffer retry retry realtime-accounting retry stop-accounting secondary accounting secondary authentication server-type state stop-accounting-buffer enable timer timer realtime-accounting user-name-format

802.1x Configuration Commands


display dot1x

This section describes how to use the 802.1x configuration commands on your Switch 7700. Syntax
display dot1x [ sessions | statistics [ interface interface-list ]]

View All views Parameter


interface: Configures to display the 802.1x information on the specified

interface.
sessions: Configures to display the session connection information of 802.1x. statistics: Configures to display the relevant statistics information of 802.1x.

802.1x Configuration Commands

403

interface-list: Ethernet interface list including several Ethernet interfaces, expressed in the format interface-list = { interface-num [ to interface-num ] } & < 1-10 >. interface-num specifies a single Ethernet interface in the format interface-num = { interface-type interface-num | interface-name }, where interface-type specifies the interface type, interface-num specifies the interface number and interface-name specifies the interface name. For the respective meanings and value ranges, read the Parameter of the Using Port Commands on page 49.

Description Use the display dot1x command to view the relevant information of 802.1x, including configuration information, running state (session connection information) and relevant statistics information. By default, all the relevant 802.1x information about each interface will be displayed. This command can be used to display the following information on the specified interface: 802.1x configuration, state or statistics. If no port is specified when executing this command, the system will display all 802.1x related information. For example, 802.1x configuration of all ports, 802.1x session connection information, and 802.1x data statistical information. The output information of this command can help the user to verify the current 802.1x configurations so as to troubleshoot 802.1x. Related commands: reset dot1x statistics, dot1x, dot1x retry, dot1x max-user, dot1x port-control, dot1x port-method, dot1x timer. Example Display the configuration information of 802.1x.
<SW7700>display dot1x Equipment 802.1X protocol is enabled DHCP-launch is disabled EAP-relay is enabled Proxy trap checker is disabled Proxy logoff checker is disabled Configure: Transmit Period 000030 s, Commit Period 000015 s Quiet Period 000060 s, Quiet Period Timer is disabled Supp Timeout 000030 s, Server Timeout 000100 s The Max-Req 000003 Total maximum on-line user number is 4096 Total current on-line user number is 0

404

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Ethernet1/0/1 is link-down 802.1X protocol is disabled Proxy trap checker is disabled Proxy logoff checker is disabled The port is a(n) authenticator Authenticate Mode is auto Port Control Type is Mac-based Max on-line user number is 1024

(Omitted) dot1x Syntax


dot1x [ interface interface-list ] undo dot1x [ interface interface-list ]

View System view Ethernet port view Parameter


interface interface-list: Ethernet port list including several Ethernet ports.

interface-list = { interface-num [ to interface-num ] } & < 1-10 >. interface-num specifies a single Ethernet port in the format interface-num = { interface-type interface-num | interface-name }, where interface-type specifies the port type, interface-num specifies the port number and interface-name specifies the port name. For the respective meanings and value ranges, read the Parameter of the Port Configuration section. Description

Use the dot1x command to enable 802.1x on the specified port or globally (i.e., on the current device). Use the undo dot1x command to disable the 802.1x on the specified port or globally.

By default, 802.1x is disabled on all the ports and globally on the device. This command is used to enable the 802.1x on the current device or on the specified port. When it is used in system view, if the parameter ports-list is not specified, 802.1x will be globally enabled. If the parameter ports-list is specified, 802.1x will be enabled on the specified port. When this command is used in Ethernet port view, the parameter interface-list cannot be input and 802.1x can only be enabled on the current port. The configuration command can be used to configure the global or port 802.1x performance parameters before or after 802.1x is enabled. Before 802.1x is enabled globally, if the parameters are not configured globally or for a specified port, they will maintain the default values. After the global 802.1x performance is enabled, only when port 802.1x performance is enabled will the configuration of 802.1x become effective on the port.

802.1x Configuration Commands

405

Related commands: display dot1x. Example Enable 802.1x on Ethernet 1/0/1.


[SW7700]dot1x interface ethernet 1/0/1

Enable the 802.1x globally.


[SW7700]dot1x

dot1x authentication-method

Syntax
dot1x authentication-method { chap | pap | eap md5-challenge } undo dot1x authentication-method

View System view Parameter


Chap: Use CHAP authentication method. Pap: Use PAP authentication method. EAP: Use EAP authentication method. By now, only md5 encryption method is available

Description

Use the dot1x authentication-method command to configure the authentication method for 802.1x user. Use the undo dot1x authentication-method command to restore the default authentication method of 802.1x user.

By default, CHAP authentication is used for 802.1x user authentication. Password Authentication Protocol (PAP) is a kind of authentication protocol with two handshakes. It sends password in the form of simple text. Challenge Handshake Authentication Protocol (CHAP) is a kind of authentication protocol with three handshakes. It only transmits username but not password. CHAP is more secure and reliable. In the process of EAP authentication, switch directly sends authentication information of 802.1x user to RADIUS server in the form of EAP packet. It is not necessary to transfer the EAP packet to standard RADIUS packet first and then send it to RADIUS server. To realize PAP, CHAP or EAP authentication, RADIUS server should support PAP, CHAP or EAP authentication respectively. Related command: display dot1x.

406

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Example Configure 802.1x user to use PAP authentication


[SW7700]dot1x authentication-method pap

dot1x dhcp-launch

Syntax
dot1x dhcp-launch undo dot1x dhcp-launch

View System view Parameter None Description

Use the dot1x dhcp-launch command to configure whether 802.1x enables the Ethernet switch to launch the user ID authentication when the supplicant runs DHCP and applies for dynamic IP addresses. Use the undo dot1x dhcp-launch command to disable DHCP to launch ID authentication on the supplicant.

By default, DHCP is not allowed launching user ID authentication. If the supplicant is a Windows XP user, you should enable this command before performing 802.1x authentication. Related command: dot1x. Example Enable to launch ID authentication for the supplicant when he runs DHCP and applies for dynamic IP addresses.
[SW7700]dot1x dhcp-launch

dot1x max-user

Syntax
dot1x max-user user-number [ interface interface-list ] undo dot1x max-user [ interface interface-list ]

View System view Ethernet port view Parameter


user-number: Specifies the limit to the amount of supplicants on the port,

ranging from 1 to 1024. By default, the maximum user number is 1024.

802.1x Configuration Commands

407

interface interface-list: Ethernet interface list including several Ethernet

interfaces, expressed in the format interface-list = { interface-num [ to interface-num ] } & < 1-10 >. interface-num specifies a single Ethernet interface in the format interface-num = { interface-type interface-num | interface-name }, where interface-type specifies the interface type, interface-num specifies the interface number and interface-name specifies the interface name. For the respective meanings and value ranges, see the parameters in the Port Command chapter. Description

Use the dot1x max-user command to configure a limit to the amount of supplicants on the specified interface of 802.1x. Use the undo dot1x max-user command to restore the default value.

This command is used for setting a limit to the amount of supplicants that 802.1x can hold on the specified interface. This command has effect on the interface specified by the parameter interface-list when executed in system view. It has effect on all the interfaces when no interface is specified. The parameter interface-list cannot be input when the command is executed in Ethernet interface view and it has effect only on the current interface. Related command: display dot1x. Example Configure the interface Ethernet 1/0/2 to hold no more than 32 users.
[SW7700]dot1x max-user 32 interface ethernet 1/0/2

dot1x port-control

Syntax
dot1x port-control { auto | authorized-force | unauthorized-force } [ interface interface-list ] undo dot1x port-control [ interface interface-list ]

View System view Ethernet interface view Parameter


auto: Automatic identification mode, configuring the initial state of the interface

as unauthorized. The user is only allowed to receive or transmit EAPoL packets but not to access the network resources. If the user passes the authentication flow, the interface will switch over to the authorized state and then the user is allowed to access the network resources. This is the most common case.
authorized-force: Forced authorized mode, configuring the interface to always

stay in authorized state and the user is allowed to access the network resources without authentication/authorization.
unauthorized-force: Forced unauthorized mode, configuring the interface to always stay in non-authorized mode and the user is not allowed to access the network resources.

