Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.1E Cisco IOS Release 12.1 E Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
C ON T E N T S Preface xxi Audience xxi Organization xxi Related Documentation Conventions xxiii xxiv Obtaining Documentation xxv Cisco.
Contents CHAPTER 3 Configuring the Cisco 7600 Series Router for the First Time Default Configuration 3-1 3-1 Configuring the Cisco 7600 Series Router 3-2 Using the Setup Facility or the setup Command 3-2 Using Configuration Mode 3-10 Checking the Running Configuration Before Saving 3-10 Saving the Running Configuration Settings 3-11 Reviewing the Configuration 3-11 Configuring a Default Gateway 3-12 Configuring a Static Route 3-12 Configuring a BOOTP Server 3-14 Protecting Access to Privileged EXEC Co
Contents RPR+ Operation 5-2 Supervisor Engine Synchronization 5-3 Supervisor Engine Redundancy Guidelines and Restrictions 5-4 RPR+ Guidelines and Restrictions 5-4 Hardware Configuration Guidelines and Restrictions 5-5 Restrictions 5-5 Configuration Mode Restrictions 5-6 Configuring Supervisor Engine Redundancy 5-6 Configuring RPR and RPR+ 5-6 Synchronizing the Supervisor Engine Configurations Displaying the Redundancy States 5-8 Performing a Fast Software Upgrade 5-9 Copying Files to the Redundant Sup
Contents Layer 2 LAN Interface Configuration Guidelines and Restrictions Restrictions 7-6 Guidelines 7-6 7-6 Configuring LAN Interfaces for Layer 2 Switching 7-7 Configuring a LAN Port for Layer 2 Switching 7-7 Configuring a Layer 2 Switching Port as a Trunk 7-8 Configuring a LAN Interface as a Layer 2 Access Port 7-14 Configuring a Custom IEEE 802.
Contents Mapping 802.
Contents Configuring EtherChannels 13-6 Configuring Port Channel Logical Interfaces for Layer 3 EtherChannels Configuring Channel Groups 13-8 Configuring the LACP System Priority and System ID 13-10 Configuring EtherChannel Load Balancing 13-11 CHAPTER 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Understanding How 802.1Q Tunneling Works 14-1 14-1 802.1Q Tunneling Configuration Guidelines and Restrictions Restrictions 14-3 Guidelines 14-4 14-3 Configuring 802.
Contents MST Regions 15-19 Message Age and Hop Count Default STP Configuration 15-20 15-21 STP and MST Configuration Guidelines 15-21 Configuring STP 15-22 Enabling STP 15-23 Enabling the Extended System ID 15-24 Configuring the Root Bridge 15-25 Configuring a Secondary Root Bridge 15-26 Configuring STP Port Priority 15-27 Configuring STP Port Cost 15-29 Configuring the Bridge Priority of a VLAN 15-30 Configuring the Hello Time 15-32 Configuring the Forward-Delay Time for a VLAN 15-32 Configuring the
Contents Enabling EtherChannel Guard CHAPTER 17 Enabling Root Guard 16-14 Enabling Loop Guard 16-15 16-14 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 Understanding How Layer 3 Switching Works 17-1 Understanding Hardware Layer 3 Switching on PFC2 and DFCs Understanding Layer 3-Switched Packet Rewrite 17-2 Default Hardware Layer 3 Switching Configuration 18 17-4 17-5 Displaying Hardware Layer 3 Switching Statistics CHAPTER 17-2 17-4 Layer 3 Switching Configuration Guidelin
Contents Displaying RPF Failure Rate-Limiting Information 18-14 Displaying IP Multicast Layer 3 Hardware Switching Summary Displaying the IP Multicast Routing Table 18-16 Displaying IP Multicast Layer 3 Switching Statistics 18-17 Using Debug Commands 18-18 Clearing IP Multicast Layer 3 Switching Statistics 18-19 CHAPTER 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 18-14 19-1 Understanding How IP MLS Works 19-2 IP MLS Overview 19-2 IP MLS Flows 19-2 Layer 3 MLS Cache 19-3 Flow Ma
Contents IPX MLS Operation 20-4 Default IPX MLS Configuration 20-5 Configuration Guidelines and Restrictions 20-5 Configuring IPX MLS 20-6 Enabling IPX MLS Globally 20-6 Enabling IPX MLS on a Layer 3 Interface 20-6 Configuring the MLS Aging Time 20-7 Configuring the Minimum IPX MLS Flow Mask 20-8 Displaying IPX MLS Information 20-8 Displaying IPX MLS Cache Entries 20-9 Displaying the IPX MLS Contention Table 20-11 Displaying IPX MLS VLAN Statistics 20-12 Clearing IPX MLS Cache Entries Troubleshooting
Contents Default RGMP Configuration 22-2 RGMP Configuration Guidelines and Restrictions Enabling RGMP on Layer 3 Interfaces CHAPTER 23 Configuring Network Security 23-1 ACL Configuration Guidelines 23-1 Hardware and Software ACL Support 22-2 22-3 23-2 Guidelines and Restrictions for Using Layer 4 Operators in ACLs Determining Layer 4 Operation Usage 23-3 Determining Logical Operation Unit Usage 23-4 23-3 Configuring the Cisco IOS Firewall Feature Set 23-4 Cisco IOS Firewall Feature Set Suppo
Contents CHAPTER 25 Configuring IEEE 802.1X Port-Based Authentication 25-1 Understanding 802.1X Port-Based Authentication 25-1 Device Roles 25-2 Authentication Initiation and Message Exchange 25-3 Ports in Authorized and Unauthorized States 25-4 Supported Topologies 25-4 Default 802.1X Port-Based Authentication Configuration 25-5 802.1X Port-Based Authentication Guidelines and Restrictions 25-6 Configuring 802.1X Port-Based Authentication 25-7 Enabling 802.
Contents Verifying Layer 3 Protocol Filtering Configuration CHAPTER 28 Configuring Traffic Storm Control 28-1 Understanding Traffic Storm Control 28-1 Default Traffic Storm Control Configuration Enabling Traffic Storm Control 29 28-2 28-2 Displaying Traffic Storm Control Settings CHAPTER 27-3 Configuring Broadcast Suppression 28-4 29-1 Understanding How Broadcast Suppression Works 29-1 Broadcast Suppression Configuration Guidelines and Restrictions Enabling Broadcast Suppression CHAPTER
Contents PFC QoS Feature Flowcharts 32-6 PFC QoS Feature Summary 32-11 Ingress LAN Port Features 32-12 PFC Marking and Policing 32-16 LAN Egress Port Features 32-21 PFC QoS Statistics Data Export 32-24 PFC QoS Default Configuration 32-25 PFC QoS Configuration Guidelines and Restrictions Guidelines: 32-31 Restrictions 32-32 32-31 Configuring PFC QoS 32-33 Enabling PFC QoS Globally 32-33 Enabling Queueing-Only Mode 32-34 Creating Named Aggregate Policers 32-35 Configuring a PFC QoS Policy 32-37 Enabling
Contents Configuring NDE Flow Filters 33-15 Displaying the NDE Configuration 33-17 CHAPTER 34 Configuring Local SPAN and RSPAN 34-1 Understanding How Local SPAN and RSPAN Work Local SPAN and RSPAN Overview 34-1 Local SPAN and RSPAN Sessions 34-3 Monitored Traffic 34-4 SPAN Sources 34-4 Destination Ports 34-5 34-1 Local SPAN and RSPAN Configuration Guidelines and Restrictions Local SPAN and RSPAN Session Limits 34-5 Local SPAN and RSPAN Source and Destination Limits 34-6 Local SPAN and RSPAN Guidelin
Contents Setting a Password for a Router and Cache Engines Verifying and Monitoring WCCP Configuration Settings 35-10 35-11 WCCP Configuration Examples 35-11 Changing the Version of WCCP on a Router Example 35-12 Performing a General WCCPv2 Configuration Example 35-12 Running a Web Cache Service Example 35-12 Running a Reverse Proxy Service Example 35-13 Registering a Router to a Multicast Address Example 35-13 Using Access Lists Example 35-13 Setting a Password for a Router and Cache Engines Example 35-
Contents CHAPTER 38 Power Management and Environmental Monitoring 38-1 Understanding How Power Management Works 38-1 Enabling or Disabling Power Redundancy 38-2 Using the CLI to Power Modules Off and On 38-3 Using the CLI to View System Power Status 38-3 Using the CLI to Power Cycle Modules 38-4 Determining System Power Requirements 38-4 Understanding How Environmental Monitoring Works 38-4 Using CLI Commands to Monitor System Environmental Status Understanding LED Environmental Indications 38-4 APPEN
Contents Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
Preface This preface describes who should read the Cisco 7600 Series Router Cisco IOS Software Configuration Guide, how it is organized, and its document conventions. Audience This guide is for experienced network administrators who are responsible for configuring and maintaining Cisco 7600 series routers. Organization This guide is organized as follows: Chapter Title Description Chapter 1 Product Overview Presents an overview of the Cisco 7600 series routers.
Preface Organization Chapter Title Description Chapter 11 Configuring Cisco IP Phone Support Describes how to configure Cisco IP Phone support. Chapter 12 Configuring Layer 3 Interfaces Describes how to configure LAN interfaces to support Layer 3 features. Chapter 13 Configuring EtherChannels Describes how to configure Layer 2 and Layer 3 EtherChannel port bundles. Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Describes how to configure IEEE 802.
Preface Related Documentation Chapter Title Description Chapter 33 Configuring NDE Describes how to configure Neflow Data Export (NDE). Chapter 34 Configuring Local SPAN and RSPAN Describes how to configure the Switch Port Analyzer (SPAN). Chapter 35 Configuring Web Cache Services Using WCCP Describes how to configure web cache services using WCCP. Chapter 36 Configuring SNMP IfIndex Persistence Describes how to configure SNMP ifIndex persistence.
Preface Conventions – Software System Error Messages – Debug Command Reference – Internetwork Design Guide – Internetwork Troubleshooting Guide – Configuration Builder Getting Started Guide The Cisco IOS Configuration Guides and Command References are located at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/index.htm • For information about MIBs, go to this URL: http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.
Preface Obtaining Documentation Cautions use the following conventions: Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.
Preface Documentation Feedback • Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Documentation Feedback You can submit e-mail comments about technical documentation to bug-doc@cisco.com.
Preface Obtaining Additional Publications and Information To open a case by telephone, use one of the following numbers: Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227) EMEA: +32 2 704 55 55 USA: 1 800 553-2447 For a complete listing of Cisco TAC contacts, go to this URL: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml TAC Case Priority Definitions To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.
Preface Obtaining Additional Publications and Information • Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL: http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html • Training—Cisco offers world-class networking training.
C H A P T E R 1 Product Overview The Cisco IOS on the Cisco 7600 Series Router product supports the following hardware and software: • Supervisor Engine 2, Policy Feature Card 2 (PFC2), and Multilayer Switch Feature Card 2 (MSFC2); and in Catalyst 6500 series switches: – Switch Fabric Module – Fabric-enabled switching modules – Fabric-enabled switching modules with a distributed forwarding card (DFC) • Supervisor Engine 1, PFC, and MSFC or MSFC2 • All Layer 2 and Layer 3 configuration from the same u
Chapter 1 Product Overview Configuring Embedded CiscoView Support Understanding Embedded CiscoView The Embedded CiscoView network management system is a web-based interface that uses HTTP and SNMP to provide a graphical representation of the router and to provide a GUI-based management and configuration interface. You can download the Java Archive (JAR) files for Embedded CiscoView at this URL: http://www.cisco.com/kobayashi/sw-center/netmgmt/ciscoview/embed-cview-planner.
Chapter 1 Product Overview Configuring Embedded CiscoView Support Displaying Embedded CiscoView Information To display the Embedded CiscoView information, enter the following EXEC commands: Command Purpose Router# show ciscoview package Displays information about the Embedded CiscoView files. Router# show ciscoview version Displays the Embedded CiscoView version. Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
Chapter 1 Product Overview Configuring Embedded CiscoView Support Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 2 Command-Line Interfaces This chapter describes the command-line interfaces (CLIs) you use to configure the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication and the Release 12.1 publications at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/index.
Chapter 2 Command-Line Interfaces Accessing the CLI To make a console connection, perform this task: Command Purpose Step 1 Press Return. Brings up the prompt. Step 2 Router> enable Initiates enable mode enable. Step 3 Password: password Router# Completes enable mode enable. Step 4 Router# quit Exits the session when finished.
Chapter 2 Command-Line Interfaces Performing Command Line Processing This example shows how to open a Telnet session to the router: unix_host% telnet Router_1 Trying 172.20.52.40... Connected to 172.20.52.40. Escape character is '^]'. User Access Verification Password: Router_1> enable Password: Router_1# Performing Command Line Processing Commands are not case sensitive.
Chapter 2 Command-Line Interfaces Cisco IOS Command Modes Table 2-2 History Substitution Commands Command Ctrl-P or the up arrow key. Purpose 1 Recalls commands in the history buffer, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Ctrl-N or the down arrow key.1 Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the up arrow key. Repeat the key sequence to recall successively more recent commands.
Chapter 2 Command-Line Interfaces Displaying a List of Cisco IOS Commands and Syntax Table 2-3 Frequently Used Cisco IOS Command Modes Mode Description of Use How to Access User EXEC Connect to remote devices, change Log in. terminal settings on a temporary basis, perform basic tests, and display system information. Prompt Router> Privileged EXEC (enable) Set operating parameters. The privileged command set includes the commands in user EXEC mode, as well as the configure command.
Chapter 2 Command-Line Interfaces ROM-Monitor Command-Line Interface For example: Router# configure ? memory network overwrite-network terminal Configure Configure Overwrite Configure from NV memory from a TFTP network host NV memory from TFTP network host from the terminal To redisplay a command you previously entered, press the up arrow key or Ctrl-P. You can continue to press the up arrow key to see the last 20 commands you entered.
C H A P T E R 3 Configuring the Cisco 7600 Series Router for the First Time This chapter contains information about how to initially configure the Cisco 7600 series router, which supplements the administration information and procedures in these publications: • Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/fun_c/index.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router Table 3-1 Default Configuration Feature Default Value Administrative connection Normal mode Global information No value for the following: • System name • System contact • Location System clock No value for system clock time Passwords No passwords configured for normal mode or enable mode (press the Return key) Prompt Router> Configuring the Cisco 7600 Series Router These sect
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router When you enter the setup command, current system configuration defaults are displayed in square brackets [ ] as you move through the setup command process and are queried by the system to make changes.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router Copyright (c) 1986-2001 by cisco Systems, Inc. Compiled Wed 28-Mar-01 18:36 by hqluong Image text-base: 0x30020980, data-base: 0x306B8000 Start as Primary processor 00:00:05: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging out put.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router --- System Configuration Dialog --Continue with configuration dialog? [yes/no]: y At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router GigabitEthernet1/1 172.20.52.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router Note Step 6 An enable secret password can contain from 1 to 25 uppercase and lowercase alphanumeric characters; an enable password can contain any number of uppercase and lowercase alphanumeric characters. In both cases, a number cannot be the first character. Spaces are also valid password characters; for example, “two words” is a valid password.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router shutdown no ip address ! interface GigabitEthernet1/2 shutdown no ip address ! . <...output truncated...> .! end [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router When you reach and respond to the configuration dialog for the last installed interface, your interface configuration is complete. Step 3 Check and verify the entire list of configuration parameters, which should display on your console terminal and end with the following query: Use this configuration? [yes/no]: A no response places you back at the enable prompt (#).
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router For detailed interface configuration information, refer to the Cisco IOS Interface Configuration Guide at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/inter_c/index.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router Current configuration: Current configuration : 3441 bytes ! version 12.1 service timestamps debug datetime localtime service timestamps log datetime localtime no service password-encryption ! hostname Router ! boot buffersize 522200 boot system flash slot0:c6sup22-jsv-mz.121-5c.EX.bin boot bootldr bootflash:c6msfc2-boot-mz.121-3a.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router Configuring a Default Gateway Note The router uses the default gateway only when it is not configured with a routing protocol. To send data to another subnet when the router is not configured with a routing protocol, configure a default gateway. The default gateway must be the IP address of an interface on a router in the same subnet.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router This example shows how to use the show running-config command to confirm the configuration of the previously configured static route: Router# show running-config Building configuration... . <...output truncated...> . ip default-gateway 172.20.52.35 ip classless ip route 171.10.5.10 255.255.255.255 172.20.3.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Configuring the Cisco 7600 Series Router Configuring a BOOTP Server The Bootstrap Protocol (BOOTP) automatically assigns an IP address by adding the MAC and IP addresses of the interface to the BOOTP server configuration file. When the router boots, it automatically retrieves the IP address from the BOOTP server. The router performs a BOOTP request only if the current IP address is set to 0.0.0.0.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Protecting Access to Privileged EXEC Commands Protecting Access to Privileged EXEC Commands The following tasks provide a way to control access to the system configuration file and privileged EXEC commands: • Setting or Changing a Static Enable Password, page 3-15 • Using the enable password and enable secret Commands, page 3-15 • Setting or Changing a Line Password, page 3-16 • Setting TACACS+ Password Protection for Privileged
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Protecting Access to Privileged EXEC Commands Use either of these commands with the level option to define a password for a specific privilege level. After you specify the level and set a password, give the password only to users who need to have access at this level. Use the privilege level configuration command to specify commands accessible at various levels.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Protecting Access to Privileged EXEC Commands When you set TACACS password protection at the privileged EXEC mode, the enable EXEC command prompts for both a new username and a password. This information is then sent to the TACACS+ server for authentication. If you are using the extended TACACS+, it also sends any existing UNIX user identification code to the TACACS+ server.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Protecting Access to Privileged EXEC Commands For example, if you want many users to have access to the clear line command, you can assign it level 2 security and distribute the level 2 password widely. If you want more restricted access to the configure command, you can assign it level 3 security and distribute that password to more restricted users.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Recovering a Lost Enable Password Exiting a Privilege Level To exit to a specified privilege level, perform this task: Command Purpose Router# disable level Exits to a specified privilege level.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Modifying the Supervisor Engine Startup Configuration These sections describe how the startup configuration on the supervisor engine works and how to modify the configuration register and BOOT variable: • Understanding the Supervisor Engine Boot Configuration, page 3-20 • Configuring the Software Configuration Register, page 3-21 • Specifying the Startup System Image, page 3-24
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration The ROM monitor has these features: • Power-on confidence test • Hardware initialization • Boot capability (manual boot and autoboot) • Debug utility and crash analysis • Monitor call interface (EMT calls—the ROM monitor provides information and some functionality to the running software images through EMT calls) • File system (the ROM monitor knows the simple file system
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Table 3-2 Software Configuration Register Bit Meaning (continued) Bit Number1 Hexadecimal Meaning 11 to 12 0x0800 to 0x1000 Console line speed (default is 9600 baud) 13 0x2000 Boot default Flash software if network boot fails 14 0x4000 IP broadcasts do not have network numbers 15 0x8000 Enable diagnostic messages and ignore NVRAM contents 1.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Modifying the Boot Field You modify the boot field from the software configuration register. To modify the software configuration register boot field, perform this task: Command Purpose Step 1 Router# show version Determines the current configuration register setting. Step 2 Router# configure terminal Enters configuration mode, selecting the terminal option.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Verifying the Configuration Register Setting Enter the show version EXEC command to verify the current configuration register setting. In ROM-monitor mode, enter the o command to verify the value of the configuration register boot field.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Flash Memory Features The Flash memory components allow you to do the following: • Copy the system image to Flash memory using TFTP. • Copy the system image to Flash memory using rcp. • Boot the system from Flash memory either automatically or manually. • Copy the Flash memory image to a network server using TFTP or rcp.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration CONFIG_FILE Environment Variable For Class A Flash file systems, the CONFIG_FILE environment variable specifies the file system and filename of the configuration file to use for initialization (startup). Valid file systems can include nvram:, slot0:, and sup-bootflash:.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Setting the BOOTLDR Environment Variable To set the BOOTLDR environment variable, perform this task: Command Purpose Step 1 Router# dir bootflash: Verifies that bootflash contains the boot loader image. Step 2 Router# configure terminal Enters the configuration mode from the terminal.
Chapter 3 Configuring the Cisco 7600 Series Router for the First Time Modifying the Supervisor Engine Startup Configuration Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 4 Configuring EHSA Supervisor Engine Redundancy With 12.1 E releases earlier than Release 12.1(13)E, the Cisco 7600 series router supports dual supervisor engines with EHSA. Note EHSA is not supported in Release 12.1(13)E and later releases (see Chapter 5, “Configuring RPR and RPR+ Supervisor Engine Redundancy,” for information about RPR or RPR+ redundancy in Release 12.1(13)E and later releases.
Chapter 4 Configuring EHSA Supervisor Engine Redundancy Supervisor Engine Redundant Operation EHSA standby mode provides the following features: Note • Auto-startup and bootvar synchronization between active and redundant supervisor engines • Hardware signals that detect and decide the active or redundant status of supervisor engines • Clock synchronization every 60 seconds from the active to the redundant supervisor engine • A redundant supervisor engine that is booted but not all subsystems ar
Chapter 4 Configuring EHSA Supervisor Engine Redundancy Supervisor Engine Redundant Operation Note • Note If the redundant supervisor engine is running Catalyst operating system software, remove the active supervisor engine and boot the router with only the redundant supervisor engine installed. Follow the procedures in the release notes to convert the redundant supervisor engine from Catalyst operating system software.
Chapter 4 Configuring EHSA Supervisor Engine Redundancy Supervisor Engine Redundant Operation Router(config-r-mc)# end Router# copy running-config startup-config Note To manually synchronize only individual elements of the standard auto-sync configuration, disable the default automatic synchronization feature.
Chapter 4 Configuring EHSA Supervisor Engine Redundancy Supervisor Engine Redundant Operation Use the following command to copy a file to the bootflash: device on a redundant supervisor engine: Router# copy source_device:source_filename slavesup-bootflash:target_filename Use the following command to copy a file to the bootflash: device on a redundant MSFC: Router# copy source_device:source_filename slavebootflash:target_filename Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
Chapter 4 Configuring EHSA Supervisor Engine Redundancy Supervisor Engine Redundant Operation Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Release 12.1(13)E and later releases support supervisor engine redundancy with Route Processor Redundancy (RPR) and Route Processor Redundancy Plus (RPR+). This chapter describes how to configure supervisor engine redundancy with RPR and RPR+. Note Enhanced high system availability (EHSA) is not supported in Release 12.1(13)E and later releases.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Understanding Supervisor Engine Redundancy RPR Operation RPR supports the following features: Note • Auto-startup and bootvar synchronization between active and redundant supervisor engines • Hardware signals that detect and decide the active or redundant status of supervisor engines • Clock synchronization every 60 seconds from the active to the redundant supervisor engine • A redundant supervisor engine that is booted but not all
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Understanding Supervisor Engine Redundancy RPR+ enhances RPR by providing the following additional benefits: • Reduced switchover time Depending on the configuration, the switchover time is in the range of 30 to 60 seconds.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Supervisor Engine Redundancy Guidelines and Restrictions Supervisor Engine Redundancy Guidelines and Restrictions These sections describe supervisor engine redundancy configuration guidelines and restrictions: • RPR+ Guidelines and Restrictions, page 5-4 • Hardware Configuration Guidelines and Restrictions, page 5-5 • Configuration Mode Restrictions, page 5-6 RPR+ Guidelines and Restrictions The following guidelines and restrictions ap
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Supervisor Engine Redundancy Guidelines and Restrictions Guidelines • The two Gigabit Ethernet interfaces on the redundant supervisor engine are always active. • RPR+ switchover takes place after the failed supervisor engine completes a core dump. A core dump can take up to 15 minutes. To get faster switchover time, disable core dump on the supervisor engines.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Configuring Supervisor Engine Redundancy Configuration Mode Restrictions The following configuration restrictions apply during the startup synchronization process: • You cannot perform configuration changes during the startup (bulk) synchronization.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Configuring Supervisor Engine Redundancy client count = 11 client_notification_TMR keep_alive TMR keep_alive count keep_alive threshold RF debug mask = = = = = 30000 milliseconds 4000 milliseconds 0 7 0x0 Router# Synchronizing the Supervisor Engine Configurations During normal operation, the startup-config and config-registers configuration are synchronized by default between the two supervisor engines.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Configuring Supervisor Engine Redundancy Router(config-r-mc)# no auto-sync standard Router(config-r-mc)# auto-sync config-register Router(config-r-mc)# end Router# copy running-config startup-config Displaying the Redundancy States To display the redundancy states, perform this task: Command Purpose Router# show redundancy states Displays the redundancy states.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Performing a Fast Software Upgrade Performing a Fast Software Upgrade The fast software upgrade (FSU) procedure supported by RPR allows you to upgrade the Cisco IOS image on the supervisor engines without reloading the system. Note If you are performing a first-time upgrade to RPR from EHSA, you must reload both supervisor engines. FSU from EHSA is not supported.
Chapter 5 Configuring RPR and RPR+ Supervisor Engine Redundancy Copying Files to the Redundant Supervisor Engine This example shows how to perform an FSU: Router# config terminal Router(config)# config-register 0x2 Router(config)# boot system flash slot0: c6sup22-jsv-mz.121-11.
C H A P T E R 6 Configuring Interfaces This chapter describes how to configure interfaces on the Cisco 7600 series routers.
Chapter 6 Configuring Interfaces Using the Interface Command • Port number—The physical port number on the module. On the Cisco 7600 series router, the port numbers always begin with 1. When facing the rear of the router, ports are numbered from the left to the right. You can identify ports from the physical location. You also can use show commands to display information about a specific port, or all the ports. Note With Release 12.
Chapter 6 Configuring Interfaces Using the Interface Command 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Router# Step 4 Enter the show hardware EXEC command to see a list of the system software and hardware: Router# show hardware Cisco Internetwork Operating System Software IOS (tm) c6sup2_rp Software (c6sup2_rp-JSV-M), Version 12.1(5c)EX, EARLY DEPLOY) Synced to mainline version: 12.
Chapter 6 Configuring Interfaces Configuring a Range of Interfaces Configuring a Range of Interfaces The interface-range configuration mode allows you to configure multiple interfaces with the same configuration parameters. After you enter the interface-range configuration mode, all command parameters you enter are attributed to all interfaces within that range until you exit out of the interface-range configuration mode.
Chapter 6 Configuring Interfaces Configuring a Range of Interfaces For information about macros, see the “Defining and Using Interface-Range Macros” section on page 6-6.
Chapter 6 Configuring Interfaces Defining and Using Interface-Range Macros Defining and Using Interface-Range Macros You can define an interface-range macro to automatically select a range of interfaces for configuration. Before you can use the macro keyword in the interface range macro command string, you must define the macro.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features • Configuring IEEE 802.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features To set the port speed for a 10/100 or a 10/100/1000-Mbps Ethernet port, perform this task: Command Purpose Step 1 Router(config)# interface fastethernet slot/port Selects the Ethernet port to be configured. Step 2 Router(config-if)# speed {10 | 100 | 1000 | auto} Sets the speed of the Ethernet interface. Router(config-if)# no speed Reverts to the default configuration (speed auto).
Chapter 6 Configuring Interfaces Configuring Optional Interface Features Table 6-1 Link Negotiation Configuration and Possible Link Status Link Negotiation State Link Status Local Port Remote Port Local Port Remote Port Off Off Up Up On On Up Up Off On Up Down On Off Down Up To configure link negotiation on a port, perform this task: Command Purpose Step 1 Router(config)# interface gigabitethernet slot/port Selects the port to be configured.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 input packets with dribble condition detected 1380 packets output, 514382 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Router# Configuring Jumbo Frame Support These sections describe jumbo frame support: Caution • Understanding J
Chapter 6 Configuring Interfaces Configuring Optional Interface Features Jumbo Frame Support Overview A jumbo frame is a frame larger than the default Ethernet frame size. You enable jumbo frame support by configuring a larger-than-default maximum transmission unit (MTU) size on a port or VLAN interface and, with Release 12.1(13)E and later releases, configuring the global LAN port MTU size. Note • Jumbo frame support fragments routed traffic in software on the MSFC.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features Bridged and Routed Traffic Size Check at Egress Gigabit Ethernet and 10 Gigabit Ethernet Ports Jumbo frame support compares egress traffic size with the global egress LAN port MTU size at egress Gigabit Ethernet and 10 Gigabit Ethernet LAN ports that have a nondefault MTU size configured. The port drops traffic that is oversized. With Release 12.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features Release 12.1(13)E and later releases support nondefault MTU sizes between 1,500 and 9,216 bytes for Layer 2 Ethernet ports, configured per-port with the mtu command and globally with the system jumbomtu command. With earlier releases, 9216 bytes is the only supported nondefault MTU size for Layer 2 Ethernet ports, configured per-port with the mtu command.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features This example shows how to configure the MTU size on Gigabit Ethernet port 1/2: Router# configure terminal Router(config)# interface gigabitethernet 1/2 Router(config-if)# mtu 9216 Router(config-if)# end This example shows how to verify the configuration: Router# show interface gigabitethernet 1/2 GigabitEthernet1/2 is administratively down, line protocol is down Hardware is C6k 1000Mb 802.3, address is 0030.9629.9f88 (bia 0030.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features When configuring flow control, note the following syntax information: • 10-Gigabit Ethernet ports are permanently configured to respond to pause frames. • When the configuration of the remote ports is unknown, use the receive desired keywords to configure a Gigabit Ethernet port to respond to received pause frames. • Use the receive on keywords to configure a Gigabit Ethernet port to respond to received pause frames.
Chapter 6 Configuring Interfaces Configuring Optional Interface Features Table 6-2 Port Debounce Timer Delay Time (continued) Port Type Debounce Timer Disabled Fiber Gigabit ports 10 milliseconds 10-Gigabit ports Note Debounce Timer Enabled 100 through 5000 milliseconds With Release 12.1(13)E and later releases, you can configure the port debounce timer on 10 Gigabit Ethernet ports, but it has no effect. With Release 12.
Chapter 6 Configuring Interfaces Understanding Online Insertion and Removal This example shows how to add a description on Fast Ethernet port 5/5: Router(config)# interface fastethernet 5/5 Router(config-if)# description Channel-group to "Marketing" Understanding Online Insertion and Removal The online insertion and removal (OIR) feature supported on the Cisco 7600 series routers allows you to remove and replace modules while the system is online.
Chapter 6 Configuring Interfaces Monitoring and Maintaining Interfaces To display information about the interface, perform these tasks: Command Purpose Router# show ibc Displays current internal status information. Router# show eobc Displays current internal out-of-band information. Router# show interfaces [type slot/port] Displays the status and configuration of all or a specific interface. Router# show running-config Displays the currently running configuration.
Chapter 6 Configuring Interfaces Monitoring and Maintaining Interfaces Resetting an Interface To reset an interface, perform this task: Command Purpose Router# clear interface type 1 Resets an interface. slot/port 1.
Chapter 6 Configuring Interfaces Monitoring and Maintaining Interfaces Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 7 Configuring LAN Ports for Layer 2 Switching This chapter describes how to use the command-line interface (CLI) to configure Ethernet, Fast Ethernet, Gigabit Ethernet, and 10-Gigabit Ethernet LAN ports for Layer 2 switching on the Cisco 7600 series routers. The configuration tasks in this chapter apply to LAN ports on LAN switching modules and to the LAN ports on the supervisor engine.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Understanding How Layer 2 Switching Works Layer 2 Ethernet Switching Overview Cisco 7600 series routers support simultaneous, parallel connections between Layer 2 Ethernet segments. Switched connections between Ethernet segments last only for the duration of the packet. New connections can be made between different segments for the next packet.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Understanding How Layer 2 Switching Works Trunking Overview Note For information about VLANs, see Chapter 9, “Configuring VLANs.” A trunk is a point-to-point link between the router and another networking device. Trunks carry the traffic of multiple VLANs over a single link and allow you to extend VLANs across an entire network.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Understanding How Layer 2 Switching Works Encapsulation Types Table 7-1 lists the Ethernet trunk encapsulation types. Table 7-1 Ethernet Trunk Encapsulation Types Encapsulation Function switchport trunk encapsulation isl Specifies ISL encapsulation on the trunk link. Note 10-Gigabit Ethernet ports do not support ISL encapsulation. switchport trunk encapsulation dot1q Specifies 802.1Q encapsulation on the trunk link.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Default Layer 2 LAN Interface Configuration Note DTP is a point-to-point protocol. However, some internetworking devices might forward DTP frames improperly. To avoid this problem, ensure that LAN ports connected to devices that do not support DTP are configured with the access keyword if you do not intend to trunk across those links.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Layer 2 LAN Interface Configuration Guidelines and Restrictions Layer 2 LAN Interface Configuration Guidelines and Restrictions When configuring Layer 2 LAN ports, follow these guidelines and restrictions: Restrictions • 10-Gigabit Ethernet ports do not support ISL encapsulation. • Non-Cisco 802.1Q switches maintain only a single instance of spanning tree (the Mono Spanning Tree, or MST) that defines the spanning tree topology for all VLANs.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching These sections describe how to configure Layer 2 switching on the Cisco 7600 series routers: Note • Configuring a LAN Port for Layer 2 Switching, page 7-7 • Configuring a Layer 2 Switching Port as a Trunk, page 7-8 • Configuring a LAN Interface as a Layer 2 Access Port, page 7-14 • Use the default interface {ethernet | fastethernet | gigabitethern
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Configuring a Layer 2 Switching Port as a Trunk These sections describe configuring a Layer 2 switching port as a trunk: • Preparing a Layer 2 Switching Port for Configuration as a Trunk, page 7-8 • Configuring the Layer 2 Switching Port as an ISL or 802.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching To configure the Layer 2 switching port as an ISL or 802.1Q trunk, perform this task: Command Purpose Router(config-if)# switchport trunk encapsulation {isl | dot1q | negotiate} (Optional) Configures the encapsulation, which configures the Layer 2 switching port as either an ISL or 802.1Q trunk.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching To configure the Layer 2 trunk not to use DTP, perform this task: Step 1 Step 2 Command Purpose Router(config-if)# switchport mode trunk (Optional) Configures the port to trunk unconditionally. Router(config-if)# no switchport mode Reverts to the default trunk trunking mode (switchport mode dynamic desirable).
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Note Complete the steps in the “Completing Trunk Configuration” section on page 7-13 after performing the tasks in this section. Configuring the 802.1Q Native VLAN Note Complete the steps in the “Preparing a Layer 2 Switching Port for Configuration as a Trunk” section on page 7-8 before performing the tasks in this section. To configure the 802.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching When configuring the list of VLANs allowed on a trunk, note the following syntax information: Note • The vlan parameter is either a single VLAN ID or a range of VLAN IDs described by two VLAN IDs, the lesser one first, separated by a dash. Do not enter any spaces between comma-separated vlan parameters or in dash-specified ranges. • With Release 12.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Note Complete the steps in the “Completing Trunk Configuration” section on page 7-13 after performing the tasks in this section. Completing Trunk Configuration To complete Layer 2 trunk configuration, perform this task: Command Purpose Step 1 Router(config-if)# no shutdown Activates the interface. (Required only if you shut down the interface.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Router# show interfaces fastethernet 5/8 switchport Name: Fa5/8 Switchport: Enabled Administrative Mode: dynamic desirable Operational Mode: trunk Administrative Trunking Encapsulation: negotiate Operational Trunking Encapsulation: dot1q Negotiation of Trunking: Enabled Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Trunking VLANs Enabled: ALL Pruning VLANs Enabled: ALL Router# sho
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Step 6 Command Purpose Router(config-if)# switchport access vlan vlan_ID Places the LAN port in a VLAN. • With Release 12.1(13)E and later releases, the vlan_ID value can be 1 to 4094, except for reserved VLANs (see Table 9-1 on page 9-2). • With 12.1 E releases earlier than Release 12.1(13)E, the vlan_ID value can be 1 to 1005.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Configuring a Custom IEEE 802.1Q EtherType Field Value With Release 12.1(20)E and later releases, you can configure a custom EtherType field value on a port to support network devices that do not use the standard 0x8100 EtherType field value on 802.1Q-tagged or 802.1p-tagged frames.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching • You cannot configure a custom EtherType field value on the ports in an EtherChannel. • You cannot form an EtherChannel from ports that are configured with custom EtherType field values. This example shows how to configure the EtherType field value to 0x1234: Router (config-if)# switchport dot1q ethertype 1234 Router (config-if)# Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
Chapter 7 Configuring LAN Ports for Layer 2 Switching Configuring LAN Interfaces for Layer 2 Switching Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 8 Configuring VTP This chapter describes how to configure the VLAN Trunking Protocol (VTP) on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 8 Configuring VTP Understanding How VTP Works Understanding the VTP Domain A VTP domain (also called a VLAN management domain) is made up of one or more interconnected network devices that share the same VTP domain name. A network device can be configured to be in one and only one VTP domain. You make global VLAN configuration changes for the domain using either the command-line interface (CLI) or Simple Network Management Protocol (SNMP).