408

CHAPTER 9: USING AAA AND RADIUS COMMANDS

interface interface-list: Ethernet interface list including several Ethernet

interfaces, expressed in the format interface-list = { interface-num [ to interface-num ] } & < 1-10 >. interface-num specifies a single Ethernet interface in the format interface-num = { interface-type interface-num | interface-name }, where interface-type specifies the interface type, interface-num specifies the interface number and interface-name specifies the interface name. For the respective meanings and value ranges, see the parameters of the Port Command chapter. Description

Use the dot1x port-control command to configure the mode for 802.1x to perform access control on the specified interface. Use the undo dot1x port-control command to restore the default access control mode.

By default, the value is auto. This command is used to set the mode, or the interface state, for 802.1x to perform access control on the specified interface. This command has effect on the interface specified by the parameter interface-list when executed in system view. It has effect on all the interfaces when no interface is specified. The parameter interface-list cannot be input when the command is executed in Ethernet port view and it has effect only on the current interface. Related command: display dot1x. Example Configure the interface Ethernet 1/0/2 to be in force-unauthorized state.
[SW7700]dot1x port-control force-unauthorized interface ethernet 1/0/2

dot1x port-method

Syntax
dot1x port-method { macbased | portbased } [ interface interface-list ] undo dot1x port-method [ interface interface-list ]

View System view Ethernet interface view Parameter


macbased: Configures the 802.1x authentication system to perform

authentication on the supplicant based on MAC address.


portbased: Configures the 802.1x authentication system to perform

authentication on the supplicant based on interface number.


interface interface-list: Ethernet interface list including several Ethernet

interfaces, expressed in the format interface-list = { interface-num [ to interface-num ] } & < 1-10 >. interface-num specifies a single Ethernet interface in

802.1x Configuration Commands

409

the format interface-num = { interface-type interface-num | interface-name }, where interface-type specifies the interface type, interface-num specifies the interface number and interface-name specifies the interface name. For the respective meanings and value ranges, see the parameters in the Port Command chapter. Description

Use the dot1x port-method command to configure the base for 802.1x to perform access control on the specified interface. Use the undo dot1x port-method command to restore the default access control base.

By default, the value is macbased. This command is used to set the base for 802.1x to perform access control, namely authenticate the users, on the specified interface. When macbased is adopted, the user access this interface must be authenticated independently, and if one successful authentication user is to finish network service, the other accessed users can still use network service. When portbased is adopted, if only the first access user by this interface can be authenticated successfully, the other access users followed can be considered authenticated successfully automatically, but if the first one finish the network service , the other accessed users network service will be rejected . . This command has effect on the interface specified by the parameter interface-list when executed in system view. It has effect on all the interfaces when no interface is specified. The parameter interface-list cannot be input when the command is executed in Ethernet interface view and it has effect only on the current interface. Related command: display dot1x. Example Authenticate the supplicant based on the interface number on Ethernet 1/0/3.
[SW7700]dot1x port-method portbased interface ethernet 1/0/3

dot1x quiet-period

Command
dot1x quiet-period undo dot1x quiet-period

View System view Parameter None Description


Use the dot1x quiet-period command to enable the quiet-period timer. Use the undo dot1x quiet-period command to disable this timer.

410

CHAPTER 9: USING AAA AND RADIUS COMMANDS

If an 802.1x user has not passed the authentication, the Authenticator will keep quiet for a while (which is specified by quiet-period timer) before launching the authentication again. During the quiet period, the Authenticator does not do anything related to 802.1x authentication. Related command: display dot1x, dot1x timer. Example Enable quiet-period timer.
[SW7700]dot1x quiet-period

dot1x retry

Syntax
dot1x retry max-retry-value undo dot1x retry

View System view Parameter


max-retry-value: Specifies the maximum times an Ethernet switch can

retransmit the authentication request frame to the supplicant, ranging from 1 to 10. By default, the value is 3, that is, the switch can retransmit the authentication request frame to the supplicant for 3 times. Description

Use the dot1x retry command to configure the maximum times an Ethernet switch can retransmit the authentication request frame to the supplicant. Use the undo dot1x retry command to restore the default maximum retransmission time.

After the switch has transmitted authentication request frame to the user for the first time, if no user response is received during the specified time-range, the switch will re-transmit authentication request to the user. This command is used for specifying how many times the switch can re-transmit the authentication request frame to the supplicant. When the time is 1, the switch is configured to transmit authentication request frame only once. 2 indicates that the switch is configured to transmit authentication request frame once again when no response is received for the first time and so on. This command has effect on all the port after configuration. Related commands: display dot1x. Example Configure the current device to transmit authentication request frame to the user for no more than 9 times.
[SW7700]dot1x retry 9

802.1x Configuration Commands

411

dot1x supp-proxy-check

Syntax
dot1x supp-proxy-check { logoff | trap } [ interface interface-list ] undo dot1x supp-proxy-check { logoff | trap } [ interface interface-list ]

View System view and Ethernet interface view Parameter


logoff: Deny the logon of the access user via proxy. trap: Allow logon of the user via proxy, but the switch will send trap message. interface interface-list: Ethernet interface list including several Ethernet

interfaces, expressed in the format interface-list = { interface-num [ to interface-num ] } & < 1-10 >. interface-num specifies a single Ethernet interface in the format interface-num = { interface-type interface-num | interface-name }, where interface-type specifies the interface type, interface-num specifies the interface number and interface-name specifies the interface name. For the respective meanings and value ranges, see the parameters in the Port Command chapter. Description

Use the dot1x supp-proxy-check command to configure the control method for 802.1x access users via proxy logon the specified interface. Use the undo dot1x supp-proxy-check command to cancel the control method set for the 802.1x access users via proxy.

Note that when performing this function, the user logging on via proxy need to run 3Com 802.1x client program,( 3Com 802.1x client program version V1.29 or above is needed). This command is used to set on the specified interface when executed in system view. The parameter interface-list cannot be input when the command is executed in Ethernet interface view and it has effect only on the current interface. Related command: display dot1x. Example Configure a switch not to allow the users using proxy to login to Ethernet 1/0/3.
[SW7700]dot1x supp-proxy-check logoff interface ethernet 1/0/3

Configure a switch to allow the users using proxy to login to Ethernet 1/0/3.
[SW7700]dot1x supp-proxy-check trap [SW7700]dot1x supp-proxy-check trap interface ethernet 1/0/3

or
[SW7700]dot1x supp-proxy-check trap [SW7700]interface Ethernet 1/0/3 [SW7700-ethernet1/0/3]dot1x supp-proxy-check trap

412

CHAPTER 9: USING AAA AND RADIUS COMMANDS

dot1x timer

Syntax
dot1x timer { quiet-period quiet-period-value | server-timeout server-timeout-value | supp-timeout supp-timeout-value | tx-period tx-period-value } undo dot1x timer { quiet-period | server-timeout | supp-timeout | tx-period }

View System view Parameter


quiet-period: Specify the quiet timer. If an 802.1x user has not passed the authentication, the Authenticator will keep quiet for a while (which is specified by quiet-period timer) before launching the authentication again. During the quiet period, the Authenticator does not do anything related to 802.1x authentication. quiet-period-value: Specify how long the quiet period is. The value ranges from 10 to 120 in units of second and defaults to 60. server-timeout: Specify the timeout timer of an Authentication Server. If an Authentication Server has not responded before the specified period expires, the Authenticator will resend the authentication request. server-timeout-value: Specify how long the duration of a timeout timer of an

Authentication Server is. The value ranges from 100 to 300 in units of second and defaults to 100 seconds.
supp-timeout: Specify the authentication timeout timer of a Supplicant. If a

Supplicant has not responded before the specified period expires, Authenticator will resend the authentication request.
supp-timeout-value: Specify how long the duration of an authentication timeout timer of a Supplicant is. The value ranges from 10 to 120 in units of second and defaults to 30. tx-period: Specify the transmission timeout timer. If a Supplicant has not

responded before the specified period expires, Authenticator will resend the authentication request.
tx-period-value: Specify how long the duration of the transmission timeout

timer is. The value ranges from 10 to 120 in units of second and defaults to 30. Description

Use the dot1x timer command to configure the 802.1x timers. Use the undo dot1x timer command to restore the default values.