Chapter 8 Configuring VTP Understanding How VTP Works The following global configuration information is distributed in VTP advertisements: • VLAN IDs (ISL and 802.1Q) • Emulated LAN names (for ATM LANE) • 802.
Chapter 8 Configuring VTP Understanding How VTP Works Figure 8-1 shows a switched network without VTP pruning enabled. Interface 1 on network Switch 1 and port 2 on Switch 4 are assigned to the Red VLAN. A broadcast is sent from the host connected to Switch 1. Switch 1 floods the broadcast, and every network device in the network receives it, even though Switches 3, 5, and 6 have no ports in the Red VLAN.
Chapter 8 Configuring VTP VTP Default Configuration Enabling VTP pruning on a VTP server enables pruning for the entire management domain. VTP pruning takes effect several seconds after you enable it. By default, VLANs 2 through 1000 are pruning eligible. VTP pruning does not prune traffic from pruning-ineligible VLANs. VLAN 1 is always pruning ineligible; traffic from VLAN 1 cannot be pruned.
Chapter 8 Configuring VTP Configuring VTP • When you enable or disable VTP pruning on a VTP server, VTP pruning for the entire management domain is enabled or disabled. • The pruning-eligibility configuration applies globally to all trunks on the router. You cannot configure pruning-eligibility separately for each trunk.
Chapter 8 Configuring VTP Configuring VTP This example shows one way to configure a VTP password with Release 12.1(13)E and later releases: Router# configure terminal Router(config)# vtp password WATER Setting device VLAN database password to WATER. Router# This example shows how to configure a VTP password with any release: Router# vtp password WATER Setting device VLAN database password to WATER. Router# Note The password is not stored in the running-config file.
Chapter 8 Configuring VTP Configuring VTP Note In a Token Ring environment, you must enable VTP version 2 for Token Ring VLAN switching to function properly on devices that support Token Ring interfaces. To enable VTP version 2, perform this task: Step 1 Step 2 Command Purpose Router(config)# vtp version {1 | 2} Enables VTP version 2. Router(config)# no vtp version Reverts to the default (VTP version 1). Router# show vtp status Verifies the configuration.
Chapter 8 Configuring VTP Configuring VTP Note When VTP is disabled, you can enter VLAN configuration commands in configuration mode instead of the VLAN database mode and the VLAN configuration is stored in the startup configuration file. This example shows how to configure the router as a VTP server: Router# configure terminal Router(config)# vtp mode server Setting device to VTP SERVER mode.
Chapter 8 Configuring VTP Configuring VTP This example shows how to verify the configuration: Router# show vtp status VTP Version : 2 Configuration Revision : 247 Maximum VLANs supported locally : 1005 Number of existing VLANs : 33 VTP Operating Mode : Transparent VTP Domain Name : Lab_Network VTP Pruning Mode : Enabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80 Configuration last modified by 0.0.0.
C H A P T E R 9 Configuring VLANs This chapter describes how to configure VLANs on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 9 Configuring VLANs Understanding How VLANs Work VLAN Ranges Note You must enable the extended system ID to use 4096 VLANs (see the “Understanding the Bridge ID” section on page 15-3). With Release 12.1(13)E and later releases, Cisco 7600 series routers support 4096 VLANs in accordance with the IEEE 802.1Q standard. These VLANs are organized into several ranges; you use each range slightly differently.
Chapter 9 Configuring VLANs Understanding How VLANs Work Configurable VLAN Parameters Note • Ethernet VLAN 1 uses only default values. • Except for the VLAN name, Ethernet VLANs 1006 through 4094 use only default values. • With Release 12.1(13)E and later releases, you can configure the VLAN name for Ethernet VLANs 1006 through 4094.
Chapter 9 Configuring VLANs Understanding How VLANs Work Figure 9-1 Interconnected Token Ring TrBRF and TrCRF VLANs SRB or SRT BRF CRF Token Ring 001 Token Ring 001 SRS Token Ring 011 SRS Token Ring 002 Token Ring 002 Token Ring 002 S6624 SRS For source routing, the Cisco 7600 series router appears as a single bridge between the logical rings. The TrBRF can function as a source-route bridge (SRB) or a source-route transparent (SRT) bridge running either the IBM or IEEE STP.
Chapter 9 Configuring VLANs Understanding How VLANs Work Figure 9-2 Undistributed TrCRFs Switch A Switch B ISL TrCRF 350 TrCRF 200 S6813 TrBRF 3 TrCRF 400 By default, Token Ring ports are associated with the default TrCRF (VLAN 1003, trcrf-default), which has the default TrBRF (VLAN 1005, trbrf-default) as its parent.
Chapter 9 Configuring VLANs VLAN Default Configuration Figure 9-4 Backup TrCRF Switch A Switch B ISL TrBRF 1 TrCRF 601 TrCRF 600 S6811 Backup TrCRF 612 VLAN Default Configuration Tables 9-2 through 9-6 show the default configurations for the different VLAN media types. Table 9-2 Ethernet VLAN Defaults and Ranges Parameter Default Range VLAN ID 1 1–4094 VLAN name “default” for VLAN 1 “VLANvlan_ID” for other Ethernet VLANs — 802.
Chapter 9 Configuring VLANs VLAN Default Configuration Table 9-3 FDDI VLAN Defaults and Ranges (continued) Parameter Default Range Translational bridge 2 0 0–1005 VLAN state active active, suspend Table 9-4 Token Ring (TrCRF) VLAN Defaults and Ranges Parameter Default Range VLAN ID 1003 1–1005 VLAN name “token-ring-default” — 802.
Chapter 9 Configuring VLANs VLAN Configuration Guidelines and Restrictions Table 9-6 Token Ring (TrBRF) VLAN Defaults and Ranges (continued) Parameter Default Range MTU size VTPv1 1500; VTPv2 4472 1500–18190 Bridge number 1 0–15 STP type ibm auto, ibm, ieee VLAN state active active, suspend VLAN Configuration Guidelines and Restrictions Follow these guidelines and restrictions when creating and modifying VLANs in your network: Restrictions • Supervisor engine redundancy does not suppor
Chapter 9 Configuring VLANs Configuring VLANs • When a Cisco 7600 series router is configured as a VTP server, you can configure FDDI and Token Ring VLANs from the router. • You must configure a TrBRF before you configure the TrCRF (the parent TrBRF VLAN you specify must exist).
Chapter 9 Configuring VLANs Configuring VLANs Note • When the router boots, if the VTP domain name and VTP mode in the startup-config and vlan.dat files do not match, the router uses the configuration in the vlan.dat file. • You can configure extended-range VLANs only in global configuration mode. You cannot configure extended-range VLANs in VLAN database mode. VLAN Configuration in VLAN Database Mode Note You cannot configure extended-range VLANs in VLAN database mode.
Chapter 9 Configuring VLANs Configuring VLANs Step 3 Command Purpose Router(config-vlan)# end Updates the VLAN database and returns to privileged EXEC mode. or Router(vlan)# exit Step 4 Router# show vlan [id | name] vlan Verifies the VLAN configuration. When you create or modify an Ethernet VLAN, note the following syntax information: • Releases 12.1(11b)E and later support VLAN configuration in global configuration mode. • Releases 12.1(13)E and later support extended-range VLANs.
Chapter 9 Configuring VLANs Configuring VLANs This example shows how to verify the configuration: Router# show vlan name VLAN0003 VLAN Name Status Ports ---- -------------------------------- --------- --------------------3 VLAN0003 active VLAN Type SAID MTU Parent RingNo BridgeNo Stp Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- ------ -----3 enet 100003 1500 0 0 Router# Assigning a Layer 2 LAN Interface to a VLAN A VLAN created in a management domain remains unused until you ass
Chapter 9 Configuring VLANs Configuring VLANs This example shows how to configure descending as the internal VLAN allocation policy: Router# configure terminal Router(config)# vlan internal allocation policy descending Mapping 802.1Q VLANs to ISL VLANs The valid range of user-configurable ISL VLANs is 1 through 1001 and 1006 through 4094. The valid range of VLANs specified in the IEEE 802.1Q standard is 1 to 4094. You can map 802.1Q VLAN numbers to ISL VLAN numbers. 802.
Chapter 9 Configuring VLANs Configuring VLANs Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 10 Configuring Private VLANs This chapter describes how to configure private VLANs on the Cisco 7600 series routers. Release 12.1 E supports private VLANs with Release 12.1(11b)E and later. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 10 Configuring Private VLANs Private VLAN Configuration Guidelines Private VLAN ports are associated with a set of supporting VLANs that are used to create the private VLAN structure. A private VLAN uses VLANs three ways: Note • Primary VLAN—Carries traffic from promiscuous ports to isolated, community, and other promiscuous ports. • Isolated VLAN—Carries traffic from isolated ports to promiscuous ports. • Community VLAN—Carries traffic between community ports and to promiscuous ports.
Chapter 10 Configuring Private VLANs Private VLAN Configuration Guidelines • Do not configure private VLAN ports as EtherChannels. While a port is part of the private VLAN configuration, any EtherChannel configuration for it is inactive. • Destination SPAN configuration supersedes private VLAN configuration. While a port is a destination SPAN port, any private VLAN configuration for it is inactive.
Chapter 10 Configuring Private VLANs Configuring Private VLANs and uses all intermediate values internally as a range. You should disable a root bridge with private VLANs and MAC address reduction, and configure the root bridge with any priority higher than the highest priority range used by any nonroot bridge. • You can apply different quality of service (QoS) configuration to primary, isolated, and community VLANs (see Chapter 32, “Configuring PFC QoS”).
Chapter 10 Configuring Private VLANs Configuring Private VLANs Note With Release 12.1(11b)E and later, when you are in configuration mode you can enter EXEC mode-level commands by entering the do keyword before the EXEC mode-level command. Configuring a VLAN as a Private VLAN To configure a VLAN as a private VLAN, perform this task: Command Purpose Step 1 Router(config)# vlan vlan_ID Enters VLAN configuration submode.
Chapter 10 Configuring Private VLANs Configuring Private VLANs Associating Secondary VLANs with a Primary VLAN To associate secondary VLANs with a primary VLAN, perform this task: Command Purpose Step 1 Router(config)# vlan primary_vlan_ID Enters VLAN configuration submode for the primary VLAN. Step 2 Router(config-vlan)# private-vlan association {secondary_vlan_list | add secondary_vlan_list | remove secondary_vlan_list} Associates the secondary VLANs with the primary VLAN.
Chapter 10 Configuring Private VLANs Configuring Private VLANs Mapping Secondary VLANs to the Layer 3 VLAN Interface of a Primary VLAN Note Isolated and community VLANs are both called secondary VLANs. To map secondary VLANs to the Layer 3 VLAN interface of a primary VLAN to allow Layer 3 switching of private VLAN ingress traffic, perform this task: Command Purpose Step 1 Router(config)# interface vlan primary_vlan_ID Enters interface configuration mode for the primary VLAN.
Chapter 10 Configuring Private VLANs Configuring Private VLANs Configuring a Layer 2 Interface as a Private VLAN Host Port To configure a Layer 2 interface as a private VLAN host port, perform this task: Command Purpose Step 1 Router(config)# interface type Step 2 Router(config-if)# switchport Step 3 Step 4 Step 5 Step 6 1 slot/port Selects the LAN port to configure.
Chapter 10 Configuring Private VLANs Configuring Private VLANs Configuring a Layer 2 Interface as a Private VLAN Promiscuous Port To configure a Layer 2 interface as a private VLAN promiscuous port, perform this task: Command Purpose Step 1 Router(config)# interface type Step 2 Router(config-if)# switchport Step 3 Step 4 Step 5 Step 6 1 slot/port Selects the LAN interface to configure.
Chapter 10 Configuring Private VLANs Configuring Private VLANs This example shows how to verify the configuration: Router# show interfaces fastethernet 5/2 switchport Name: Fa5/2 Switchport: Enabled Administrative Mode: private-vlan promiscuous Operational Mode: down Administrative Trunking Encapsulation: negotiate Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Administrative private-vlan host-association: none ((Inactive)) Administrative private-vlan map
C H A P T E R 11 Configuring Cisco IP Phone Support This chapter describes how to configure support for Cisco IP Phones on the Cisco 7600 series routers. Release 12.1(13)E and later releases support Cisco IP Phones. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication for this release.
Chapter 11 Configuring Cisco IP Phone Support Understanding Cisco IP Phone Support Figure 11-1 Cisco IP Phone Connected to a Switch Cisco IP Phone 7960 Phone ASIC Workstation/PC P2 3-port switch P3 Access port Catalyst switch or Cisco Router 79490 P1 10/100 module Cisco IP Phone Voice Traffic The Cisco IP Phone transmits voice traffic with Layer 3 IP precedence and Layer 2 CoS values, which are both set to 5 by default.
Chapter 11 Configuring Cisco IP Phone Support Understanding Cisco IP Phone Support Cisco IP Phone Data Traffic Note Untagged traffic from the device attached to the Cisco IP Phone passes through the Cisco IP Phone unchanged, regardless of the trust state of the access port on the Cisco IP Phone. To process tagged data traffic (traffic in 802.1Q or 802.
Chapter 11 Configuring Cisco IP Phone Support Default Cisco IP Phone Support Configuration When a switching module port detects an unpowered Cisco IP Phone, the switching module reports to the supervisor engine that an unpowered Cisco IP Phone is present and on which module and port. If the port is configured in auto mode, the supervisor engine determines if there is enough system power available to power up the Cisco IP Phone.
Chapter 11 Configuring Cisco IP Phone Support Configuring Cisco IP Phone Support • You cannot configure 10/100 Mbps ports with QoS port architecture 1p4t/2q2t to trust received Layer 2 CoS values. Configure policies to trust the Layer 3 IP precedence value on switching modules with QoS port architecture 1p4t/2q2t. • The following conditions indicate that the Cisco IP Phone and a device attached to the Cisco IP Phone are in the same VLAN and must be in the same IP subnet: – If they both use 802.
Chapter 11 Configuring Cisco IP Phone Support Configuring Cisco IP Phone Support Command Purpose Step 3 Router(config)# end Exits configuration mode. Step 4 Router# show interfaces fastethernet slot/port switchport Router# show running-config interface fastethernet slot/port Verifies the configuration.
Chapter 11 Configuring Cisco IP Phone Support Configuring Cisco IP Phone Support Configuring Data Traffic Support To configure the way in which the Cisco IP Phone transmits data traffic, perform this task: Command Purpose Step 1 Router(config)# interface fastethernet slot/port Selects the port to configure. Step 2 Router(config-if)# mls qos trust extend [cos cos_value] Configures the way in which the Cisco IP Phone transmits data traffic.
Chapter 11 Configuring Cisco IP Phone Support Configuring Cisco IP Phone Support Configuring Inline Power Support To configure inline power support, perform this task: Command Purpose Step 1 Router(config)# interface fastethernet slot/port Selects the port to configure. Step 2 Router(config-if)# power inline {auto | never} Configures inline power support. Router(config-if)# no power inline Clears the configuration. Step 3 Router(config)# end Exits configuration mode.
C H A P T E R 12 Configuring Layer 3 Interfaces This chapter contains information about how to configure Layer 3 interfaces on the Cisco 7600 series routers, which supplements the information and procedures in the Release 12.1 publications at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/index.
Chapter 12 Configuring Layer 3 Interfaces Configuring IP Routing and Addresses • With Release 12.1(11b)E and later, when you are in configuration mode you can enter EXEC mode-level commands by entering the do keyword before the EXEC mode-level command. Configuring IP Routing and Addresses For complete information and procedures, refer to these publications: • Cisco IOS IP and IP Routing Configuration Guide, Release 12.1, at this URL: http://www.cisco.
Chapter 12 Configuring Layer 3 Interfaces Configuring IP Routing and Addresses Step 7 Command Purpose Router# show interfaces [{vlan vlan_ID} | {type1 slot/port} | {port-channel port_channel_number}] Router# show ip interfaces [{vlan vlan_ID} | {type1 slot/port} | {port-channel port_channel_number}] Router# show running-config interfaces [{vlan vlan_ID} | {type1 slot/port} | {port-channel port_channel_number}] Verifies the configuration. 1.
Chapter 12 Configuring Layer 3 Interfaces Configuring IP Routing and Addresses This example uses the show ip interface command to display the detailed configuration and status of Fast Ethernet port 5/4: Router# show ip interface fastethernet 5/4 FastEthernet5/4 is up, line protocol is up Internet address is 172.20.52.106/29 Broadcast address is 255.255.255.
Chapter 12 Configuring Layer 3 Interfaces Configuring IPX Routing and Network Numbers Configuring IPX Routing and Network Numbers For complete information and procedures, refer to these publications: • Cisco IOS AppleTalk and Novell IPX Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/atipx_c/index.htm • Cisco IOS AppleTalk and Novell IPX Command Reference, Release 12.1, at this URL: http://www.cisco.
Chapter 12 Configuring Layer 3 Interfaces Configuring AppleTalk Routing, Cable Ranges, and Zones Configuring AppleTalk Routing, Cable Ranges, and Zones For complete information and procedures, refer to these publications: • Cisco IOS AppleTalk and Novell IPX Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/atipx_c/index.htm • Cisco IOS AppleTalk and Novell IPX Command Reference, Release 12.1, at this URL: http://www.cisco.
Chapter 12 Configuring Layer 3 Interfaces Configuring Other Protocols on Layer 3 Interfaces Configuring Other Protocols on Layer 3 Interfaces Refer to these publications for information about configuring other protocols on Layer 3 interfaces: • Cisco IOS Apollo Domain, VINES, DECnet, ISO CLNS, and XNS Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/apollo_c/index.
Chapter 12 Configuring Layer 3 Interfaces Configuring Other Protocols on Layer 3 Interfaces Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 13 Configuring EtherChannels This chapter describes how to configure EtherChannels on the Cisco 7600 series router Layer 2 or Layer 3 LAN ports. Note • For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication. • The commands in the following sections can be used on all LAN ports in Cisco 7600 series routers, including the ports on the supervisor engine and a redundant supervisor engine.
Chapter 13 Configuring EtherChannels Understanding How EtherChannels Work EtherChannel Feature Overview An EtherChannel bundles individual Ethernet links into a single logical link that provides the aggregate bandwidth of up to eight physical links. A Cisco 7600 series router supports a maximum of 64 EtherChannels (256 with Release 12.1(2)E and earlier). You can form an EtherChannel with up to eight compatibly configured LAN ports on any module in a Cisco 7600 series router.
Chapter 13 Configuring EtherChannels Understanding How EtherChannels Work Table 13-1 EtherChannel Modes Mode Description on Mode that forces the LAN port to channel unconditionally. In the on mode, a usable EtherChannel exists only when a LAN port group in the on mode is connected to another LAN port group in the on mode. Because ports configured in the on mode do not negotiate, there is no negotiation traffic between the ports. You cannot configure the on mode with an EtherChannel protocol.
Chapter 13 Configuring EtherChannels Understanding How EtherChannels Work The protocol learns the capabilities of LAN port groups dynamically and informs the other LAN ports. Once LACP identifies correctly matched Ethernet links, it facilitates grouping the links into an EtherChannel. The EtherChannel is then added to the spanning tree as a single bridge port.
Chapter 13 Configuring EtherChannels EtherChannel Feature Configuration Guidelines and Restrictions Understanding Port Channel Interfaces Each EtherChannel has a numbered port channel interface. Release 12.1(5)E and later releases support a maximum of 64 port channel interfaces, numbered from 1 to 256. Note Releases 12.1(4)E1, 12.1(3a)E4, and 12.1(3a)E3 support a maximum of 64 port channel interfaces, numbered from 1 to 64. Releases 12.
Chapter 13 Configuring EtherChannels Configuring EtherChannels • Enable all LAN ports in an EtherChannel. If you shut down a LAN port in an EtherChannel, it is treated as a link failure and its traffic is transferred to one of the remaining ports in the EtherChannel. • An EtherChannel will not form if one of the LAN ports is a Switched Port Analyzer (SPAN) destination port.
Chapter 13 Configuring EtherChannels Configuring EtherChannels Configuring Port Channel Logical Interfaces for Layer 3 EtherChannels Note • When configuring Layer 2 EtherChannels, you cannot put Layer 2 LAN ports into manually created port channel logical interfaces. If you are configuring a Layer 2 EtherChannel, do not perform the procedures in this section (see the “Configuring Channel Groups” section on page 13-8).
Chapter 13 Configuring EtherChannels Configuring EtherChannels Configuring Channel Groups Note • When configuring Layer 3 EtherChannels, you must manually create the port channel logical interface first (see the “Configuring Port Channel Logical Interfaces for Layer 3 EtherChannels” section on page 13-7), and then put the Layer 3 LAN ports into the channel group as described in this section.
Chapter 13 Configuring EtherChannels Configuring EtherChannels Note See the “Configuring a Range of Interfaces” section on page 6-4 for information about the range keyword. This example shows how to verify the configuration of port channel interface 2: Router# show running-config interface port-channel 2 Building configuration...
Chapter 13 Configuring EtherChannels Configuring EtherChannels This example shows how to verify the configuration of port channel interface 2 after the LAN ports have been configured: Router# show etherchannel 12 port-channel Port-channels in the group: ---------------------Port-channel: Po12 -----------Age of the Port-channel = 04d:18h:58m:50s Logical slot/port = 14/1 Number of ports = 0 GC = 0x00000000 HotStandBy port = null Port state = Port-channel Ag-Not-Inuse Protocol = PAgP Router# Configuring th
Chapter 13 Configuring EtherChannels Configuring EtherChannels Configuring EtherChannel Load Balancing To configure EtherChannel load balancing, perform this task: Command Purpose Router(config)# port-channel load-balance {src-mac | dst-mac | src-dst-mac | src-ip | dst-ip | src-dst-ip | src-port | dst-port | src-dst-port} Configures EtherChannel load balancing. Router(config)# no port-channel load-balance Reverts to default EtherChannel load balancing.
Chapter 13 Configuring EtherChannels Configuring EtherChannels Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling With Release 12.1(13)E and later, the Cisco 7600 series routers support IEEE 802.1Q tunneling and Layer 2 protocol tunneling. This chapter describes how to configure IEEE 802.1Q tunneling and Layer 2 protocol tunneling on the Cisco 7600 series routers. Note • For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Understanding How 802.1Q Tunneling Works Figure 14-1 IEEE 802.1Q Tunnel Ports in a Service-Provider Network Customer A VLANs 1 to 100 Customer A VLANs 1 to 100 Service provider Tunnel port VLAN 30 Tunnel port VLAN 30 Tunnel port VLAN 30 Trunk ports Trunk ports Tunnel port VLAN 40 74016 Tunnel port VLAN 40 Customer B VLANs 1 to 200 Customer B VLANs 1 to 200 Trunk Asymmetric link Figure 14-2 Untagged, 802.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling 802.1Q Tunneling Configuration Guidelines and Restrictions When a tunnel port receives tagged customer traffic from an 802.1Q trunk port, it does not strip the received 802.1Q tag from the frame header; instead, the tunnel port leaves the 802.1Q tag intact, adds a 2-byte Ethertype field (0x8100) followed by a 2-byte field containing the priority (CoS) and the VLAN.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling 802.1Q Tunneling Configuration Guidelines and Restrictions • The 802.1Q tunneling feature cannot be configured on ports configured to support private VLANs • VLAN Trunk Protocol (VTP) does not work between the following devices: – Devices connected by an asymmetrical link – Devices communicating through a tunnel Note VTP works between tunneled devices if Layer 2 protocol tunneling is enabled.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Configuring 802.1Q Tunneling • If the service provider does not want the customer to see its switches, CDP should be disabled on the 802.1Q tunnel port as follows: Router(config-if)# no cdp enable Configuring 802.1Q Tunneling These sections describe 802.1Q tunneling configuration: Caution • Preconfiguration Tasks, page 14-5 • Configuring 802.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Configuring 802.1Q Tunneling Configuring 802.1Q Tunnel Ports To configure 802.1Q tunneling on a port, perform this task: Command Purpose Step 1 Router(config)# interface type Step 2 Router(config-if)# switchport Step 3 1 slot/port Selects the LAN port to configure.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Understanding How Layer 2 Protocol Tunneling Works Understanding How Layer 2 Protocol Tunneling Works Layer 2 protocol tunneling allows Layer 2 protocol data units (PDUs) (CDP, STP, and VTP) to be tunneled through a network. This section uses the following terminology: • Edge switch—The switch connected to the customer switch and placed on the boundary of the service provider network (see Figure 14-3).
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Configuring Support for Layer 2 Protocol Tunneling Configuring Support for Layer 2 Protocol Tunneling Note Encapsulated PDUs received by an 802.1Q tunnel port are transmitted from other tunnel ports in the same VLAN on the router.
Chapter 14 Configuring IEEE 802.
Chapter 14 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling Configuring Support for Layer 2 Protocol Tunneling Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 15 Configuring STP and IEEE 802.1s MST This chapter describes how to configure the Spanning Tree Protocol (STP) and the IEEE 802.1s Multiple Spanning Tree (MST) protocol on Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication. This chapter consists of these sections: Note • Understanding How STP Works, page 15-2 • Understanding How IEEE 802.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Understanding How STP Works These sections describe how STP works: • STP Overview, page 15-2 • Understanding the Bridge ID, page 15-3 • Understanding Bridge Protocol Data Units, page 15-4 • Election of the Root Bridge, page 15-4 • STP Protocol Timers, page 15-5 • Creating the Spanning Tree Topology, page 15-5 • STP Port States, page 15-6 • STP and IEEE 802.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Understanding the Bridge ID Each VLAN on each network device has a unique 64-bit bridge ID consisting of a bridge priority value, an extended system ID, and an STP MAC address allocation. This section contains these topics: • Bridge Priority Value, page 15-3 • Extended System ID, page 15-3 • STP MAC Address Allocation, page 15-3 Bridge Priority Value With Release 12.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works If you have a network device in your network with MAC address reduction enabled, you should also enable MAC address reduction on all other Layer-2 connected network devices to avoid undesirable root bridge election and spanning tree topology issues. When MAC address reduction is enabled, the root bridge priority becomes a multiple of 4096 plus the VLAN ID.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works The STP root bridge is the logical center of the spanning tree topology in a Layer 2 network. All paths that are not needed to reach the root bridge from anywhere in the Layer 2 network are placed in STP blocking mode. BPDUs contain information about the transmitting bridge and its ports, including bridge and MAC addresses, bridge priority, port priority, and path cost.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works For example, assume that one port on Switch B is a fiber-optic link, and another port on Switch B (an unshielded twisted-pair [UTP] link) is the root port. Network traffic might be more efficient over the high-speed fiber-optic link. By changing the STP port priority on the fiber-optic port to a higher priority (lower numerical value) than the root port, the fiber-optic port becomes the new root port.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Figure 15-2 STP Layer 2 LAN Interface States Boot-up initialization Blocking state Listening state Disabled state Forwarding state S5691 Learning state When you enable STP, every port in the Cisco 7600 series router, VLAN, and network goes through the blocking state and the transitory states of listening and learning at power up. If properly configured, each Layer 2 LAN port stabilizes to the forwarding or blocking state.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Blocking State A Layer 2 LAN port in the blocking state does not participate in frame forwarding, as shown in Figure 15-3. After initialization, a BPDU is sent out to each Layer 2 LAN port. A network device initially assumes it is the root until it exchanges BPDUs with other network devices. This exchange establishes which network device in the network is the root or root bridge.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Listening State The listening state is the first transitional state a Layer 2 LAN port enters after the blocking state. The Layer 2 LAN port enters this state when STP determines that the Layer 2 LAN port should participate in frame forwarding. Figure 15-4 shows a Layer 2 LAN port in the listening state.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Learning State A Layer 2 LAN port in the learning state prepares to participate in frame forwarding. The Layer 2 LAN port enters the learning state from the listening state. Figure 15-5 shows a Layer 2 LAN port in the learning state.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Forwarding State A Layer 2 LAN port in the forwarding state forwards frames, as shown in Figure 15-6. The Layer 2 LAN port enters the forwarding state from the learning state.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How STP Works Disabled State A Layer 2 LAN port in the disabled state does not participate in frame forwarding or STP, as shown in Figure 15-7. A Layer 2 LAN port in the disabled state is virtually nonoperational.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1w RSTP Works Understanding How IEEE 802.1w RSTP Works Note In Cisco IOS release 12.1(11)EX and later releases, RSTP is implemented as part of Multiple Spanning Tree Protocol (MSTP). In Cisco IOS release 12.1(13)E and later releases, RSTP is also available as a standalone protocol in Rapid-Per-VLAN-Spanning Tree (Rapid-PVST) mode. In this mode, the switch runs an RSTP instance on each VLAN, which follows the usual PVST+ approach.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works • Backup—A backup for the path provided by a designated port toward the leaves of the spanning tree. Backup ports can exist only where two ports are connected together in a loopback by a point-to-point link or bridge with two or more connections to a shared LAN segment. • Disabled—A port that has no role within the operation of spanning tree.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works These sections describe Multiple Spanning Tree (MST): • IEEE 802.1s MST Overview, page 15-15 • MST-to-PVST Interoperability, page 15-16 • Common Spanning Tree, page 15-18 • MST Instances, page 15-18 • MST Configuration Parameters, page 15-18 • MST Regions, page 15-19 • Message Age and Hop Count, page 15-20 • Default STP Configuration, page 15-21 IEEE 802.1s MST Overview Releases 12.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works • MST establishes and maintains additional spanning trees within each MST region. These spanning trees are referred to as MST instances (MSTIs). The IST is numbered 0, and the MSTIs are numbered 1,2,3, and so on. Any MSTI is local to the MST region that is independent of MSTIs in another region, even if the MST regions are interconnected.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works An MST region appears as an SST or pseudobridge to STP running in the SST region. Pseudobridges operate as follows: • The same values for root identifiers and root path costs are sent in all BPDUs of all the pseudobridge ports. Pseudobridges differ from a single SST bridge as follows: – The pseudobridge BPDUs have different bridge identifiers.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works When you connect a PVST+ switch to two different MST regions, the topology change from the PVST+ switch does not pass beyond the first MST region. In this case, the topology changes are only propagated in the instance to which the VLAN is mapped. The topology change stays local to the first MST region and the CAM entries in the other region are not flushed.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works MST Regions These sections describe MST regions: • MST Region Overview, page 15-19 • Boundary Ports, page 15-19 • IST Master, page 15-19 • Edge Ports, page 15-20 • Link Type, page 15-20 MST Region Overview Interconnected bridges that have the same MST configuration are referred to as an MST region. There is no limit on the number of MST regions in the network.
Chapter 15 Configuring STP and IEEE 802.1s MST Understanding How IEEE 802.1s MST Works If two or more bridges at the boundary of a region have an identical path to the root, you can set a slightly lower bridge priority to make a specific bridge the IST master. The root path cost and message age inside a region stay constant, but the IST path cost is incremented and the IST remaining hops are decremented at each hop.
Chapter 15 Configuring STP and IEEE 802.1s MST Default STP Configuration Default STP Configuration Table 15-5 shows the default STP configuration.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP • Ensure that trunks carry all of the VLANs mapped to an instance or do not carry any VLANs at all for this instance. • Do not connect switches with access links because access links may partition a VLAN.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP Enabling STP Note STP is enabled by default on VLAN 1 and on all newly created VLANs. You can enable STP on a per-VLAN basis. The Cisco 7600 series router maintains a separate instance of STP for each VLAN (except on VLANs on which you disable STP). To enable STP on a per-VLAN basis, perform this task: Command Purpose Router(config)# spanning-tree vlan vlan_ID Enables STP on a per-VLAN basis.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP This example shows how to verify the configuration: Router# show spanning-tree vlan 200 VLAN0200 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 00d0.00b8.14c8 This bridge is the root Hello Time 2 sec Max Age 20 sec Bridge ID Priority 32768 Address 00d0.00b8.14c8 Hello Time 2 sec Max Age 20 sec Aging Time 300 Interface ---------------Fa4/4 Fa4/5 Role ---Desg Back Sts --FWD BLK Cost --------200000 200000 Prio.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP This example shows how to enable the extended system ID: Router# configure terminal Router(config)# spanning-tree extend system-id Router(config)# end Router# This example shows how to verify the configuration: Router# show spanning-tree summary | include Extended Extended system ID is enabled. Configuring the Root Bridge Cisco 7600 series routers maintain a separate instance of STP for each active VLAN.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP Use the diameter keyword to specify the Layer 2 network diameter (that is, the maximum number of bridge hops between any two end stations in the Layer 2 network). When you specify the network diameter, the Cisco 7600 series router automatically selects an optimal hello time, forward delay time, and maximum age time for a network of that diameter, which can significantly reduce the STP convergence time.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP To configure a Cisco 7600 series router as the secondary root bridge, perform this task: Step 1 Step 2 Command Purpose Router(config)# [no] spanning-tree vlan vlan_ID root secondary [diameter hops [hello-time seconds]] Configures a Cisco 7600 series router as the secondary root bridge. The vlan_ID value can be 1 through 4094, except reserved VLANs (see Table 9-1 on page 9-2).
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP Command Step 5 Purpose 1 Router# show spanning-tree interface {type slot/port} | {port-channel port_channel_number} Router# show spanning-tree vlan vlan_ID 1. Verifies the configuration.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP You also can display spanning tree information for VLAN 200 using the following command: Router# show spanning-tree vlan 200 interface fastEthernet 4/4 Interface Role Sts Cost Prio.Nbr Status ---------------- ---- --- --------- -------- -------------------------------Fa4/4 Desg LRN 200000 64.196 P2p Configuring STP Port Cost The STP port path cost default value is determined from the media speed of a LAN interface.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP VLAN0006 VLAN0007 VLAN0008 VLAN0009 VLAN0010 Router# Back Back Back Back Back BLK BLK BLK BLK BLK 1000 1000 1000 1000 1000 160.196 160.196 160.196 160.196 160.196 P2p P2p P2p P2p P2p This example shows how to configure the port priority at an individual port VLAN cost for VLAN 200: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP To configure the STP bridge priority of a VLAN when the extended system ID is disabled, perform this task: Command Purpose Router(config)# spanning-tree vlan vlan_ID priority bridge_priority Configures the bridge priority of a VLAN when the extended system ID is disabled. The bridge_priority value can be from 1 to 65535. The vlan_ID value can be 1 through 4094, except reserved VLANs (see Table 9-1 on page 9-2).
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP Configuring the Hello Time Note Be careful when using this command. For most situations, we recommend that you use the spanning-tree vlan vlan_ID root primary and spanning-tree vlan vlan_ID root secondary commands to modify the hello time. To configure the STP hello time of a VLAN, perform this task: Command Purpose Router(config)# spanning-tree vlan vlan_ID hello-time hello_time Configures the hello time of a VLAN.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring STP This example shows how to configure the forward delay time for VLAN 200 to 21 seconds: Router# configure terminal Router(config)# spanning-tree vlan 200 forward-time 21 Router(config)# end Router# This example shows how to verify the configuration: Router# show spanning-tree vlan 200 bridge Hello Max Fwd Vlan Bridge ID Time Age Delay ---------------- -------------------- ---- ---- ----VLAN200 49152 0050.3e8d.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Specifying the Link Type Rapid connectivity is established only on point-to-point links. Spanning tree views a point-to-point link as a segment connecting only two switches running the spanning tree algorithm. Because the switch assumes that all full-duplex links are point-to-point links and that half-duplex links are shared links, you can avoid explicitly configuring the link type.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Command Purpose Step 4 Router(config-mst)# show current Displays the current MST configuration from within the MST configuration submode Step 5 Router(config-mst)# name name revision revision_number instance instance_number vlan vlan_range Enters the MST configuration. Step 6 Router(config-mst)# no instance instance_number (Optional) Unmaps all VLANs that were mapped to an instance.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Router# show spanning-tree mst ###### MST00 vlans mapped: 11-4094 Bridge address 00d0.00b8.1400 priority 32768 (32768 sysid Root address 00d0.004a.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Router# show spanning-tree mst 1 detail ###### MST01 vlans mapped: 1-10 Bridge address 00d0.00b8.1400 priority Root this switch for MST01 32769 (32768 sysid 1) FastEthernet4/4 of MST01 is backup blocking Port info port id 160.196 priority 160 cost 1000 Designated root address 00d0.00b8.1400 priority 32769 cost 0 Designated bridge address 00d0.00b8.1400 priority 32769 port id 128.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Configuring MST Instance Parameters To configure MST instance parameters, perform these tasks: Command Purpose Step 1 Router(config)# spanning-tree mst X priority Y Configures the priority for an MST instance Step 2 Router(config)# spanning-tree mst X root [primary | secondary] Configures the bridge as root for an MST instance. Step 3 Router# show spanning-tree mst Verifies the configuration.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Configuring MST Instance Port Parameters To configure MST instance port parameters, perform these tasks: Command Purpose Step 1 Router(config-if)# spanning-tree mst x cost y Configures the MST instance port cost. Step 2 Router(config-if)# spanning-tree mst x port-priority y Configures the MST instance port priority. Step 3 Router# show spanning-tree mst x interface y Verifies the configuration.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST To restart the protocol migration process (force the renegotiation with neighboring switches) on the entire switch, you can use the clear spanning-tree detected-protocols privileged EXEC command. Use the clear spanning-tree detected-protocols interface interface-id privileged EXEC command to restart the protocol migration process on a specific interface.