When it is run, 802.1x enables many timers to control the rational and orderly interacting of the Supplicant, the Authenticator and the Authenticator Server. This command can set some of the timers (while other timers cannot be set) to adapt the interaction process. It could be necessary for some special and hard network environment. Generally, the user should keep the default values of the timers.

802.1x Configuration Commands

413

Related command: display dot1x. Example Set the Authentication Server timeout timer is 150s.
[SW7700]dot1x timer server-timeout 150

dot1x timer handshake-period

Syntax
dot1x timer handshake-period interval undo dot1x timer handshake-period

View system view Parameter


interval: handshake period, range from 1 to 1024, unit in second.

Description

Use the dot1x timer handshake-period command to set the handshake period of 802.1x. Use the undo dot1x timer handshake-period command to restore the handshake period to default value.

By default, handshake period is 15s. After setting handshake-period, system will send the handshake packet by the period. Suppose the dot1x retry time is configured as N, the system will consider the user having logged off and set the user as logoff state if system doesnt receive the response from user for consecutive N times. Example Set the handshake period of 802.1x to 200 seconds.
[SW7700]dot1x timer handshake-period 200

reset dot1x statistics

Syntax
reset dot1x statistics [ interface interface-list ]

View User view Parameter


interface interface-list: Ethernet port list including several Ethernet ports. interface-list = { interface-num [ to interface-num ] } & < 1-10 >.

interface-num specifies a single Ethernet port in the format port-num = { interface-type interface-num | interface-name }, where interface-type specifies the port type, interface-num specifies the port number and interface-name specifies the port name. For the respective meanings and value ranges, read the Parameter of the Port Configuration section.

414

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Description Use the reset dot1x statistics command to reset the statistics information of 802.1x. This command can be used to re-perform information statistics if the user wants to delete the former statistics information of 802.1x. When the original statistics information is cleared, if no port type or port number is specified, the global 802.1x statistics information of the switch and 802.1x statistics information on all the ports will be cleared. If the port type and port number are specified, the 802.1x statistics information on the specified port will be cleared. Related commands: display dot1x. Example Clear the 802.1x statistics information on Ethernet 1/0/2.
<SW7700>reset dot1x statistics interface ethernet 1/0/2

AAA Configuration Commands


access-limit

This section describes how to use the AAA configuration commands on your Switch 7700. Syntax
access-limit { disable | enable max-user-number } undo access-limit

View ISP domain view Parameter


disable: No limit to the supplicant number in the current ISP domain. enable max-user-number: Specifies the maximum supplicant number in the current ISP domain, ranging from 1 to 4096

Description Use the access-limit command to configure a limit to the number of supplicants in the current ISP domain. Use the undo access-limit command to remove the limit to the number of supplicants in the current ISP domain. By default, there is no limit to the amount of supplicants in the current ISP domain. This command limits the amount of supplicants contained in the current ISP domain. The supplicants may contend with each other for the network resources. So setting a suitable limit to the amount will guarantee the reliable performance for the existing supplicants.

AAA Configuration Commands

415

Example Sets a limit of 500 supplicants for the ISP domain, marlboro.net.
[SW7700isp-marlboro.net]access-limit enable 500

attribute

Syntax
attribute { ip ip-address | mac mac-address | idle-cut second | access-limit max-user-number | vlan vlanid | location { nas-ip ip-address port portnum | port portnum } undo attribute {ip | mac | idle-cut | access-limit | vlan |location }

View Local user view Parameter


idle-cut second: Allows/Disallows the local users to enable the idle-cut function. (The specific data for this function depends on the configuration of the ISP domain where the users locate.) The argument minute defines the idle-cut time, which is in the range of 60 to 7200 seconds. access-limit max-user-number: Defines the maximum number of users that the current ISP domain can accommodate. The argument max-user-number is in

the range of 1 to 4096.


ip: Specifies the IP address of a user. mac mac-address: Specifies the MAC address of a user. Where, mac-address takes on the hexadecimal format of X-X-X. vlan vlanid: Sets the VLAN attribute of user, in other words, the VLAN to which a user belong. The argument vlanid is an integer in the range of 1 to 4094. location: Sets the port binding attribute of user. nas-ip ip-address: The IP address of the access server in the event of binding a remote port with a user. The argument ip-address is an IP address in dotted decimal format and defaults to 127.0.0.1. port portnum: Sets the port with which a user is bound. The argument portnum

is represented by SlotNumber SubSlotNumber PortNumber. If any of these three items is absent, the value 0 will be used to replace it. Description

Use the attribute command to configure some attributes for specified local user. Use the undo attribute command to cancel the attributes that have been defined for this local user.

It should be noted that the argument nas-ip must be defined for a user bound with a remote port, which is unnecessary, however, in the event of a user bound with a local port.

416

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Related command: display local-user. Example Configure the IP address 10.110.50.1 to the user JohnQ.
[SW7700-luser-JohnQ]ip 10.110.50.1

cut connection

Syntax
cut connection { all | access-type { dot1x | gcm } | domain domain-name | interface portnum | ip ip-address | mac mac-address | radius-scheme radius-scheme-name | vlan vlanid | ucibindex ucib-index | user-name user-name }

View System view Parameter


all: Configures to disconnect all connection. access-type { dot1x | gcm }: Configures to cut a category of connections according to logon type. dot1x means the 802.1x users. gcm means gcm user. domain domain-name: Configures to cut the connection according to ISP domain. domain-name specifies the ISP domain name with a character string not exceeding

24 characters. The specified ISP domain shall have been created.


mac mac-address: Configures to cut the connection of the supplicant whose MAC address is mac-address. The argument mac-address is in the hexadecimal

format (x-x-x).
radius-scheme radius-server-name: Configures to cut the connection according to RADIUS server name. radius-server-name specifies the RADIUS server name with a character string not exceeding 32 characters, excluding /, :, *, ?, < and >. interface portnum: Configures to cut the connection according to the port. ip ip-address: Configures to cut the connection according to IP address. The argument ip-address is in the hexadecimal format (ip-address). vlan vlanid: Configures to cut the connection according to VLAN ID. Here, vlanid ranges from 1 to 4094. ucibindex ucib-index: Configures to cut the connection according to ucib-index. Here, ucib-index ranges from 0 to 4095. user-name user-name: Configures to cut the connection according to user name. user-name is the argument specifying the username. It is a character string not

exceeding 32 characters, excluding /, :, *, ?, < and >. The @ character can only be used once in one username. The pure username (the part before @, namely the user ID) cannot exceed 24 characters.