Chapter 15 Configuring STP and IEEE 802.1s MST Configuring IEEE 802.1s MST Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 16 Configuring Optional STP Features This chapter describes how to configure optional STP features. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 16 Configuring Optional STP Features Understanding How PortFast Works Understanding How PortFast Works STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately, bypassing the listening and learning states. You can use PortFast on Layer 2 access ports connected to a single workstation or server to allow those devices to connect to the network immediately, instead of waiting for STP to converge.
Chapter 16 Configuring Optional STP Features Understanding How UplinkFast Works When you enable PortFast BPDU filtering globally and set the port configuration as the default for PortFast BPDU filtering (see the “Enabling PortFast BPDU Filtering” section on page 16-10), then PortFast enables or disables PortFast BPDU filtering. If the port configuration is not set to default, then the PortFast configuration will not affect PortFast BPDU filtering.
Chapter 16 Configuring Optional STP Features Understanding How BackboneFast Works If Switch C detects a link failure on the currently active link L2 on the root port (a direct link failure), UplinkFast unblocks the blocked port on Switch C and transitions it to the forwarding state without going through the listening and learning states, as shown in Figure 16-2. This switchover takes approximately one to five seconds.
Chapter 16 Configuring Optional STP Features Understanding How BackboneFast Works Figure 16-3 BackboneFast Example Before Indirect Link Failure Switch A (Root) Switch B L1 L2 L3 11241 Blocked port Switch C If link L1 fails, Switch C cannot detect this failure because it is not connected directly to link L1. However, because Switch B is directly connected to the root bridge over L1, it detects the failure and elects itself the root and begins sending BPDUs to Switch C indicating itself as the root.
Chapter 16 Configuring Optional STP Features Understanding How EtherChannel Guard Works Figure 16-5 Adding a Network Device in a Shared-Medium Topology Switch A (Root) Switch B (Designated Bridge) Switch C Blocked port 11245 Added switch Understanding How EtherChannel Guard Works EtherChannel guard detects a misconfigured EtherChannel where interfaces on the Cisco 7600 series router are configured as an EtherChannel while interfaces on the other device are not or not all the interfaces on the other
Chapter 16 Configuring Optional STP Features Understanding How Loop Guard Works If you enable loop guard on a channel and the first link becomes unidirectional, loop guard blocks the entire channel until the affected port is removed from the channel. Figure 16-6 shows loop guard in a triangle switch configuration.
Chapter 16 Configuring Optional STP Features Enabling PortFast – If a channel is blocked by loop guard and the channel breaks, spanning tree loses all the state information. The individual physical ports may obtain the forwarding state with the designated role, even if one or more of the links that formed the channel are unidirectional. Note • You can enable UniDirectional Link Detection (UDLD) to help isolate the link failure.
Chapter 16 Configuring Optional STP Features Enabling PortFast To enable the default PortFast configuration, perform this task: Command Purpose Step 1 Router(config)# spanning-tree portfast default Configures the PortFast default. Step 2 Router(config)# show spanning-tree summary totals Verifies the global configuration. Step 3 Router(config)# show spanning-tree interface x detail Verifies the effect on a specific port.
Chapter 16 Configuring Optional STP Features Enabling PortFast BPDU Filtering Router# show spanning-tree interface fastEthernet 4/4 detail Port 196 (FastEthernet4/4) of VLAN0010 is forwarding Port path cost 1000, Port priority 160, Port Identifier 160.196. Designated root has priority 32768, address 00d0.00b8.140a Designated bridge has priority 32768, address 00d0.00b8.140a Designated port id is 160.
Chapter 16 Configuring Optional STP Features Enabling BPDU Guard To enable PortFast BPDU filtering on a nontrunking port, perform this task: Command Purpose Step 1 Router(config)# interface fastEthernet 4/4 Selects the interface to configure. Step 2 Router(config-if)# spanning-tree bpdufilter enable Enables BPDU filtering. Step 3 Router# show spanning-tree interface fastEthernet 4/4 Verifies the configuration.
Chapter 16 Configuring Optional STP Features Enabling UplinkFast This example shows how to verify the configuration: Router# show spanning-tree summary totals default Root bridge for:VLAN0010 EtherChannel misconfiguration guard is enabled Extended system ID is disabled Portfast is enabled by default PortFast BPDU Guard is disabled by default Portfast BPDU Filter is enabled by default Loopguard is disabled by default UplinkFast is disabled BackboneFast is disabled Pathcost method used is long Name Blockin
Chapter 16 Configuring Optional STP Features Enabling BackboneFast This example shows how to verify that UplinkFast is enabled: Router# show spanning-tree uplinkfast UplinkFast is enabled Router# Enabling BackboneFast Note BackboneFast operates correctly only when enabled on all network devices in the network. BackboneFast is not supported on Token Ring VLANs. This feature is supported for use with third-party network devices.
Chapter 16 Configuring Optional STP Features Enabling EtherChannel Guard Enabling EtherChannel Guard To enable EtherChannel guard, perform this task: Command Purpose Router(config)# spanning-tree etherchannel guard misconfig Enables EtherChannel guard. Router(config)# no spanning-tree etherchannel guard misconfig Disables EtherChannel guard. Step 2 Router(config)# end Exits configuration mode.
Chapter 16 Configuring Optional STP Features Enabling Loop Guard Enabling Loop Guard Use the set spanning-tree guard command to enable or disable the spanning tree loop guard feature on a per-port basis. To enable loop guard globally on the switch, perform this task: Command Purpose Step 1 Router(config)# spanning-tree loopguard default Enables loop guard globally on the switch. Step 2 Router(config)# end Exits configuration mode.
Chapter 16 Configuring Optional STP Features Enabling Loop Guard This example shows how to verify the configuration: Router# show spanning-tree interface fastEthernet 4/4 detail Port 196 (FastEthernet4/4) of VLAN0010 is forwarding Port path cost 1000, Port priority 160, Port Identifier 160.196. Designated root has priority 32768, address 00d0.00b8.140a Designated bridge has priority 32768, address 00d0.00b8.140a Designated port id is 160.
C H A P T E R 17 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 This chapter describes how to configure IP unicast Layer 3 switching for Policy Feature Card 2 (PFC2), Distributed Forwarding Cards (DFCs), and Multilayer Switch Feature Card 2 (MSFC2). Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication and the publications at this URL: http://www.cisco.
Chapter 17 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 Understanding How Layer 3 Switching Works Understanding Hardware Layer 3 Switching on PFC2 and DFCs Hardware Layer 3 switching allows the PFC2 and DFCs, instead of the MSFC2, to forward IP unicast traffic between subnets. Hardware Layer 3 switching provides wire-speed forwarding on the PFC2 and DFCs, instead of in software on the MSFC2. Hardware Layer 3 switching requires minimal support from the MSFC2.
Chapter 17 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 Understanding How Layer 3 Switching Works A received IP unicast packet is formatted (conceptually) as follows: Layer 2 Frame Header Layer 3 IP Header Destination Destination Source TTL Checksum Destination B IP Source A IP n calculation1 Source MSFC2 MAC Source A MAC Data FCS After the router rewrites an IP unicast packet, it is formatted (conceptually) as follows: Layer 2 Frame Header Destination Layer 3 IP Header S
Chapter 17 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 Default Hardware Layer 3 Switching Configuration Default Hardware Layer 3 Switching Configuration Table 17-1 shows the default hardware Layer 3 switching configuration.
Chapter 17 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 Configuring Hardware Layer 3 Switching Configuring Hardware Layer 3 Switching Note For information on configuring unicast routing on the MSFC2, see Chapter 12, “Configuring Layer 3 Interfaces.” Hardware Layer 3 switching is permanently enabled on Supervisor Engine 2 with PFC2, MSFC2, and Distributed Feature Card (DFC). No configuration is required.
Chapter 17 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2 Displaying Hardware Layer 3 Switching Statistics Displaying Hardware Layer 3 Switching Statistics Hardware Layer 3 switching statistics are obtained on a per-VLAN basis. To display hardware Layer 3 switching statistics, perform this task: Command Purpose Router# show interfaces {{type {port-channel number}} 1 slot/port} | Displays hardware Layer 3 switching statistics. 1.
C H A P T E R 18 Configuring IP Multicast Layer 3 Switching This chapter describes how to configure IP multicast Layer 3 switching on the Cisco 7600 series routers. Note For more information on the syntax and usage for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 18 Configuring IP Multicast Layer 3 Switching Understanding How IP Multicast Layer 3 Switching Works IP Multicast Layer 3 Switching Overview Policy Feature Card 2 (PFC2) provides Layer 3 switching for IP multicast flows using the hardware replication table and hardware Cisco Express Forwarding (CEF), which uses the forwarding information base (FIB) and the adjacency table on the PFC2.
Chapter 18 Configuring IP Multicast Layer 3 Switching Understanding How IP Multicast Layer 3 Switching Works The Layer 3 switching cache contains flow information for all active Layer 3-switched flows. After the switching cache is populated, multicast packets identified as belonging to an existing flow can be Layer 3 switched based on the cache entry for that flow. For each cache entry, the PFC maintains a list of outgoing interfaces for the IP multicast group.
Chapter 18 Configuring IP Multicast Layer 3 Switching Understanding How IP Multicast Layer 3 Switching Works The PFC rewrites the packet as follows: • Changes the source MAC address in the Layer 2 frame header from the MAC address of the host to the MAC address of the MSFC (this MAC address is stored in the multicast Layer 3 switching cache entry for the flow) • Decrements the IP header Time to Live (TTL) by one and recalculates the IP header checksum The result is a rewritten IP multicast packet tha
Chapter 18 Configuring IP Multicast Layer 3 Switching Understanding How IP Multicast Layer 3 Switching Works Partially Switched Flows with PFC2 In PFC2 systems, (*,G) flows will be partially switched on the last-hop leaf router if the shared-tree to shortest-path-tree (SPT) threshold is not equal to infinity. This allows the flow to transition from SPT. Note With a PFC2, flows matching an output ACL on an outgoing interface are routed in software.
Chapter 18 Configuring IP Multicast Layer 3 Switching Understanding How IP Multicast Layer 3 Switching Works Figure 18-1 Redundant Multicast Router Configuration in a Stub Network Rest of network Router A Router B Network A, B, C.0 Network A, B, D.0 55645 Mulitcast traffic non-RPF traffic Filtering of RPF Failures for Stub Networks PFC1, PFC2, and the DFCs support ACL-based filtering of RPF failures for sparse mode stub networks.
Chapter 18 Configuring IP Multicast Layer 3 Switching Default IP Multicast Layer 3 Switching Configuration NetFlow-Based Rate Limiting of RPF Failures With NetFlow-based rate limiting of RPF failures, a NetFlow entry is created for each non-RPF flow. When a non-RPF packet arrives, the MSFC communicates information about the group, the source, and the interface on which the packet arrived to the PFC.
Chapter 18 Configuring IP Multicast Layer 3 Switching IP Multicast Layer 3 Switching Configuration Guidelines and Restrictions IP Multicast Layer 3 Switching Configuration Guidelines and Restrictions These sections describe IP Multicast Layer 3 switching configuration restrictions: • PFC2 with MSCF2, page 18-8 • PFC1 with MSFC or MSCF2, page 18-8 • PFC1 and PFC2 General Restrictions, page 18-9 • Unsupported Features, page 18-9 PFC2 with MSCF2 In systems with PCF2 and MSFC2, IP multicast Layer 3 s
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching • If the SPT bit for the flow is cleared when running PIM sparse mode for the interface or group. • For packets that require fragmentation and packets with IP options. However, packets in the flow that do not specify IP options are Layer 3 switched. • For source traffic received on tunnel interfaces (such as MBONE traffic).
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching Source Specific Multicast with IGMPv3, IGMP v3lite, and URD For complete information and procedures about source specific multicast with IGMPv3, IGMP v3lite, and URL Rendezvous Directory (URD), refer to this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t5/dtssm5t.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching This example shows how to enable PIM sparse mode on an interface: Router(config-if)# ip pim sparse-mode Router(config-if)# Enabling IP Multicast Layer 3 Switching on Layer 3 Interfaces IP multicast Layer 3 switching is enabled by default on the Layer 3 interface when you enable PIM on the interface.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching This example shows how to configure the Layer 3 switching threshold to 10 packets per second: Router(config)# mls ip multicast threshold 10 Router(config)# Enabling Installation of Directly Connected Subnets In PIM sparse mode, a first-hop router that is the designated router for the interface may need to encapsulate the source traffic in a PIM register message and unicast it to the rendezvous point.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching Step 3 Command Purpose Router(config-if)# mls ip multicast non-rpf netflow Enables NetFlow-based rate limiting of RPF failures on the Layer 3 interface. Router(config-if)# no mls ip multicast non-rpf netflow Disables NetFlow-based rate limiting of RPF failures on the Layer 3 interface. 1.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching This example shows how to enable the hardware shortcut-consistency checker: Router (config)# mls ip multicast consistency-check Router (config)# Configuring ACL-Based Filtering of RPF Failures When you configure ACL-based filtering of RPF failures, ACLs that filter RPF failures in hardware are downloaded to the hardware-based ACL engine and applied on the interface you specify.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching To display IP multicast Layer 3 switching information for an IP PIM Layer 3 interface, perform one of these tasks: Command Purpose Router# show ip pim interface [{{vlan vlan_ID} | {type1 slot/port} | {port-channel number}}] count Displays IP multicast Layer 3 switching enable state information for all MSFC IP PIM Layer 3 interfaces.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching IP fast switching is enabled IP fast switching on the same interface is disabled IP Flow switching is disabled IP CEF switching is enabled IP Fast switching turbo vector IP Normal CEF switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled IP route-cache flags are Fast, CEF Router Discovery is disabled IP output packet accounting is disabled IP access
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching Outgoing interface list: GigabitEthernet4/9, Forward/Sparse-Dense, 00:14:31/00:00:00, H (132.206.72.28, 224.2.136.89), 00:14:31/00:01:40, flags:CJT Incoming interface:GigabitEthernet4/8, RPF nbr 10.15.1.20, RPF-MFD Outgoing interface list:Null Router# Note The RPF-MFD flag indicates the flow is completely hardware switched. The H flag indicates the flow is hardware switched on the outgoing interface.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching (10.1.0.19, 224.2.2.19) Incoming interface: Vlan10, Packets switched: 1970 Hardware switched outgoing interfaces: MFD installed: Vlan10 (10.1.0.11, 224.2.2.11) Incoming interface: Vlan10, Packets switched: 0 Hardware switched outgoing interfaces: MFD installed: Vlan10 (10.1.0.10, 224.2.2.10) Incoming interface: Vlan10, Packets switched: 2744 Hardware switched outgoing interfaces: MFD installed: Vlan10 (10.1.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching Table 18-2 IP Multicast Layer 3 Switching Debug Commands (continued) Command Description [no] debug mls ip multicast group group_id group_mask Turns on debugging for a subset of flows. [no] debug mls ip multicast messages Displays IP multicast Layer 3 switching messages from and to hardware switching engine. [no] debug mls ip multicast all Turns on all IP multicast Layer 3 switching messages.
Chapter 18 Configuring IP Multicast Layer 3 Switching Configuring IP Multicast Layer 3 Switching Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Note The features described in this chapter are supported only on Supervisor Engine 1, the policy feature card (PFC), and the Multilayer Switch Feature Card (MSFC or MSFC2). For information about Supervisor Engine 2, PFC2, and MSFC2, see Chapter 17, “Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IP MLS Works Understanding How IP MLS Works These sections provide an overview of IP MLS and describe how IP MLS works: • IP MLS Overview, page 19-2 • IP MLS Flows, page 19-2 • Layer 3 MLS Cache, page 19-3 • Flow Masks, page 19-3 • Layer 3-Switched Packet Rewrite, page 19-4 • IP MLS Operation, page 19-5 IP MLS Overview IP MLS provides high-performance hardware-based Layer 3 switching for Cisco 7600 se
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IP MLS Works Layer 3 MLS Cache The PFC maintains a Layer 3 switching table (the Layer 3 MLS cache) for Layer 3-switched flows. The cache also includes entries for traffic statistics that are updated in tandem with the switching of packets. After the MLS cache is created, packets identified as belonging to an existing flow can be Layer 3 switched based on the cached information.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IP MLS Works • Security ACLs—Does not affect flow mask. • Reflexive ACLs—Does not affect flow mask. • TCP intercept—Does not affect flow mask. • Policy Based Routing (PBR)—Does not affect flow mask. • ISLB (IOS Server Load Balancing)—When packets are processed by the ISLB process, a full-flow-ip mask is used.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IP MLS Works After the PFC performs the packet rewrite, the packet is formatted (conceptually) as follows: Frame Header IP Header Payload Destination Source Destination Source TTL Checksum Host B MAC MSFC MAC Host B IP n-1 Host A IP Data Checksum calculation2 IP MLS Operation Figure 19-1 shows a simple IP MLS network topology. In this example, Host A is on the Sales VLAN (IP subnet 171.59.1.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Default IP MLS Configuration Default IP MLS Configuration Table 19-1 shows the default IP MLS configuration.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Configuring IP MLS Disabling and Enabling IP MLS on a Layer 3 Interface IP MLS is permanently enabled globally but can be disabled and enabled on a specified interface. To enable IP MLS on a specific interface, perform this task: Command Purpose Step 1 Router(config)# interface {{vlan vlan_ID} | {type1 slot/port} | {port-channel number}} Selects an interface to configure.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Configuring IP MLS IP Flow switching is disabled IP CEF switching is enabled IP Fast switching turbo vector IP Normal CEF switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled Router Discovery is disabled IP output packet accounting is disabled IP access violation accounting is disabled TCP/IP header compression is disabled RTP/IP header compression is disabled Probe prox
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IP MLS Cache Entries To display the IP MLS flow mask configuration, perform this task: Command Purpose Router# show mls netflow flowmask With Release 12.1(8a)E and later releases, displays the flow mask configuration. Router# show mls flowmask With releases earlier than Release 12.1(8a)E, displays the flow mask configuration.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IP MLS Cache Entries This example shows how to display IP MLS information: Router# show mls ip DstIP SrcIP DstVlan-DstMAC Pkts Bytes ----------------------------------------------------------------------SrcDstPorts SrcDstEncap Age LastSeen -------------------------------------172.20.52.122 0.0.0.0 5 : 00e0.4fac.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Clearing IP MLS Cache Entries This example shows how to display MLS entries for a specific source IP address: Router# show mls ip source 172.20.52.122 any DstIP SrcIP DstVlan-DstMAC Pkts Bytes ----------------------------------------------------------------------SrcDstPorts SrcDstEncap Age LastSeen -------------------------------------172.20.52.122 0.0.0.0 5 : 00e0.4fac.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Clearing IP MLS Cache Entries • slot—Clears only the entries associated with a specific slot number. The flow keyword specifies the following additional flow information: • Protocol family (protocol)—Specifies tcp or udp.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Clearing IP MLS Cache Entries To show the MLS contention table and VLAN statistics, perform this task: Command Purpose Router# show mls table-contention [detailed | summary] Displays the MLS contention table.