AAA Configuration Commands

417

Description Use the cut connection command to disconnect a user or a category of users by force. By default, no online user will be disconnected by force. In some occasions, it is necessary to disconnect a user or a category of users by force. Related command: display connection. Example Cut all the connections in the ISP domain, marlboro.net.
[SW7700]cut connection domain marlboro.net

display connection

Syntax
display connection [ access-type { dot1x | gcm } | domain domain-name | interface portnum | ip ip-address | mac mac-address | radius-scheme radius-scheme-name | vlan vlanid | ucibindex ucib-index | user-name user-name ]

View All views Parameter


access-type { dot1x | gcm }: Configures to display the supplicants according to their logon type. dot1x means the 802.1x users. gcm means gcm user. domain domain-name: Configures to display all the users in an ISP domain. domain-name specifies the ISP domain name with a character string not exceeding

24 characters. The specified ISP domain shall have been created.


mac mac-address: Configures to display the supplicant whose MAC address is mac-address. The argument mac-address is in the hexadecimal format (x-x-x). radius-scheme radius-server-name: Configures to display the supplicant according to RADIUS server name. radius-server-name specifies the RADIUS server name with a character string not exceeding 32 characters, excluding /, :, *, ?, < and >. interface portnum: Configures to display the supplicant according the port. ip ip-address: Configures to display the user specified with IP address. The argument ipt-address is in the hexadecimal format (ip-address). vlan vlanid: Configures to display the user specified with VLAN ID. Here, vlanid ranges from 1 to 4094. ucibindex ucib-index: Configures to display the user specified with ucib-index. Here, ucib-index ranges from 0 to 4095. user-name user-name: Configures to display a user specifies with user-name. user-name is the argument specifying the username. It is a character string not

418

CHAPTER 9: USING AAA AND RADIUS COMMANDS

exceeding 32 characters, excluding /, :, *, ?, < and >. The @ character can only be used once in one username. The pure username (the part before @, namely the user ID) cannot exceed 24 characters. Description Use the display connection command to view the relevant information of all the supplicants or the specified one(s). This command displays the information about a specified or all the users. The output can help you with the user connection diagnosis and troubleshooting. Related command: cut connection. Example Display the relevant information of all the users.
<SW7700>display connection Total 0 connections matched ,0 listed.

display domain

Syntax
display domain [ isp-name ]

View All views Parameter


isp-name: Specifies the ISP domain name, with a character string not exceeding

24 characters. The specified ISP domain shall have been created. Description Use the display domain command to view the configuration of a specified ISP domain or display the summary information of all ISP domains. This command is used to output the configuration of a specified ISP domain or display the summary information of all ISP domains. If an ISP domain is specified, the configuration information will be displayed exactly the same, concerning the content and format, as the displayed information of the display domain command. The output information can help with ISP domain diagnosis and troubleshooting. Note that the accounting scheme to be displayed should have been created. Related commands: access-limit, domain, radius scheme, state, display domain. Example Display the summary information of all ISP domains of the system.
<SW7700>display domain 0 Domain=123 State=Active Accessed=0 1 Domain=3Com163.net State=Block Accessed=0 Default Domain Name: 123 Auto-Append=Yes Total 2 domain(s) listed.

AAA Configuration Commands

419

display local-user

Syntax
display local-user [ domain isp-name | idle-cut { enable | disable } | service-type { telnet | ftp | lan-access } | state { active | block } | user-name user-name | vlan vlanid ]

View All views Parameter


domain isp-name: Configures to display all the local users in the specified ISP domain. isp-name specifies the ISP domain name with a character string not

exceeding 24 characters. The specified ISP domain shall have been created.
idle-cut: Configures to display the local users according to the state of idle-cut function. disable means that the user disables the idle-cut function and enable means the user enables the function. This parameter only takes effect on the users configured as lan-access type. For other types of users, the display local-user idle-cut enable and display local-user idle-cut disable commands do not display any information. service-type: Configures to display local user of a specified type. telnet means that: the specified user type is telnet. ftp means that: the specified user type is ftp. lan-access means that the specified user type is lan-access which mainly refers to Ethernet accessing users, 802.1x supplicants for example. state { active | block }: Configures to display the local users in the specified state. active means that the system allows the user requesting network service and block means the system does not allow the user requesting network service. user-name user-name: Configures to display a user specified with user-name. user-name is the argument specifying the username. It is a character string not

exceeding 32 characters, excluding /, :, *, ?, < and >. The @ character can only be used once in one username. The pure username (the part before @, namely the user ID) cannot exceed 24 characters.
vlan vlanid: Configures to display the users belonged to specified VLAN. vlanid is the integer, ranging from 1 to 4094.

Description Use the display local-user command to view the relevant information of all the local users or the specified one(s). This command displays the relevant information about a specified or all the local users. The output can help you with the fault diagnosis and troubleshooting related to local user. Related command: local-user. Example Display the relevant information of all the local users.
<SW7700>display local-user The contents of local user xxx: State: Active

ServiceType Mask:

420

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Idle Cut: AccessLimit: Bind location: Vlan ID:

Disable Disable Disable Disable

Current AccessNum: 0

Total 1 local user(s) Matched,1 listed.

domain

Syntax
domain [ isp-name | default { disable | enable isp-name }] undo domain isp-name

View System view Parameter


isp-name: Specifies an ISP domain name. The name is expressed with a character string not exceeding 24 characters, excluding /, : , *, ? , <, and >. default: configure default ISP. disable: Disable default ISP configuration. enable: Enable default ISP configuration.

Description

Use the domain command to configure an ISP domain or enter the view of an existing ISP domain. Use the undo domain command to cancel a specified ISP domain.

By default, a domain named system has been created in the system. The attributes of system are all default values. ISP domain is a group of users belonging to the same ISP. Generally, for a username in the userid@isp-name format, taking gw20010608@3Com163.net as an example, the isp-name (i.e.3Com163.net) following the @ is the ISP domain name. When 3Com SW7700 Series Ethernet Switches control user access, as for an ISP user whose username is in userid@isp-name format, the system will take userid part as username for identification and take isp-name part as domain name. The purpose of introducing ISP domain settings is to support the application environment with several ISP domains. In this case, an access device may have supplicants from different ISP domains. Because the attributes of ISP users, such as username and password structures, service types, may be different, it is necessary to separate them by setting ISP domains. In ISP domain view, you can configure a complete set of exclusive ISP domain attributes for each ISP domain, which includes AAA schemes ( RADIUS server group applied and so forth.) For a switch, each supplicant belongs to an ISP domain. The system supports to configure up to 16 ISP domains. If a user has not reported its ISP domain name, the system will put it into the default domain.

AAA Configuration Commands

421

When this command is used, if the specified ISP domain does not exist, the system will create a new ISP domain. All the ISP domains are in the active state when they are created. Related commands: access-limit, radius scheme, state, display domain. Example Create a new ISP domain, marlboro.net, and enters its view.
[SW7700]domain marlboro.net New Domain added. [SW7700-isp-3Com163.net]

idle-cut

Syntax
idle-cut { disable | enable minute flow }

View ISP domain view Parameter


disable: means disabling the user to use idle-cut function . enable: means enabling the user to use the function. minute: Specifies the maximum idle time, ranging from 1 to 120 and measured in

minutes.
flow: The minimum data traffic, ranging from 1 to 10,240,000 and measured in

bytes. Description Use the idle-cut command to configure the user template in the current ISP domain. By default, after an ISP domain is created, this attribute in user template is disable, that is, the user idle-cut is disabled. The user template is a set of default user attributes. If a user requesting for the network service does not have some required attributes, the corresponding attributes in the template will be endeavored to him as default ones. The user template of the switch you are using may only provide user idle-cut settings. After a user is authenticated, if the idle-cut is configured to enable or disable by neither the user nor the RADIUS server, the user will adopt the idle-cut state in the template. Because a user template only works in one ISP domain, it is necessary to configure user template attributes for users from different ISP domain respectively. Related command: domain Example Enable the user in the current ISP domain, 3Com163.net, to use the idle-cut attribute specified in the user template (that is, enabling the user to use the

422

CHAPTER 9: USING AAA AND RADIUS COMMANDS

idle-cut function). The maximum idle time is 50 minutes and the minimum data traffic is 500 bytes.
[SW7700-isp-3Com163.net]idle-cut enable 50 500

local-user

Syntax
local-user user-name undo local-user { user-name | all [ service-type { telnet | ftp | lan-access } ] }

View System view Parameter


user-name: Specifies a local username with a character string not exceeding 32

characters, excluding /, :, *, ?, < and >. The @ character can only be used once in one username. The pure username (the part before @, namely the user ID) cannot exceed 24 characters. The user-name parameter is not case sensitive.
service-type: Specifies the service type. telnet: The specified user type is telnet. ftp: The specified user type is ftp. lan-access: The specified user type is lan-access which mainly refers to Ethernet

accessing users, 802.1x supplicants for example.


all: All the users.