Chapter 19 Configuring IP Unicast Layer 3 Switching on Supervisor Engine 1 Troubleshooting IP MLS Vlan 1 Statistics Information: ------------------------------65280 Layer 2 Packets Bridged, 0 Bytes 65280 Layer 3 Packets Input, 0 Bytes 65280 Layer 3 Packets Output, 0 Bytes Slot 3 ======= (Information Deleted) Router# Troubleshooting IP MLS Table 19-2 describes IP MLS-related debugging commands that you can use to troubleshoot IP MLS problems.
C H A P T E R 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Note The features described in this chapter are supported only on Supervisor Engine 1, PFC, and MSFC or MSFC2. For information about Supervisor Engine 2, PFC2, and MSFC2 see Chapter 17, “Configuring IP Unicast Layer 3 Switching on Supervisor Engine 2.” Supervisor Engine 1 with PFC and MSFC or MSFC2 provide Layer 3 switching with Multilayer Switching (MLS).
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IPX MLS Works Understanding How IPX MLS Works These sections provide an overview of MLS and describe how MLS works: • IPX MLS Overview, page 20-2 • IPX MLS Flows, page 20-2 • Layer 3 MLS Cache, page 20-2 • Flow Masks, page 20-3 • Layer 3-Switched Packet Rewrite, page 20-3 • IPX MLS Operation, page 20-4 IPX MLS Overview IPX MLS provides high-performance hardware-based Layer 3 switching for Cisco 7600
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IPX MLS Works The state and identity of the flow are maintained while packet traffic is active; when traffic for a flow ceases, the entry ages out. You can configure the aging time for IPX MLS entries kept in the MLS cache. If an entry is not used for the specified period of time, the entry ages out and statistics for that flow can be exported to a flow collector application.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Understanding How IPX MLS Works Received IPX packets are formatted (conceptually) as follows: Layer 2 Frame Header Layer 3 IPX Header Data FCS Destination Source Checksum/ IPX Length/ Transport Control Destination Net/ Node/ Socket Source Net/ Node/ Socket MSFC MAC Source A MAC n Destination B IPX Source A IPX The PFC rewrites the Layer 2 frame header, changing the destination MAC address to the MAC address of Host B
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Default IPX MLS Configuration Figure 20-1 IPX MLS Example Topology Source IPX Destination Rewrite Src/Dst Address IPX Address MAC Address Destination VLAN 01.Aa 03.Bb Dd:Bb Marketing 01.Aa 02.Cc Dd:Cc Engineering 02.Cc 01.Aa Dd:Aa Sales MAC = Bb MAC = Dd MSFC ng ti arke M / 3 Net 03 MAC = Aa Net 1/Sales 01 Net Host A 2/E ngin eer 02 01.Aa:02.Cc ing MAC = Cc Aa:Dd Host C Data 01.Aa:02.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Configuring IPX MLS – The no ipx routing command purges all IPX MLS cache entries and disables IPX MLS. – The ipx security interface command disables IPX MLS on the interface. • In IPX, the two end points of communication negotiate the maximum transmission unit (MTU) to be used. MTU size is limited by media type.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Configuring IPX MLS To display the IPX MLS interface configuration, perform this task: Command Purpose Router# show [ipx [interface {{vlan vlan_ID} | {type1 slot/port} | {port-channel number}}] | nde] Displays MLS details for an interface. 1.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IPX MLS Information Configuring the Minimum IPX MLS Flow Mask You can configure the minimum granularity of the flow mask for the MLS cache on the PFC. The actual flow mask used will be at least of the granularity specified by this command. For information on how the different flow masks work, see the “Flow Masks” section on page 20-3.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IPX MLS Information Displaying IPX MLS Cache Entries The show mls ipx command displays IPX shortcut cache entries. You can specify the following parameters to focus the information displayed: • source and destination parameters display the source and or destination IPX network addresses associated with those entries. • interface arguments display only entries associated with a specific interface number.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IPX MLS Information Displaying IPX MLS Cache Entries for a Specific Destination Address To display IPX MLS cache entries for a specific destination IPX address, perform this task: Command Purpose Router# show mls ipx [destination ipx_addr] Displays IPX MLS entries for a specific destination address (net_address.node_address).
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IPX MLS Information Displaying IPX MLS Cache Entries for a Specific Interface To display IPX MLS entries for a specific interface, perform this task: Command Purpose Router# show mls ipx interface {{vlan vlan_ID} | {type1 slot/port} | {port-channel number}} Displays IPX MLS cache entries for a specific interface. 1.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Displaying IPX MLS Information To show the MLS contention table and VLAN statistics for the switch, perform this task: Command Purpose Router# show mls table-contention [detailed | summary] Displays the IPX MLS contention table.
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Clearing IPX MLS Cache Entries Vlan 1 Statistics Information: ------------------------------65280 Layer 2 Packets Bridged, 0 Bytes 65280 Layer 3 Packets Input, 0 Bytes 65280 Layer 3 Packets Output, 0 Bytes Slot 3 ======= Vlan 1 Statistics Information: ------------------------------65280 Layer 2 Packets Bridged, 0 Bytes 65280 Layer 3 Packets Input, 0 Bytes 65280 Layer 3 Packets Output, 0 Bytes Slot 4 ======= Vlan 1 Statistics Infor
Chapter 20 Configuring IPX Unicast Layer 3 Switching on Supervisor Engine 1 Troubleshooting IPX MLS Troubleshooting IPX MLS Table 20-2 describes debug commands that you can use to troubleshoot IPX MLS problems. Table 20-2 IPX MLS Debug Commands Command Description [no] debug l3-mgr events Displays Layer 3 manager-related events. [no] debug l3-mgr packets Displays Layer 3 manager packets. [no] debug l3-mgr global Displays bug trace of IP global purge events.
C H A P T E R 21 Configuring IGMP Snooping This chapter describes how to configure Internet Group Management Protocol (IGMP) snooping on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 21 Configuring IGMP Snooping Understanding How IGMP Snooping Works IGMP Snooping Overview You can configure the router to use IGMP snooping in subnets that receive IGMP queries from either IGMP or the IGMP snooping querier. IGMP snooping constrains multicast traffic at Layer 2 by configuring Layer 2 LAN ports dynamically to forward multicast traffic only to those ports that want to receive it.
Chapter 21 Configuring IGMP Snooping Understanding How IGMP Snooping Works Figure 21-1 Initial IGMP Join Message Router A 1 IGMP report 224.1.2.3 VLAN Switching engine CPU 0 45750 Forwarding table 2 3 4 5 Host 1 Host 2 Host 3 Host 4 Multicast router A sends a general query to the switch, which forwards the query to ports 2 through 5, all members of the same VLAN. Host 1 wants to join multicast group 224.1.2.
Chapter 21 Configuring IGMP Snooping Understanding How IGMP Snooping Works Figure 21-2 Second Host Joining a Multicast Group Router A 1 VLAN Switching engine CPU 0 45751 Forwarding table 2 Host 1 3 Host 2 4 Host 3 5 Host 4 Table 21-2 Updated IGMP Snooping Forwarding Table Destination Address Type of Packet Ports 0100.5exx.xxxx IGMP 0 0100.5e01.
Chapter 21 Configuring IGMP Snooping Understanding How IGMP Snooping Works response to the general query, it removes the group entry and relays the IGMP leave to the multicast router. If the multicast router receives no reports from a VLAN, the multicast router removes the group for the VLAN from its IGMP cache. The interval for which the switch waits before updating the table entry is called the “last member query interval.
Chapter 21 Configuring IGMP Snooping Default IGMP Snooping Configuration Understanding IGMP Version 3 Support With Release 12.1(8a)E and later releases, IGMP snooping supports IGMP version 3. Because the Layer 2 table is (MAC-group, VLAN) based, with IGMPv3 hosts it is preferable to have only a single multicast source per MAC-group. A single multicast source per group allows IGMPv3 hosts connected to specific ports to receive traffic from a specific (source, group).
Chapter 21 Configuring IGMP Snooping Enabling the IGMP Snooping Querier Periodically, the IGMP querier sends IGMP queries that trigger IGMP report messages from the switch that wants to receive IP multicast traffic. IGMP snooping listens to these IGMP reports to establish appropriate forwarding. In a normal network with IP multicast routing, the IP multicast router acts as the IGMP querier.
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping Command Purpose Step 3 Router(config-if)# end Exits configuration mode. Step 4 Router# show ip igmp interface vlan vlan_ID | include querier Verifies the configuration.
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping Enabling IGMP Snooping To enable IGMP snooping globally, perform this task: Command Purpose Router(config)# ip igmp snooping Enables IGMP snooping. Router(config)# no ip igmp snooping Disables IGMP snooping. Step 2 Router(config)# end Exits configuration mode. Step 3 Router# show ip igmp interface vlan vlan_ID | include globally Verifies the configuration.
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping Configuring IGMP Snooping Learning To configure IGMP snooping learning, perform this task: Command Purpose Step 1 Router(config)# interface vlan vlan_ID Selects a VLAN interface. Step 2 Router(config-if)# ip igmp snooping mrouter learn {cgmp | pim-dvmrp} Configures the learning method. Router(config-if)# no ip igmp snooping mrouter learn {cgmp | pim-dvmrp} Reverts to the default learning method.
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping Configuring the IGMP Query Interval You can configure the interval for which the switch waits after sending a group-specific query to determine if hosts are still interested in a specific multicast group. Note When both IGMP fast-leave processing and the IGMP query interval are configured, fast-leave processing takes precedence.
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping Configuring a Host Statically Hosts normally join multicast groups dynamically, but you can also configure a host statically for a Layer 2 LAN port. To configure a host statically for a Layer 2 LAN port, perform this task: Command Purpose Step 1 Router(config)# interface vlan vlan_ID Selects a VLAN interface.
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping This example shows how to display the multicast router interfaces in VLAN 1: Router# show ip igmp snooping mrouter interface vlan 1 vlan ports -----+---------------------------------------1 Gi1/1,Gi2/1,Fa3/48,Router Router# Displaying MAC Address Multicast Entries To display MAC address multicast entries for a VLAN, perform this task: Command Purpose Router# show mac-address-table multicast vlan_ID [count] Displays MAC address multicast en
Chapter 21 Configuring IGMP Snooping Configuring IGMP Snooping Multicast TTL threshold is 0 Multicast designated router (DR) is 172.20.52.94 (this system) IGMP querying router is 172.20.52.94 (this system) No multicast groups joined IGMP snooping is globally enabled IGMP snooping is enabled on this interface IGMP snooping fast-leave is enabled on this interface IGMP snooping querier is disabled on this interface Router# Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 22 Configuring RGMP This chapter describes how to configure Router-Port Group Management Protocol (RGMP). Release 12.1(3a)E3 and later releases support RGMP.
Chapter 22 Configuring RGMP Default RGMP Configuration Table 22-1 provides a summary of the RGMP packet types. Table 22-1 RGMP Packet Types Description Action Hello When RGMP is enabled on the router, no multicast data traffic is sent to the router by the Cisco 7600 series router unless an RGMP join is specifically sent for a group. Bye When RGMP is disabled on the router, all multicast data traffic is sent to the router by the Cisco 7600 series router.
Chapter 22 Configuring RGMP Enabling RGMP on Layer 3 Interfaces • The following properties of RGMP are the same as for IGMP snooping: – RGMP constrains traffic based on the multicast group, not on the sender’s IP address. – If spanning tree topology changes occur in the network, the state is not flushed as it is with Cisco Group Management Protocol (CGMP). – RGMP does not constrain traffic for multicast groups 224.0.0.x (x = 0...
Chapter 22 Configuring RGMP Enabling RGMP on Layer 3 Interfaces Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 23 Configuring Network Security This chapter contains network security information unique to the Cisco 7600 series routers, which supplements the network security information and procedures in these publications: • Cisco IOS Security Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_c/index.htm • Cisco IOS Security Command Reference, Release 12.1, at this URL: http://www.cisco.
Chapter 23 Configuring Network Security Hardware and Software ACL Support With the ip unreachables command enabled (which is the default), a Supervisor Engine 2 drops most of the denied packets in hardware and sends only a small number of packets to the MSFC2 to be dropped (10 packets per second, maximum) , which generates ICMP-unreachable messages.
Chapter 23 Configuring Network Security Guidelines and Restrictions for Using Layer 4 Operators in ACLs • Flows that require logging are processed in software without impacting nonlogged flow processing in hardware. • The forwarding rate for software-processed flows is substantially less than for hardware-processed flows. • When you enter the show ip access-list command, the match count displayed does not include packets processed in hardware.
Chapter 23 Configuring Network Security Configuring the Cisco IOS Firewall Feature Set Determining Logical Operation Unit Usage Logical operation units (LOUs) are registers that store operator-operand couples. All ACLs use LOUs. There can be up to 32 LOUs; each LOU can store two different operator-operand couples with the exception of the range operator.
Chapter 23 Configuring Network Security Configuring the Cisco IOS Firewall Feature Set • Firewall Configuration Guidelines and Restrictions, page 23-6 • Configuring CBAC on Cisco 7600 Series Routers, page 23-6 Cisco IOS Firewall Feature Set Support Overview The firewall feature set images support these Cisco IOS firewall features: • Context-based Access Control (CBAC) • Port-to-Application Mapping (PAM) • Authentication Proxy These are the firewall feature set image names: • c6sup22-jo3sv-mz •
Chapter 23 Configuring Network Security Configuring the Cisco IOS Firewall Feature Set Note Cisco 7600 series routers support the Intrusion Detection System Module (IDSM) (WS-X6381-IDS). Cisco 7600 series routers do not support the Cisco IOS firewall IDS feature, which is configured with the ip audit command.
Chapter 23 Configuring Network Security Configuring MAC Address-Based Traffic Blocking Router(config-if)# exit Router(config)# interface vlan 200 Router(config-if)# ip access-group Router(config-if)# ip access-group Router(config-if)# exit Router(config)# interface vlan 300 Router(config-if)# ip access-group Router(config-if)# ip access-group Router(config-if)# end deny_ftp_c in deny_ftp_d out deny_ftp_e in deny_ftp_f out If the FTP session enters on VLAN 100 and needs to leave on VLAN 200, CBAC permit
Chapter 23 Configuring Network Security Configuring VLAN ACLs Command Purpose Router(config)# mac-address-table static mac_address vlan vlan_ID drop Blocks all traffic to or from the configured MAC address in the specified VLAN. Router(config)# no mac-address-table static mac_address vlan vlan_ID Clears MAC address-based blocking. This example shows how to block all traffic to or from MAC address 0050.3e8d.6400 in VLAN 12: Router# configure terminal Router(config)# mac-address-table static 0050.
Chapter 23 Configuring Network Security Configuring VLAN ACLs is first checked against the output ACL applied to the routed interface and, if permitted, the VACL configured for the destination VLAN is applied. If a VACL is configured for a packet type and a packet of that type does not match the VACL, the default action is deny. Note • VACLs and CBAC cannot be configured on the same interface.
Chapter 23 Configuring Network Security Configuring VLAN ACLs Routed Packets Figure 23-2 shows how ACLs are applied on routed and Layer 3-switched packets. For routed or Layer 3-switched packets, the ACLs are applied in the following order: 1. VACL for input VLAN 2. Input Cisco IOS ACL 3. Output Cisco IOS ACL 4.
Chapter 23 Configuring Network Security Configuring VLAN ACLs Multicast Packets Figure 23-3 shows how ACLs are applied on packets that need multicast expansion. For packets that need multicast expansion, the ACLs are applied in the following order: 1. Packets that need multicast expansion: a. VACL for input VLAN b. Input Cisco IOS ACL 2. Packets after multicast expansion: a. Output Cisco IOS ACL b. VACL for output VLAN (not supported with PFC2) 3.
Chapter 23 Configuring Network Security Configuring VLAN ACLs • VLAN Access Map Configuration and Verification Examples, page 23-15 • Configuring a Capture Port, page 23-16 VACL Configuration Overview VACLs use standard and extended Cisco IOS IP and IPX ACLs, and MAC-Layer named ACLs (see the “Configuring MAC-Layer Named Access Lists (Optional)” section on page 32-39) and VLAN access maps. VLAN access maps can be applied to VLANs or, with releases 12.
Chapter 23 Configuring Network Security Configuring VLAN ACLs When defining a VLAN access map, note the following syntax information: • To insert or modify an entry, specify the map sequence number. • If you do not specify the map sequence number, a number is automatically assigned. • You can specify only one match clause and one action clause per map sequence. • Use the no keyword with a sequence number to remove a map sequence. • Use the no keyword without a sequence number to remove the map.