Description

Use the local-user command to configure a local user and enter the local user view. Use the undo local-user command to cancel a specified local user.

By default, no local user. Related commands: display local-user, server-type. Example Add a local user named 3Com1.
[SW7700]local-user JohnQ [SW7700-luser-JohnQ]

local-user password-display-mode

Syntax
local-user password-display-mode { cipher-force | auto } undo local-user password-display-mode

AAA Configuration Commands

423

View System view Parameter


cipher-force: Forced cipher mode specifies that the passwords of all the

accessed users must be displayed in cipher text.


auto: The auto mode specifies that a user is allowed to use the password

command to set a password display mode. Description

Use the local-user password-display-mode command to configure the password display mode of all the accessing users. Use the undo local-user password-display-mode command to cancel the password display mode that has been set for all the accessing users.

If cipher-force has been adopted, the user efforts of specifying to display passwords in simple text will render useless. The password display mode of all the accessing users defaults to auto. Related commands: display local-user, password. Example Force all the accessing users to display passwords in cipher text.
[SW7700]local-user password-display-mode cipher-force

password

Syntax
password { simple | cipher } password undo password

View Local user view Parameter


simple: Specifies to display passwords in simple text. cipher: Specifies to display passwords in cipher text. password: Defines a password, which is a character string of up to 16 characters if it is in simple text and of up to 24 characters if it is in cipher text.

Description

Use the password command to configure a password display mode for local users. Use the undo password command to cancel the specified password display mode.

424

CHAPTER 9: USING AAA AND RADIUS COMMANDS

If local-user password-display-mode cipher-force has been adopted, the user efforts of using the password command to set the password display mode to simple text (simple) will render useless. Related command: display local-user. Example Set the user 3Com1 to display the password in simple text, given the password is 20030422.
[SW7700-luser-3Com1]password simple 20030422

radius-scheme

Syntax
radius-scheme radius-scheme-name

View ISP domain view Parameter


radius-scheme-name: Specifies a RADIUS server group, with a character string

not exceeding 32 characters. Description Use the radius-scheme command to configure the RADIUS server group used by the current ISP domain. After an ISP domain is created, it uses the default RADIUS server group (named default. For configuration of relevant parameters, read the RADIUS Configuration section of this chapter) of the system. This command is used to specify the RADIUS server group for the current ISP domain. The specified RADIUS server group shall have been created. Related commands: radius scheme, display radius. Example The following example designates the current ISP domain, marlboro.net, to use the RADIUS server, Radserver.
[SW7700-isp-marlboro.net]radius-scheme Radserver

service-type

Syntax
service-type { ftp [ ftp-directory directory ] | lan-access | telnet [ level level ] ] | telnet [ level level ] } undo service-type { ftp [ ftp-directory ] | lan-access | telnet [ level ] }

View Local user view

AAA Configuration Commands

425

Parameter
telnet: Specifies user type as Telnet. level level: Specifies the level of Telnet users. The argument level is an integer

in the range of 0 to 3 and defaults to 1.


ftp: Specifies user type as ftp. ftp-directory directory: Specifies the directory of ftp users, directory is a

character string of up to 64 characters.


lan-access: Specifies user type to lan-access, which mainly refers to Ethernet

accessing users, 802.1x supplicants for example. Description

Use the service-type command to configure a service type for a particular user. Use the undo service-type command to cancel the specified service type for the user.

Example Set to provide the lan-access service for the user JohnQ.
[SW7700-luser-JohnQ]service-type lan-access

state

Syntax
state { active | block }

View ISP domain view Local user view Parameter


active: Configures the current ISP domain (ISP domain view)/current user (local

user view) as being in active state, that is, the system allows the users in the domain (ISP domain view) or the current user (local user view) to request network service.
block: Configures the current ISP domain (ISP domain view)/current user (local

user view) as being in block state, that is, the system does not allow the users in the domain (ISP domain view) or the current user (local user view) to request network service. Description Use the state command to configure the state of the current ISP domain/ current user. By default, after an ISP domain is created, it is in the active state (in ISP domain view). A local user will be active (in local user view) upon its creation.

426

CHAPTER 9: USING AAA AND RADIUS COMMANDS

In ISP domain view, every ISP can either be in active or block state. If an ISP domain is configured to be active, the users in it can request for network service, while in block state, its users cannot request for any network service, which will not affect the users currently online. Related command: domain. Example Set the current ISP domain marlboro.net to be in the block state. The supplicants in this domain cannot request for the network service.
[SW7700-isp-marlboro.net]state block

Set the user 3Com1 to be in the block state.


[SW7700-user-3Com1]state block

RADIUS Protocol Configuration Commands


accounting optional

This section describes how to use the RADIUS Protocol configuration commands on your Switch 7700.

Syntax
accounting optional undo accounting optional

View RADIUS server group view Parameter None Description

Use the accounting optional command to enable the selection of the RADIUS accounting option. Use the undo accounting optional command to disable the selection of RADIUS accounting option.

By default, selection of the RADIUS accounting option is disabled. If no RADIUS server is available or if RADIUS accounting server fails when the accounting optional is configured, the user can still use the network resource, otherwise, the user will be disconnected. The user configured with accounting optional command in RADIUS scheme will no longer send real-time accounting update packet or offline accounting packet. The accounting optional command in RADIUS server group view is only effective on the accounting that uses this RADIUS server group. Example Enable the selection of RADIUS accounting of the RADIUS server group named as CAMS.

RADIUS Protocol Configuration Commands

427

[SW7700-radius-cams] accounting optional

data-flow-format

Syntax
data-flow-format data { byte | giga-byte | kilo-byte | mega-byte } packet { giga-byte | kilo-byte | mega-byte | one-packet }

View RADIUS server group view Parameter


data: Set data unit. byte: Set 'byte' as the unit of data flow. giga-byte: Set 'giga-byte' as the unit of data flow. kilo-byte: Set 'kilo-byte' as the unit of data flow. mega-byte: Set 'mega-byte' as the unit of data flow. packet: Set data packet unit. giga-packet: Set 'giga-packet' as the unit of packet flow. kilo-packet: Set 'kilo-packet' as the unit of packet flow. mega-packet: Set 'mega-packet' as the unit of packet flow. one-packet: Set 'one-packet' as the unit of packet flow.

Description Use the data-flow-format command to configure the unit of data flow that send to RADIUS Server. By default, the data unit is byte and the data packet unit is one-packet. Related command: display radius. Example Set the unit of data flow that send to kilo-byte and the data packet to kilo-packet
[SW7700-radius-3Com]data-flow-format data kilo-byte packet kilo-packet

display local-server statistics

Syntax
display local-server statistics

View All views Parameter None

428

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Description Use the display local-server statistics command to view the configuration information of local RADIUS server group. Related command: local-server. Example Display local RADIUS server group information.
<SW7700> display local-server statistics The localserver packet statistics: Receive: 0 Send: Discard: 0 Receive Packet Error: Auth Receive: 0 Auth Send: Acct Receive: 0 Acct Send:

0 0 0 0

display radius

Syntax
display radius [ radius-server-name ]

View All views Parameter


radius-server-name: Specifies the RADIUS server group name with a character string not exceeding 32 characters, excluding /, :, *, ?, < and >. Display all RADIUS server groups when the parameter is not set.

Description Use the display radius command to view the configuration information of all RADIUS server groups or a specified one. By default, this command outputs the configuration information about the specified or all the RADIUS server groups. The output can help with RADIUS diagnosis and troubleshooting. Related command: radius scheme. Example Display the configuration information of all the RADIUS server groups.
<SW7700>display radius -----------------------------------------------------------------ServerName =default Index=0 Type=standard Primary Auth IP =0.0.0.0 Port=1812 State=Down Primary Acct IP =0.0.0.0 Port=1813 State=Down Second Auth IP =0.0.0.0 Port=1812 State=Down Second Acct IP =0.0.0.0 Port=1813 State=Down Auth Server Encryption Key= 3Com Acct Server Encryption Key= 3Com TimeOutValue (seconds)=3 RetryTimes=3 RealtimeACCT (minutes)=12 Permitted send realtime PKT failed counts =5 Retry sending times of noresponse acct-stop-PKT =500 Username format =with-domain Data flow unit =Byte

RADIUS Protocol Configuration Commands

429

Packet unit

=1

-----------------------------------------------------------------ServerName =3Com Index=1 Type=standard Primary Auth IP =10.11.1.1 Port=1812 State=Up Primary Acct IP =10.11.1.2 Port=1813 State=Up Second Auth IP =10.11.1.2 Port=1812 State=Up Second Acct IP =10.11.1.1 Port=1813 State=Up Auth Server Encryption Key= 3Com Acct Server Encryption Key= 3Com TimeOutValue (seconds)=3 RetryTimes=3 RealtimeACCT (minutes)=12 Permitted send realtime PKT failed counts =5 Retry sending times of noresponse acct-stop-PKT =500 Username format =without-domain Data flow unit =Byte Packet unit =1 -----------------------------------------------------------------Printed [2] items

display radius statistics

Syntax
display radius statistics

View All views Parameter None Description Use the display radius statistics command to view the statistics information of RADIUS packet. This command outputs the statistics information about the RADIUS packets. The displayed packet information can help with RADIUS diagnosis and troubleshooting. Related command: radius scheme. Example Display the statistics information of RADIUS packets.
<SW7700>display radius statistics state statistic(total=1528): DEAD=1528 AuthProc=0 AcctStart=0 RLTSend=0 AcctStop=0 OnLine=0 StateErr=0

AuthSucc=0 RLTWait=0 Stop=0

Receive and Send packets statistic: Send PKT total :0 Receive PKT total:0 RADIUS received packets statistic: Code= 2,Num=0 ,Err=0 Code= 3,Num=0 ,Err=0 Code= 5,Num=0 ,Err=0

430

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Code=11,Num=0 Code=22,Num=0

,Err=0 ,Err=0

Running statistic: RADIUS received messages statistic: Normal auth request ,Num=0 EAP auth request ,Num=0 Account request ,Num=0 Account off request ,Num=0 Leaving request ,Num=0 PKT auth timeout ,Num=0 PKT acct_timeout ,Num=0 Realtime Account ,Num=2317 PKT response ,Num=0 EAP reauth_request ,Num=0 PORTAL access ,Num=0 Update ack ,Num=0 PORTAL access ack ,Num=0 Session ctrl pkt ,Num=0 RADIUS send messages statistic: Normal auth accept ,Num=0 Normal auth reject ,Num=0 EAP auth accept ,Num=0 EAP auth reject ,Num=0 EAP auth replying ,Num=0 EAP reauth accept ,Num=0 EAP_reauth_reject ,Num=0 Account success ,Num=0 Account failure ,Num=0 Account off ack ,Num=0 Update request ,Num=0 Leaving ack ,Num=0 Cut req ,Num=0 RecError_MSG_sum:0 SndMSG_Fail_sum :0 Timer_Err :0 Alloc_Mem_Err :0 State Mismatch :0 Other_Error :0 No-response-acct-stop packet=0 Discarded No-response-acct-stop packet=0

,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0 ,Err=0

,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=2317 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0 ,Succ=0

display stop-accounting-buffer

Syntax
display stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name }

View All views Parameter


radius-scheme radius-server-name: Configures to display the saved stopping accounting requests according to RADIUS server name. radius-server-name specifies the RADIUS server name with a character string not exceeding 32 characters, excluding /, :, *, ?, < and >.

RADIUS Protocol Configuration Commands

431

session-id session-id: Configures to display the saved stopping accounting requests according to the session ID. session-id specifies the session ID with a character string not exceeding 50 characters. time-range start-time stop-time: Configures to display the saved stopping accounting requests according to the saving time. Start-time specifies the start time of the saving time range and stop-time specifies the stop time of the saving time range. The time is expressed in the format hh:mm:ss-yyyy/mm/dd. When this parameter is specified, all the stopping accounting requests saved in the time range since start-time to stop-time will be displayed. user-name user-name: Configures to display the saved stopping accounting requests according to the username. User-name specifies the username, a character string not exceeding 32 characters, excluding /, :, *, ?, < and >. The @ character can only be used once in one username. The pure username (the part before @, namely the user ID) cannot exceed 24 characters.

Description Use the display stop-accounting-buffer command to view the stopping accounting requests, which have not been responded and saved in the buffer. After transmitting the stopping accounting requests, if there is no response from the RADIUS server, the switch will save the packet in the buffer and retransmit it for several times, which is set through the retry realtime-accounting. This command is used to display the stopping accounting requests saved in the switch buffer. You can select to display the packets sent to a certain RADIUS server, or display the packets according to user session ID or username. You may also display the request packets saved during a specified time range. The displayed packet information can help with diagnosis and troubleshooting. Related commands: reset stop-accounting-buffer, stop-accounting-buffer enable, retry stop-accounting. Example Display the stopping accounting requests saved in the system buffer since 0:0:0 to 23:59:59 on August 31, 2002.
<SW7700>display stop-accounting-buffer time-range 0:0:0-2002/08/31 23:59:59-2002/08/31 Total find 0 record

key

Syntax
key { accounting | authentication } string undo key { accounting | authentication }

View RADIUS server group view Parameter


accounting: Configures to set/delete the authentication key for the RADIUS

accounting packet.

432

CHAPTER 9: USING AAA AND RADIUS COMMANDS

authentication: Configures to set/delete the encryption key for RADIUS authentication/authorization packet. string: Specifies the key with a character string not exceeding 16 characters, excluding /, : , *, ? , < and >. By default, the key is 3Com.

Description

Use the key command to configure encryption key for RADIUS authentication/authorization or accounting packet. Use the undo key command to restore the default key.

RADIUS client (switch system) and RADIUS server use MD5 algorithm to hash the exchanged packets. The two ends verify the packet through setting the key. Only when the keys are identical can both ends accept the packets from each other and give responses. So it is necessary to ensure that the keys set on the switch and the RADIUS server are identical. If the authentication/authorization and accounting are performed on two different servers with different keys, you should set two keys respectively. Related commands: primary accounting, primary authentication, radius scheme. Example Example 1: Set the authentication/authorization key of the RADIUS server group to hello.
[SW7700-radius]key authentication hello

Example 2: Set the accounting packet key of the RADIUS server group to ok.
[SW7700-radius]key accounting ok

local-server

Syntax
local-server nas-ip ip-address key password undo local-server nas-ip ip-address

View System view Parameter


nas-ip ip-address: set IP address of access server. ip-address is expressed in the format of dotted decimal. key password: Set password of logon user. password is a character string containing up to 16 characters.

Description

Use the local-server command to configure the parameters of local RADIUS server.

RADIUS Protocol Configuration Commands

433

Use the undo local-server command to cancel a local RADIUS server.