Chapter 23 Configuring Network Security Configuring VLAN ACLs Configuring an Action Clause in a VLAN Access Map Sequence To configure an action clause in a VLAN access map sequence, perform this task: Command Purpose Router(config-access-map)# action {drop [log]} | {forward [capture]} | {redirect {{ethernet | fastethernet | gigabitethernet | tengigabitethernet} slot/port} | {port-channel channel_id}} Configures the action clause in a VLAN access map sequence.
Chapter 23 Configuring Network Security Configuring VLAN ACLs Command Purpose Router(config)# no vlan filter map_name [vlan-list vlan_list | interface type1 number2] Removes the VLAN access map from the specified VLANs or WAN interfaces. 1. type = pos, atm, or serial 2.
Chapter 23 Configuring Network Security Configuring VLAN ACLs This example shows how to define and apply a VLAN access map to forward IP packets. In this example, IP traffic matching net_10 is forwarded and all other IP packets are dropped due to the default drop action. The map is applied to VLAN 12 to 16.
Chapter 23 Configuring Network Security Configuring VLAN ACLs When configuring a capture port, note the following syntax information: • With Release 12.1(13)E and later releases, you can configure any port as a capture port. With earlier releases, only the Gigabit Ethernet monitor port on the IDS module can be configured as a capture port. • When configuring a capture port with Release 12.
Chapter 23 Configuring Network Security Configuring TCP Intercept These restrictions apply to VACL logging: • Supported only with Supervisor Engine 2. • Because of the rate-limiting function for redirected packets, VACL logging counters may not be accurate. • Only denied IP packets are logged.
Chapter 23 Configuring Network Security Configuring Unicast Reverse Path Forwarding Configuring Unicast Reverse Path Forwarding These sections describe configuring Cisco IOS Unicast Reverse Path Forwarding (Unicast RPF): • Understanding Unicast RPF Support, page 23-19 • Configuring Unicast RPF, page 23-19 • Enabling Self-Pinging, page 23-19 • Configuring the Unicast RPF Checking Mode, page 23-20 Understanding Unicast RPF Support The PFC2 supports Unicast RPF with hardware processing for packets th
Chapter 23 Configuring Network Security Configuring Unicast Reverse Path Forwarding This example shows how to enable self-pinging: Router(config)# interface gigabitethernet 4/1 Router(config-if)# ip verify unicast source reachable-via any allow-self-ping Router(config-if)# end Configuring the Unicast RPF Checking Mode There are two Unicast RPF checking modes: Note • Strict checking mode, which verifies that the source IP address exists in the FIB table and verifies that the source IP address is reach
Chapter 23 Configuring Network Security Configuring Unicast Flood Protection This example shows how to enable Unicast RPF exist-only checking mode on Gigabit Ethernet port 4/1: Router(config)# interface gigabitethernet 4/1 Router(config-if)# ip verify unicast source reachable-via any Router(config-if)# end Router# This example shows how to enable Unicast RPF strict checking mode on Gigabit Ethernet port 4/2: Router(config)# interface gigabitethernet 4/2 Router(config-if)# ip verify unicast source reachab
Chapter 23 Configuring Network Security Configuring MAC Move Notification When configuring unicast flood protection, note the following syntax information: • Use the limit keyword to specify the unicast floods on a per source MAC address and per VLAN basis; valid values are from 1 to 4000 floods per second (fps). • Use the filter keyword to specify how long to filter unicast flood traffic; valid values are from 1 to 34560 minutes.
Chapter 23 Configuring Network Security Configuring MAC Move Notification This example shows how to enable the MAC move notification feature: Router(config)# mac-address-table notification mac-move Router# show mac-address-table notification mac-move MAC Move Notification: enabled Router# Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
Chapter 23 Configuring Network Security Configuring MAC Move Notification Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 24 Configuring Denial of Service Protection This chapter contains information on how to protect your system against Denial of Service (DoS) attacks. The information covered in this chapter is unique to the Cisco 7600 series routers, and it supplements the network security information and procedures in the “Configuring Network Security” in this publication as well as the network security information and procedures in these publications: • Cisco IOS Security Configuration Guide, Release 12.
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection Configuring DoS Protection The following sections describe the different DoS protection implementations and give configuration examples: • Supervisor Engine DoS Protection, page 24-2 • Security ACLs, page 24-2 • QoS ACLs, page 24-4 • Forwarding Information Base Rate-Limiting, page 24-5 • APR Throttling, page 24-5 • Monitoring Packet Drop Statistics, page 24-6 Supervisor Engine DoS Protection The supervisor engine h
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection When using security ACLs to drop DoS packets, note the following information: • The security ACL must specify the traffic flow to be dropped. • When adding a security ACL to block DoS packets to an interface that already has a security ACL configured, you must merge the DoS security ACL with the existing security ACL. • Security ACLs need to be configured on all external interfaces that require protection.
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection QoS ACLs Unlike Security ACLs, QoS ACLs can be used to limit the rate of traffic without denying access to all the traffic in a flow. When using QoS ACLs to limit the rate of packets, note the following information: • The QoS ACL must specify the traffic flow to be rate-limited.
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection Forwarding Information Base Rate-Limiting The forwarding information base (FIB) rate-limiting allows all packets that require software processing to be rate limited. The following FIB rate-limiting usage guidelines apply: • FIB rate-limiting does not limit the rate of multicast traffic. • FIB rate-limiting does not differentiate between legitimate and illegitimate traffic (for example, tunnels, Telnet).
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection Monitoring Packet Drop Statistics Because the rate-limiting mechanism allows a certain number of packets to be forwarded for software processing, you can view the packet drop statistics by entering NetFlow show commands from the CLI. You can also capture the incoming or outgoing traffic on an interface and send a copy of this traffic to an external interface for monitoring by, for example, a traffic analyzer.
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection 9.9.9.177 9.9.9.
Chapter 24 Configuring Denial of Service Protection Configuring DoS Protection Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 25 Configuring IEEE 802.1X Port-Based Authentication This chapter describes how to configure IEEE 802.1X port-based authentication to prevent unauthorized devices (clients) from gaining access to the network. Release 12.1(13)E and later releases support 802.1X port-based authentication. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Device Roles With 802.1X port-based authentication, the devices in the network have specific roles as shown in Figure 25-1. Figure 25-1 802.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Authentication Initiation and Message Exchange The router or the client can initiate authentication. If you enable authentication on a port by using the dot1x port-control auto interface configuration command, the router must initiate authentication when it determines that the port link state transitions from down to up.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Ports in Authorized and Unauthorized States The router port state determines whether or not the client is granted access to the network. The port starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except for 802.1X protocol packets.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Default 802.1X Port-Based Authentication Configuration In a point-to-point configuration (see Figure 25-1 on page 25-2), only one client can be connected to the 802.1X-enabled router port. The router detects the client when the port link state changes to the up state. If a client leaves or is replaced with another client, the router changes the port link state to down, and the port returns to the unauthorized state. Figure 25-3 shows 802.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication 802.1X Port-Based Authentication Guidelines and Restrictions Table 25-1 Default 802.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication These sections describe how to configure 802.1X port-based authentication: • Enabling 802.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication Command Purpose Step 6 Router(config)# end Returns to privileged EXEC mode. Step 7 Router# show dot1x all Verifies your entries. Check the Status column in the 802.1X Port Summary section of the display. An enabled status means the port-control value is set either to auto or to force-unauthorized. 1. type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet When you enable 802.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication • Host name and specific UDP port numbers • IP address and specific UDP port numbers The combination of the IP address and UDP port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication Note You also need to configure some settings on the RADIUS server. These settings include the IP address of the router and the key string to be shared by both the server and the router. For more information, refer to the RADIUS server documentation.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication Manually Reauthenticating the Client Connected to a Port Note Reauthentication does not disturb the status of an already authorized port. To manually reauthenticate the client connected to a port, perform this task: Command Purpose Step 1 Router# dot1x re-authenticate interface type1 slot/port Manually reauthenticates the client connected to a port.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication To change the quiet period, perform this task: Command Purpose Step 1 Router(config)# interface type1 slot/port Selects an interface to configure. Step 2 Router(config-if)# dot1x timeout quiet-period seconds Sets the number of seconds that the router remains in the quiet state following a failed authentication exchange with the client. The range is 0 to 65535 seconds; the default is 60.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication Setting the Cisco 7600 Series Router-to-Client Retransmission Time for EAP-Request Frames The client notifies the router that it received the EAP-request frame. If the router does not receive this notification, the router waits a set period of time, and then retransmits the frame. You may set the amount of time that the router waits for notification from 1 to 65535 seconds. (The default is 30 seconds.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Configuring 802.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Displaying 802.1X Status To allow multiple hosts (clients) on an 802.1X-authorized port that has the dot1x port-control interface configuration command set to auto, perform this task: Command Purpose Step 1 Router(config)# interface type1 slot/port Selects an interface to configure. Step 2 Router(config-if)# dot1x multi-hosts Allows multiple hosts (clients) on an 802.1X-authorized port.
Chapter 25 Configuring IEEE 802.1X Port-Based Authentication Displaying 802.1X Status Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 26 Configuring Port Security This chapter describes how to configure the port security feature. Release 12.1(13)E and later releases support the port security feature. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 26 Configuring Port Security Default Port Security Configuration Note If the port shuts down, all dynamically learned addresses are removed. After the maximum number of secure MAC addresses is configured, they are stored in an address table. To ensure that an attached device has the full bandwidth of the port, set the maximum number of addresses to one and configure the MAC address of the attached device.
Chapter 26 Configuring Port Security Configuring Port Security Configuring Port Security on an Interface To restrict traffic through a port by limiting and identifying MAC addresses of the stations allowed to access the port, perform this task: Command Purpose Step 1 Router(config)# interface interface_id Enters interface configuration mode and enters the physical interface to configure, for example, gigabitethernet 3/1.
Chapter 26 Configuring Port Security Configuring Port Security To return the interface to the default condition (not a secure port), enter the no switchport port-security interface configuration command. To return the interface to the default number of secure MAC addresses, enter the no switchport port-security maximum value command. To delete a MAC address from the address table, enter the no switchport port-security mac-address mac_address command.
Chapter 26 Configuring Port Security Displaying Port Security Settings To configure port security aging, perform this task: Command Purpose Step 1 Router(config)# interface interface_id Enters interface configuration mode for the port on which you want to enable port security aging. Step 2 Router(config-if)# switchport port-security aging time aging_time Sets the aging time for the secure port. For time, specify the aging time for this port.
Chapter 26 Configuring Port Security Displaying Port Security Settings To display traffic control information, enter one or more of these commands: Command Purpose Router# show port-security [interface interface_id] Displays port security settings for the switch or for the specified interface, including the maximum allowed number of secure MAC addresses for each interface, the number of secure MAC addresses on the interface, the number of security violations that have occurred, and the violation mode.
C H A P T E R 27 Configuring Layer 3 Protocol Filtering on Supervisor Engine 1 Note Layer 3 protocol filtering is supported with Supervisor Engine 1. Layer 3 protocol filtering is not supported with Supervisor Engine 2. This chapter describes how to configure Layer 3 protocol filtering on Layer 2 LAN ports on the Catalyst 6500 series switches.
Chapter 27 Configuring Layer 3 Protocol Filtering on Supervisor Engine 1 Configuring Layer 3 Protocol Filtering You can configure a Layer 2 LAN port with any one of these modes for each protocol group: on, off, or auto. If the configuration is set to on, the port allows all traffic for that protocol. If the configuration is set to off, the port does not allow any traffic for that protocol.
Chapter 27 Configuring Layer 3 Protocol Filtering on Supervisor Engine 1 Configuring Layer 3 Protocol Filtering This example shows how to enable Layer 3 protocol filtering globally: Router# configure terminal Router(config)# protocol-filtering Configuring Layer 3 Protocol Filtering on a Layer 2 LAN Interface To configure Layer 3 protocol filtering on a Layer 2 LAN port, perform this task: Command Purpose Step 1 Router(config)# interface {{type1 slot/port} | {port-channel number}} Selects the interfac
Chapter 27 Configuring Layer 3 Protocol Filtering on Supervisor Engine 1 Configuring Layer 3 Protocol Filtering Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 28 Configuring Traffic Storm Control This chapter describes how to configure the traffic storm control feature on the Cisco 7600 series routers. Release 12.1(12c)E1 and later releases support traffic storm control. For earlier releases, refer to Chapter 29, “Configuring Broadcast Suppression.” Note • For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 28 Configuring Traffic Storm Control Default Traffic Storm Control Configuration Traffic storm control monitors the level of each traffic type for which you enable traffic storm control in 1-second traffic storm control intervals. Within an interval, when the ingress traffic for which traffic storm control is enabled reaches the traffic storm control level that is configured on the port, traffic storm control drops the traffic until the traffic storm control interval ends.
Chapter 28 Configuring Traffic Storm Control Enabling Traffic Storm Control Step 4 Command Purpose Router(config-if)# storm-control unicast level level[.level] Enables unicast traffic storm control on the interface, configures the traffic storm control level, and applies the traffic storm control level to all traffic storm control modes enabled on the interface. Note The storm-control unicast command is supported only on Gigabit Ethernet interfaces.
Chapter 28 Configuring Traffic Storm Control Displaying Traffic Storm Control Settings Displaying Traffic Storm Control Settings To display traffic storm control information, use the commands described in Table 28-1. Table 28-1 Commands for Displaying Traffic Storm Control Status and Configuration Command Purpose 1 Router# show interfaces [{type slot/port} | {port-channel number}] switchport Displays the administrative and operational status of all Layer 2 LAN ports or the specified Layer 2 LAN port.
C H A P T E R 29 Configuring Broadcast Suppression This chapter describes how to configure broadcast suppression on the Cisco 7600 series routers. Releases earlier than Release 12.1(12c)E1 support broadcast suppression. Use traffic storm control with Release 12.1(12c)E1 and later releases (see Chapter 28, “Configuring Traffic Storm Control”).
Chapter 29 Configuring Broadcast Suppression Broadcast Suppression Configuration Guidelines and Restrictions Figure 29-1 Broadcast Suppression Total number of broadcast packets or bytes 0 T1 T2 T3 T4 T5 Time S5706 Threshold The broadcast suppression threshold numbers and the time interval combination make the broadcast suppression algorithm work with different levels of granularity. A higher threshold allows more broadcast packets to pass through.
Chapter 29 Configuring Broadcast Suppression Enabling Broadcast Suppression Enabling Broadcast Suppression To enable broadcast suppression, perform this task: Command Purpose 1 Step 1 Router(config)# interface {{type {port-channel number}} Step 2 Router(config-if)# broadcast suppression threshold Enables broadcast suppression. Router(config-if)# no broadcast suppression Disables broadcast suppression. Step 3 Router(config-if)# end Exits configuration mode.
Chapter 29 Configuring Broadcast Suppression Enabling Broadcast Suppression Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 30 Configuring CDP This chapter contains information about how to configure Cisco Discovery Protocol (CDP) on the Cisco 7600 series routers, which supplements the information in these publications: • The Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.1, “Cisco IOS System Management,” “Configuring Cisco Discovery Protocol (CDP)” at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/fun_c/fcprt3/fcd301c.
Chapter 30 Configuring CDP Configuring CDP Note • Displaying the CDP Interface Configuration, page 30-3 • Monitoring and Maintaining CDP, page 30-3 With Release 12.1(11b)E and later releases, when you are in configuration mode you can enter EXEC mode-level commands by entering the do keyword before the EXEC mode-level command. Enabling CDP Globally To enable CDP globally, perform this task: Command Purpose Router(config)# cdp run Enables CDP globally.
Chapter 30 Configuring CDP Configuring CDP Step 2 Command Purpose Router(config-if)# cdp enable Enables CDP on the port. Router(config-if)# no cdp enable Disables CDP on the port. 1.
Chapter 30 Configuring CDP Configuring CDP Command Purpose Router# show cdp traffic Displays CDP counters, including the number of packets sent and received and checksum errors. Router# show debugging Displays information about the types of debugging that are enabled. Refer to the Debug Command Reference publication for more information about CDP debug commands. 1.
C H A P T E R 31 Configuring UDLD This chapter describes how to configure the UniDirectional Link Detection (UDLD) protocol in Release 12.1(2)E and later releases on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 31 Configuring UDLD Understanding How UDLD Works A unidirectional link occurs whenever traffic transmitted by the local device over a link is received by the neighbor but traffic transmitted from the neighbor is not received by the local device. If one of the fiber strands in a pair is disconnected, as long as autonegotiation is active, the link does not stay up. In this case, the logical link is undetermined, and UDLD does not take any action.
Chapter 31 Configuring UDLD Default UDLD Configuration Default UDLD Configuration Table 31-1 shows the default UDLD configuration.
Chapter 31 Configuring UDLD Configuring UDLD Enabling UDLD on Individual LAN Interfaces With Release 12.1(13)E and later releases, to enable UDLD on individual LAN ports, perform this task: Command Purpose 1 Step 1 Router(config)# interface type Step 2 Router(config-if)# udld port [aggressive] Enables UDLD on a specific LAN port. Enter the aggressive keyword to enable aggressive mode. On a fiber-optic LAN port, this command overrides the udld enable global configuration command setting.
Chapter 31 Configuring UDLD Configuring UDLD Disabling UDLD on Fiber-Optic LAN Interfaces With Release 12.1(13)E and later releases, to disable UDLD on individual fiber-optic LAN ports, perform this task: Command Purpose 1 Step 1 Router(config)# interface type Step 2 Router(config-if)# udld port disable Disables UDLD on a fiber-optic LAN port. Router(config-if)# no udld port disable Reverts to the udld enable global configuration command setting. slot/port Selects the LAN port to configure.