RADIUS service, which adopts authentication/authorization/accounting servers to manage users, is widely used in SW7700 switches. Besides, local authentication/authorization/accounting service is also used in these products and it is called local RADIUS function, i.e. realize basic RADIUS function on the switch. Note that when using local RADIUS server function, remember the number of UDP port used for authentication is 1645 and that for accounting is 1646. SW7700 switches support up to 16 local RADIUS server groups. Related commands: radius scheme, state. Example Set the IP address of local RADIUS server group to 10.110.1.2 and the password to 3Com.
[SW7700]local-server nas-ip 10.110.1.2 key 3Com

primary accounting

Syntax
primary accounting ip-address [ port-number ] undo primary accounting

View RADIUS server group view Parameter


ip-address: IP address, in dotted decimal format. By default, the IP addresses of

the primary accounting servers is at 0.0.0.0.


port-number: Specifies UDP port number. ranging from 1 to 65535. By default,

the UDP port for accounting service is 1813. Description

Use the primary accounting command to configure the IP address and port number for the primary accounting server. Use the undo primary accounting command to restore the default IP address and port number of the primary RADIUS accounting server.

After creating a RADIUS server group, you are supposed to set IP addresses and UDP port numbers for the RADIUS servers, including primary/second authentication/authorization servers and accounting servers. In real networking environments, the above parameters shall be set according to the specific requirements. However, at least you have to set one authentication/authorization server and an accounting server. Besides, ensure that the RADIUS service port settings on the Ethernet switch is consistent with the port settings on the RADIUS server. Related commands: key, radius scheme, state.

434

CHAPTER 9: USING AAA AND RADIUS COMMANDS

Example Set the IP address of the primary accounting server of RADIUS server group, 3Com, to 10.110.1.2 and the UDP port 1813 to provide RADIUS accounting service.
[SW7700-radius-3Com]primary accounting 10.110.1.2 1813

primary authentication

Syntax
primary authentication ip-address [ port-number ] undo primary authentication

View RADIUS server group view Parameter


ip-address: IP address, in dotted decimal format. By default, the IP addresses of

the primary authentication/authorization is at 0.0.0.0.


port-number: Specifies UDP port number. ranging from 1 to 65535. By default,

the UDP port for authentication/authorization service is 1812 . Description

Use the primary authentication command to configure the IP address and port number for the primary RADIUS authentication/authorization. Use the undo primary authentication command to restore the default IP address and port number of the primary RADIUS authentication/authorization.

After creating a RADIUS server group, you are supposed to set IP addresses and UDP port numbers for the RADIUS servers, including primary/second authentication/authorization servers and accounting servers. In real networking environments, the above parameters shall be set according to the specific requirements. However, at least you have to set one authentication/authorization server and an accounting server. Besides, ensure that the RADIUS service port settings on the Ethernet switch is consistent with the port settings on the RADIUS server. Related commands: key, radius scheme, state. Example Set the IP address of the primary authentication/authorization server of RADIUS server group, 3Com, to 10.110.1.1 and the UDP port 1812 to provide RADIUS authentication/authorization service.
[SW7700-radius-3Com]primary authentication auth 10.110.1.1 1812

radius scheme

Syntax
radius scheme radius-server-name undo radius scheme radius-server-name

View System view

RADIUS Protocol Configuration Commands

435

Parameter
radius-server-name: Specifies the Radius server name with a character string

not exceeding 32 characters, excluding /, :, *, ?, < and >. Description

Use the radius scheme command to configure a RADIUS server group and enter its view. Use the undo radius scheme command to cancel the specified RADIUS server group.

By default, a RADIUS server group named system has been created in the system. The attributes of system are all default values. RADIUS protocol configuration is performed on a per-RADIUS-server-group basis. Every RADIUS server group shall at least have the specified IP address and UDP port number of the RADIUS authentication/authorization/accounting server and some necessary parameters exchanged with the RADIUS client end (switch system). So it is necessary to create the RADIUS server group and enter its view before performing other RADIUS protocol configurations. A RADIUS server group can be used by several ISP domains at the same time. Although undo radius scheme can remove a specified RADIUS server group. However, the default one cannot be removed. Note that a serer group currently in use by the online user cannot be removed. Related commands: key, retry realtime-accounting, radius-scheme, timer realtime-accounting, stop-accounting-buffer enable, retry stop-accounting, server-type, state, user-name-format, retry, display radius, display radius statistics. Example Create a RADIUS server group named 3Com and enters its view.
[SW7700]radius scheme 3Com [SW7700-radius-3Com]

reset stop-accounting-buffer

Syntax
reset stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name }

View User view Parameter


radius-scheme radius-server-name: Configures to delete the stopping accounting requests from the buffer according to the specified RADIUS server name. radius-server-name specifies the RADIUS server name with a character string not exceeding 32 characters, excluding /, :, *, ?, < and >.

436

CHAPTER 9: USING AAA AND RADIUS COMMANDS

session-id session-id: Configures to delete the stopping accounting requests from the buffer according to the specified session ID. session-id specifies the

session ID with a character string not exceeding 50 characters.


time-range start-time stop-time: Configures to delete the stopping accounting requests from the buffer according to the saving time. Start-time specifies the start time of the saving time range and stop-time specifies the stop time of the saving time range. The time is expressed in the format hh:mm:ss-yyyy/mm/dd. When this parameter is set, all the stopping accounting requests saved since start-time to stop-time will be deleted. user-name user-name: Configures to delete the stopping accounting requests from the buffer according to the username. User-name specifies the username, a

character string not exceeding 32 characters, excluding /, :, *, ?, < and >. The @ character can only be used once in one username. The pure username (the part before @, namely the user ID) cannot exceed 24 characters. Description Use the reset stop-accounting-buffer command to reset the stopping accounting requests, which are saved in the buffer and have not been responded. By default, after transmitting the stopping accounting requests, if there is no response from the RADIUS server, the switch will save the packet in the buffer and retransmit it for several times, which is set through the retry realtime-accounting command. This command is used to delete the stopping accounting requests from the switch buffer. You can select to delete the packets transmitted to a specified RADIUS server, or according to the session-id or username, or delete the packets transmitted during the specified time-range. Related commands: stop-accounting-buffer enable, retry stop-accounting, display stop-accounting-buffer. Example Delete the stopping accounting requests saved in the system buffer by the user, user0001@marlboro.net.
[SW7700]reset stop-accounting-buffer user-name user0001@marlboro.net

Delete the stopping accounting requests saved in the system buffer since 0:0:0 to 23:59:59 on August 31, 2002.
[SW7700]reset stop-accounting-buffer time-range 0:0:0-2002/08/31 23:59:59-2002/08/31

retry

Syntax
retry retry-times undo retry

View RADIUS server group view

RADIUS Protocol Configuration Commands

437

Parameter
retry-times: Specifies the maximum times of retransmission, ranging from 1 to

20. By default, the value is 3. Description

Use the retry command to configure the RADIUS request retransmission times. Use the undo retry command to restore the retry-times to default value.

Because RADIUS protocol uses UDP packets to carry the data, its communication process is not reliable. If the RADIUS server has not responded NAS until timeout, NAS has to retransmit RADIUS request packet. If it transmits more than the specified retry-time, NAS considers the communication with the current RADIUS server has been disconnected and it will transmit request packet to other RADIUS servers. Setting a suitable retry-time according to the network situation can speed up the system response. Related command: radius scheme Example Set to retransmit the RADIUS request packet no more than 5 times via the server 3Com in the RADIUS server group.
[SW7700-radius-3Com]retry 5

retry realtime-accounting

Syntax
retry realtime-accounting retry-times undo retry realtime-accounting

View RADIUS server group view Parameter


retry-times: Specifies the maximum times of real-time accounting request

failing to be responded, ranging from 1 to 255. By default, the accounting request can fail to be responded up to 5 times. Description

Use the retry realtime-accounting command to configure the maximum number of retries for real-time accounting requests. Use the undo retry realtime-accounting command to restore the maximum number of retries for real-time accounting requests to the default value.

RADIUS server usually checks if a user is online with timeout timer. If the RADIUS server has not received the real-time accounting packet from NAS, it will consider that there is line or device failure and stop accounting. Accordingly, it is necessary to disconnect the user at NAS end and on RADIUS server synchronously when some unexpected failure occurs. 3Com SW7700 Series Ethernet Switches support

438

CHAPTER 9: USING AAA AND RADIUS COMMANDS

to set maximum times of real-time accounting request failing to be responded. NAS will disconnect the user if it has not received real-time accounting response from RADIUS server for some specified times. How to calculate the value of count? Suppose RADIUS server connection will timeout in T and the real-time accounting interval of NAS is t, then the integer part of the result from dividing T by t is the value of count. Therefore, when applied, T is suggested the numbers which can be divided exactly by t. Related command: radius scheme. Example Allow the real-time accounting request failing to be responded for up to 10 times.
[SW7700-radius-3Com]retry realtime-accounting 10

retry stop-accounting

Syntax
retry stop-accounting retry-times undo retry stop-accounting

View RADIUS server group view Parameter


retry-times: Specifies the maximal retransmission times after stopping accounting request,. ranging from 10 to 65535. By default, the value is 500.

Description

Use the retry stop-accounting command to configure the maximal retransmission times after stopping accounting request. Use the undo retry stop-accounting command to restore the retransmission times to the default value.

Because the stopping accounting request concerns account balance and will affect the amount of charge, which is very important for both the user and ISP, NAS shall make its best effort to send the message to RADIUS accounting server. Accordingly, if the message from the switch to RADIUS accounting server has not been responded, the switch shall save it in the local buffer and retransmit it until the server responds or discard the messages after transmitting for specified times. Related commands: reset stop-accounting-buffer, radius scheme, display stop-accounting-buffer. Example Indicate that, when stopping accounting request for the server 3Com in the RADIUS server group, the switch system will retransmit the packets for up to 1000 times.
[SW7700-radius-3Com]retry stop-accounting 1000

RADIUS Protocol Configuration Commands

439

secondary accounting

Syntax
secondary accounting ip-address [ port-number ] undo secondary accounting

View RADIUS server group view Parameter


ip-address: IP address, in dotted decimal format. By default, the IP addresses of

second accounting server is at 0.0.0.0.


port-number: Specifies the UDP port number, ranging from 1 to 65535. By

default, the accounting service is provided via UDP 1813. Description

Use the secondary accounting command to configure the IP address and port number for the second RADIUS accounting server. Use the undo secondary accounting command to restore the IP address and port number to default values.

For detailed information, read the Description of the primary accounting command. Related commands: key, radius scheme, state. Example Set the IP address of the second accounting server of RADIUS server group, 3Com, to 10.110.1.1 and the UDP port 1813 to provide RADIUS accounting service.
[SW7700-radius-3Com]secondary accounting 10.110.1.1 1813

secondary authentication

Syntax
secondary authentication ip-address [ port-number ] undo secondary authentication

View RADIUS server group view Parameter


ip-address: IP address, in dotted decimal format. By default, the IP addresses of

second authentication/authorization is at 0.0.0.0.


port-number: Specifies the UDP port number, ranging from 1 to 65535. By

default, the authentication/authorization service is provided via UDP 1812 Description

Use the secondary authentication command to configure the IP address and port number for the second RADIUS authentication/authorization. Use the undo secondary authentication command to restore the IP address and port number to default values.

440

CHAPTER 9: USING AAA AND RADIUS COMMANDS

For detailed information, read the Description of the primary authentication command. Related commands: key, radius scheme, state. Example Set the IP address of the second authentication/authorization server of RADIUS server group, 3Com, to 10.110.1.2 and the UDP port 1812 to provide RADIUS authentication/authorization service.
[SW7700-radius-3Com]secondary authentication 10.110.1.2 1812

server-type

Syntax
server-type { extendedtype | iphotel | portal | standard } undo server-type

View RADIUS server group view Parameter


3Comtype: Configures the switch system to support the extended RADIUS server

type, which requires the RADIUS client end (switch system) and RADIUS server to interact according RADIUS extensions.
iphotel: Configures the switch system to support the RADIUS server of IP Hotel type, which requires the RADIUS client end (switch system) and RADIUS server to interact according to the regulation and packet format of IP Hotel (an extension of RADIUS protocol). portal: Configures the switch system to support the RADIUS server of portal type, which requires the RADIUS client end (switch system) and RADIUS server to interact according to the regulation and packet format of Portal (an extension of RADIUS protocol). standard: Configures the switch system to support the RADIUS server of Standard type, which requires the RADIUS client end (switch system) and RADIUS server to interact according to the regulation and packet format of standard RADIUS protocol (RFC 2138/2139 or newer).

Description

Use the server-type command to configure the RADIUS server type supported by the switch. Use the undo server-type to restore the RADIUS server type to the default value.

By default, the value is standard. The 3Com Switch 7700 supports standard RADIUS protocol and the extended RADIUS service platform IP Hotel, 201+ and Portal etc independently developed by 3Com. This command is used to select the supported RADIUS sever type.

RADIUS Protocol Configuration Commands

441

Related command: radius scheme. Example Set RADIUS server type of RADIUS sever group, 3Com to IP Hotel.
[SW7700-radius-3Com]server-type iphotel

state

Syntax
state { primary | secondary } { accounting | authentication } { block | active }

View RADIUS server group view Parameter


primary: Configures to set the state of the primary RADIUS server. secondary: Configures to set the state of the second RADIUS server. accounting: Configures to set the state of RADIUS accounting server. authentication: Configures to set the state of RADIUS

authentication/authorization.
block: Configures the RADIUS server to be in the state of block. active: Configures the RADIUS server to be active, namely the normal operation state.

Description Use the state command to configure the state of RADIUS server. By default, all the RADIUS servers in every RADIUS server group are in the state of active. For the primary and second servers (no matter an authentication/authorization or an accounting server), if the primary server is disconnected to NAS for some fault, NAS will automatically turn to exchange packets with the second server. However, after the primary one recovers, NAS will not resume the communication with it at once, instead, it continues communicating with the second one. When the second one fails to communicate, NAS will turn to the primary one again. This command is used to set the primary server to be active manually, in order that NAS can communicate with it right after the troubleshooting. When the primary and second servers are all active or block, NAS will send the packets to the primary server only. Related commands: radius scheme, primary authentication, secondary authentication, primary accounting, secondary accounting. Example Set the second authentication server of RADIUS server group, 3Com, to be active.

442

CHAPTER 9: USING AAA AND RADIUS COMMANDS

[SW7700-radius-3Com]state secondary authentication active

stop-accounting-buffer enable

Syntax
stop-accounting-buffer enable undo stop-accounting-buffer enable

View RADIUS server group view Parameter None Description

Use the stop-accounting-buffer enable command to configure to save the stopping accounting requests without response in the switch system buffer. Use the undo stop-accounting-buffer enable command to cancel the function of saving the stopping accounting requests without response in the switch system buffer.

By default, enable to save the stopping accounting requests in the buffer. Because the stopping accounting request concerns account balance and will affect the amount of charge, which is very important for both the user and ISP, NAS shall make its best effort to send the message to RADIUS accounting server. Accordingly, if the message from the switch to RADIUS accounting server has not been responded, the switch shall save it in the local buffer and retransmit it until the server responds or discard the messages after transmitting for specified times. Related commands: reset stop-accounting-buffer, radius scheme, display stop-accounting-buffer. Example Indicate that, for the server 3Com in the RADIUS server group, the switch system will save the stopping accounting request packets in the buffer
[SW7700-radius-3Com]stop-accounting-buffer enable

timer

Syntax
timer seconds undo timer

View RADIUS server group view Parameter


second: RADIUS server response timeout timer, ranging from 1 to 10 and measured in seconds. By default, the value is 3.

RADIUS Protocol Conf