Chapter 31 Configuring UDLD Configuring UDLD Resetting Disabled LAN Interfaces To reset all LAN ports that have been shut down by UDLD, perform this task: Command Purpose Router# udld reset Resets all LAN ports that have been shut down by UDLD. Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 32 Configuring PFC QoS This chapter describes how to configure quality of service (QoS) as implemented on the policy feature card (PFC) on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this publication, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works QoS selects network traffic (both unicast and multicast), prioritizes it according to its relative importance, and uses congestion avoidance to provide priority-indexed treatment; QoS can also limit the bandwidth used by network traffic. QoS makes network performance more predictable and bandwidth utilization more effective.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works • The PFC does not provide QoS for FlexWAN module ports. Refer to the following publications for information about FlexWAN module QoS features: – Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.1: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/qos_c/index.htm – Cisco IOS Quality of Service Solutions Command Reference, Release 12.1: http://www.cisco.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Note On LAN ports configured as Layer 2 ISL trunks, all traffic is in ISL frames. On LAN ports configured as Layer 2 802.1Q trunks, all traffic is in 802.1Q frames except for traffic in the native VLAN. – Layer 3 IP precedence values—The IP version 4 specification defines the three most significant bits of the 1-byte Type of Service (ToS) field as IP precedence.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Table 32-1 IP Precedence and DSCP Values 3-bit IP Precedence 6 MSb1 of ToS 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 0 0 1 1 0 0 1 1 0 1 0 1 0 1 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 1 1 1 1 0 0 1 1 0 0 1 1 2 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 3 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 1 1 1 1 8 7 6 3-bit IP Precedence 6 MSb1
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works PFC QoS Feature Flowcharts Figure 32-1 show how traffic flows through the components that support PFC QoS features.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Figure 32-3 Ingress LAN Port Layer 2 PFC QoS Features Frame enters switch Port set to untrusted? Ethernet ingress port classification, marking, scheduling, and congestion avoidance Yes Apply port CoS No Apply port CoS No ISL or 802.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Figure 32-4 PFC Classification, Marking, and Policing PFC QoS Features Trust CoS Policer Marker DSCP Trusted Ingress LAN Port Received Layer 3 ToS byte Received Layer 2 CoS Layer 2 CoS drop thresholds Map Map CoS CoS* Trust DSCP DSCP Policer Marker Untrusted Ingress LAN Port DSCP Map Received Layer 3 ToS byte Received Layer 2 CoS DSCP Egress Interface Write Layer 3 ToS byte CoS* Always apply Layer 2 CoS Ingress OSM Port Recei
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Figure 32-5 Marking with PFC2 and Multilayer Switch Feature Card 2 From PFC2 Multilayer Switch Feature Card 2 (MSFC2) marking IP traffic Yes from PFC2? Write ToS byte into packet No 55845 Route traffic CoS = IP precedence for all traffic (not configurable) To egress port Figure 32-6 Marking with PFC1 and Multilayer Switch Feature Card 1 or 2 From PFC Multilayer Switch Feature Card (MSFC) marking IP traffic Yes from PFC? Write ToS by
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Figure 32-7 Egress WAN Port Marking From PFC2 or MSFC2 OSM switching module marking IP traffic Yes from PFC? Write ToS byte into packet 68834 No OSM QoS Features Transmit OSM traffic Figure 32-8 Egress LAN Port Scheduling, Congestion Avoidance, and Marking From switching engine or MSFC Ethernet egress port scheduling, congestion avoidance, and marking PFC3 only Drop thresholds IP traffic Yes from PFC? Yes Write ToS byte into pack
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works PFC QoS Feature Summary These sections summarize the PFC QoS features: • Ingress LAN Port Features, page 32-11 • Ingress OSM Port Features, page 32-11 • PFC QoS Features, page 32-11 • Egress LAN Port Features, page 32-12 • Egress OSM Port Features, page 32-12 • MSFC Features, page 32-12 Ingress LAN Port Features PFC QoS supports classification, marking, scheduling, and congestion avoidance using Layer 2 CoS values at ingress LAN po
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Egress LAN Port Features PFC QoS supports egress LAN port scheduling and congestion avoidance using Layer 2 CoS values. Egress LAN port marking sets Layer 2 CoS values and Layer 3 DSCP values. See the “LAN Egress Port Features” section on page 32-21. Egress OSM Port Features Ingress PFC QoS sets Layer 3 DSCP values that can be used by the OSM egress QoS features.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Marking at Untrusted Ingress LAN Ports PFC QoS marks all frames received through untrusted ingress LAN ports with the ingress port CoS value (the default is zero). PFC QoS does not implement ingress port congestion avoidance on untrusted ingress LAN ports. Note • To use the ingress port CoS value applied to untrusted traffic as the basis of egress DSCP, configure a trust-CoS policy map that matches the ingress traffic.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works • 1p1q0t indicates one strict-priority queue and one standard queue with no configurable threshold (effectively a tail-drop threshold at 100 percent). • 1p1q8t indicates one strict-priority queue and one standard queue with eight thresholds, each configurable as either WRED-drop or tail-drop, and one non-configurable (100 percent) tail-drop threshold. Strict-priority queues are queues that are serviced in preference to other queues.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works – Using standard receive-queue tail-drop threshold 3, the router drops incoming frames with CoS 4 when the receive-queue buffer is 80 percent or more full. – Using standard receive-queue tail-drop threshold 4, the router drops incoming frames with CoS 6 or 7 when the receive-queue buffer is 100 percent full.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Note The explanations in this section use default values. You can configure many of the parameters (see the “Configuring PFC QoS” section on page 32-33). All LAN ports of the same type use the same drop-threshold configuration. Figure 32-9 illustrates the drop thresholds for a 1q4t ingress LAN port. Drop thresholds in other configurations function similarly.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Note • Policers, page 32-19 • Attaching Policy Maps, page 32-21 • Egress CoS and ToS Values, page 32-21 Filtering for PFC QoS can use Layer 2, 3, and 4 values. Marking uses Layer 2 CoS values and Layer 3 IP precedence or DSCP values.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works For all egress traffic, PFC QoS uses a configurable mapping table to derive a CoS value from the internal DSCP value associated with traffic (see the “Mapping Internal DSCP Values to Egress CoS Values” section on page 32-67). PFC QoS sends the CoS value to the egress LAN ports for use in scheduling and to be written into ISL and 802.1Q frames.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works • Untrusted—Sets the internal DSCP value to a configured DSCP value. Note With the default values, PFC QoS applies DSCP zero to traffic from ingress LAN ports configured as untrusted.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Note • Aggregate policing works independently on each DFC-equipped switching module and independently on the PFC2, which supports any non-DFC-equipped switching modules. Aggregate policing does not combine flow statistics from different DFC-equipped switching modules. You can display aggregate policing statistics for each DFC-equipped switching module and for the PFC2 and any non-DFC-equipped switching modules supported by the PFC2.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works Attaching Policy Maps You can configure each ingress LAN port for either physical port-based PFC QoS (default) or VLAN-based PFC QoS (see the “Enabling VLAN-Based PFC QoS on Layer 2 LAN Ports” section on page 32-52) and attach a policy map to the selected port (see the “Attaching a Policy Map to an Interface” section on page 32-49).
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works • 1p3q1t indicates one strict-priority queue and three standard queues, each with one threshold configurable as either WRED-drop or tail-drop, and one nonconfigurable tail-drop threshold. • 1p2q1t indicates one strict-priority queue and two standard queues, each with one configurable WRED-drop threshold and one nonconfigurable tail-drop threshold. All port types have a low-priority and a high-priority standard transmit queue.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works 2q2t Ports For 2q2t ports, each transmit queue has two tail-drop thresholds that function as follows: • Frames with CoS 0, 1, 2, or 3 go to the low-priority transmit queue (queue 1): – Using transmit queue 1, tail-drop threshold 1, the switch drops frames with CoS 0 or 1 when the low-priority transmit-queue buffer is 80 percent full.
Chapter 32 Configuring PFC QoS Understanding How PFC QoS Works 1p2q1t Ports 1p2q1t ports have a strict-priority queue and two standard transmit queues. The standard transmit queues each have one WRED-drop threshold and one nonconfigurable tail-drop threshold. • Frames with CoS 5 go to the strict-priority transmit queue (queue 3), where the switch drops frames only when the buffer is 100 percent full.
Chapter 32 Configuring PFC QoS PFC QoS Default Configuration PFC QoS Default Configuration Table 32-2 shows the PFC QoS default configuration. Table 32-2 PFC QoS Default Configuration Feature Default Value PFC QoS global enable state Disabled Note With PFC QoS enabled and all other PFC QoS parameters at default values, PFC QoS sets Layer 3 DSCP to zero and Layer 2 CoS to zero in all traffic transmitted from the router.
Chapter 32 Configuring PFC QoS PFC QoS Default Configuration Table 32-2 PFC QoS Default Configuration (continued) Feature Default Value With PFC QoS enabled Ingress LAN port trust state 2q2t transmit-queue size percentages 1p2q2t transmit-queue size percentages 1p2q1t transmit-queue size percentages Untrusted • Low priority: 80% • High priority: 20% • Low priority: 70% • High priority: 15% • Strict priority 15% • Low priority: 70% • High priority: 15% • Strict priority 15% 1p2q1t st
Chapter 32 Configuring PFC QoS PFC QoS Default Configuration Table 32-2 PFC QoS Default Configuration (continued) Feature Default Value 1p1q4t port receive-queue CoS value and drop-threshold mapping and threshold percentages Standard receive queue: • Threshold 1: – CoS 0 and 1 – Tail-drop: 50% • Threshold 2: – CoS 2 and 3 – Tail-drop: 60% • Threshold 3: – CoS 4 – Tail-drop: 80% • Threshold 4: – CoS 6 and 7 – Tail-drop: 100% Strict-priority receive queue: 1p1q0t port receive-queue CoS value an
Chapter 32 Configuring PFC QoS PFC QoS Default Configuration Table 32-2 PFC QoS Default Configuration (continued) Feature Default Value 1p1q8t receive-queue port CoS value and drop-threshold mapping Standard receive queue: • Threshold 1: – CoS 0 – Tail-drop: 70% – WRED-drop: 40% low, 70% high • Threshold 2: – CoS 1 – Tail-drop: 70% – WRED-drop: 40% low, 70% high • Threshold 3: – CoS 2 – Tail-drop: 80% – WRED-drop: 50% low, 80% high • Threshold 4: – CoS 3 – Tail-drop: 80% – WRED-drop: 50% low,
Chapter 32 Configuring PFC QoS PFC QoS Default Configuration Table 32-2 PFC QoS Default Configuration (continued) Feature Default Value 1p2q2t port transmit-queue CoS value and Standard transmit queue 1 (low priority): drop-threshold mapping and threshold • Threshold 1: percentages – CoS 0 and 1 – WRED-drop: 40% low, 70% high • Threshold 2: – CoS 2 and 3 – WRED-drop: 70% low, 100% high Standard transmit queue 2 (high priority): • Threshold 1: – CoS 4 – WRED-drop: 40% low, 70% high • Threshold 2: –
Chapter 32 Configuring PFC QoS PFC QoS Default Configuration Table 32-2 PFC QoS Default Configuration (continued) Feature Default Value 1p3q1t transmit-queue CoS value and drop-threshold mapping Standard transmit queue 1 (low priority): • Threshold 1: – CoS 0 and 1 – Tail drop (disabled): 100% – WRED-drop (enabled): 70% low, 100% high Standard transmit queue 2 (medium priority) tail-drop threshold: • Threshold 1: – CoS 2, 3, and 4 – Tail drop (disabled): 100% – WRED-drop (enabled): 70% low, 100% h
Chapter 32 Configuring PFC QoS PFC QoS Configuration Guidelines and Restrictions Table 32-2 PFC QoS Default Configuration (continued) Feature Default Value Transmit-queue size ratio Low priority: 100% (other queues not used) CoS value and drop threshold mapping All CoS values mapped to the low-priority queue. PFC QoS Configuration Guidelines and Restrictions Follow these guidelines and restrictions when configuring PFC QoS: Guidelines: • With an MSFC2, Release 12.
Chapter 32 Configuring PFC QoS PFC QoS Configuration Guidelines and Restrictions Within each range, PFC QoS programs the PFC hardware with rate values that are multiples of the granularity values.
Chapter 32 Configuring PFC QoS Configuring PFC QoS – class class_name destination-address, class class_name input-interface, class class_name protocol, class class_name qos-group, or class class_name source-address policy map commands – bandwidth, priority, queue-limit, or random-detect policy map class commands Configuring PFC QoS These sections describe how to configure PFC QoS on the Cisco 7600 series routers: Note • Enabling PFC QoS Globally, page 32-33 • Enabling Queueing-Only Mode, page 32-34
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to enable PFC QoS globally: Router# configure terminal Router(config)# mls qos Router(config)# end Router# This example shows how to verify the configuration: Router# show mls qos QoS is enabled globally Microflow QoS is enabled globally QoS global counters: Total packets: 544393 IP shortcut packets: 1410 Packets dropped by policing: 0 IP packets with TOS changed by policing: 467 IP packets with COS changed by policing: 59998 Non-
Chapter 32 Configuring PFC QoS Configuring PFC QoS Creating Named Aggregate Policers To create a named aggregate policer (see the “Policers” section on page 32-19), perform this task: Command Purpose Router(config)# mls qos aggregate-policer policer_name bits_per_second normal_burst_bytes [maximum_burst_bytes] [pir1 peak_rate_bps] [[[conform-action {drop | set-dscp-transmit2 dscp_value | set-prec-transmit2 ip_precedence_value | transmit}] exceed-action {drop | policed-dscp | transmit}] violate-action1 {
Chapter 32 Configuring PFC QoS Configuring PFC QoS The maximum_burst_bytes parameter is supported with PFC2. The maximum_burst_bytes parameter is not supported with PFC, but can be entered with a value equal to the normal_burst_bytes parameter.
Chapter 32 Configuring PFC QoS Configuring PFC QoS – Enter the policed-dscp-transmit keyword to cause all matched out-of-profile traffic to be marked down as specified in the markdown map (see the “Configuring DSCP Markdown Values” section on page 32-68). – For marking without policing, enter the transmit keyword to transmit all matched out-of-profile traffic.
Chapter 32 Configuring PFC QoS Configuring PFC QoS These commands configure traffic classes and the policies to be applied to those traffic classes and attach the policies to ports: • access-list (Optional for IP traffic. You can filter IP traffic with class-map commands.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Configuring MAC-Layer Named Access Lists (Optional) In Release 12.1(1)E and later releases, you can configure named access lists that filter DECnet, AppleTalk, VINES, or XNS traffic based on Layer 2 addresses. To configure a MAC-Layer named access list, perform this task: Step 1 Step 2 Command Purpose Router(config)# mac access-list extended list_name Configures a MAC-Layer named access list.
Chapter 32 Configuring PFC QoS Configuring PFC QoS • 0x6005—diagnostic—DEC DECnet Diagnostics • 0x6007—lavc-sca—DEC Local-Area VAX Cluster (LAVC), SCA • 0x6008—amber—DEC AMBER • 0x6009—mumps—DEC MUMPS • 0x8038—dec-spanning—DEC LANBridge Management • 0x8039—dsm—DEC DSM/DDP • 0x8040—netbios—DEC PATHWORKS DECnet NETBIOS Emulation • 0x8041—msdos—DEC Local Area System Transport • 0x8042—etype-8042—DEC unassigned • 0x809B—appletalk—Kinetics EtherTalk (AppleTalk over Ethernet) • 0x80F3—aarp
Chapter 32 Configuring PFC QoS Configuring PFC QoS To configure filtering in a class map, perform one of these tasks: Command Purpose Router(config-cmap)# match access-group name acl_index_or_name (Optional) Configures the class map to filter using an ACL. Router(config-cmap)# no match access-group name acl_index_or_name Clears the ACL configuration from the class map.
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to create a class map named ipp5 and how to configure filtering to match traffic with IP precedence 5: Router# configure terminal Enter configuration commands, one per line. Router(config)# class-map ipp5 Router(config-cmap)# match ip precedence 5 Router(config-cmap)# end Router# End with CNTL/Z.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Creating a Policy Map Class and Configuring Filtering Note • With an MSFC2, Release 12.1(13)E and later releases support the class class_name protocol policy map command, which configures NBAR and sends all traffic on the Layer 3 interface, both ingress and egress, to be processed in software on the MSFC2. To configure NBAR, refer to this publication: http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t8/dtnbarad.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Configuring Policy Map Class Actions When configuring policy map class actions, note the following: • For hardware-switched traffic, PFC QoS does not support the bandwidth, priority, queue-limit, or random-detect policy map class commands. You can configure these commands because they can be used for software-switched traffic. • With Release 12.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Configuring the Policy Map Class Trust State To configure the policy map class trust state, perform this task: Command Purpose Router(config-pmap-c)# trust {cos | dscp | ip-precedence} Configures the policy map class trust state, which selects the value that PFC QoS uses as the source of the internal DSCP value (see the “Internal DSCP Values” section on page 32-17).
Chapter 32 Configuring PFC QoS Configuring PFC QoS Configuring a Per-Interface Policer To configure a per-interface policer (see the “Policers” section on page 32-19), perform this task: Command Purpose Router(config-pmap-c)# police [flow] bits_per_second normal_burst_bytes [maximum_burst_bytes] [pir1 peak_rate_bps] [[[conform-action {drop | set-dscp-transmit2 dscp_value | set-prec-transmit2 ip_precedence_value | transmit}] exceed-action {drop | policed-dscp | transmit}] violate-action1 {drop | police
Chapter 32 Configuring PFC QoS Configuring PFC QoS – Because the token bucket must be large enough to hold at least one frame, set the parameter larger than the maximum Layer 3 packet size of the traffic being policed. – For TCP traffic, configure the token bucket size as a multiple of the TCP window size, with a minimum value at least twice as large as the maximum Layer 3 packet size of the traffic being policed. The maximum_burst_bytes parameter is supported with the PFC2.
Chapter 32 Configuring PFC QoS Configuring PFC QoS • (Optional—Not supported with the flow keyword) For traffic that exceeds the PIR, you can specify a violate action as follows: – For marking without policing, you can enter the transmit keyword to transmit all matched out-of-profile traffic. – The default violate action is equal to the exceed action.
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to verify the configuration: Router# show policy-map max-pol-ipp5 Policy Map max-pol-ipp5 class ipp5 class ipp5 police flow 10000000 10000 conform-action set-prec-transmit 6 exceed-action policed-dscp-transmit trust precedence police 2000000000 2000000 2000000 conform-action set-prec-transmit 6 exceed-action policed-dscp-transmit Router# Attaching a Policy Map to an Interface Note PFC QoS does not support the output service-policy
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to verify the configuration: Router# show policy-map interface fastethernet 5/36 FastEthernet5/36 service-policy input: pmap1 class-map: cmap1 (match-all) 0 packets, 0 bytes 5 minute rate 0 bps match: ip precedence 5 class cmap1 police 8000 8000 conform-action transmit exceed-action drop class-map: cmap2 (match-any) 0 packets, 0 bytes 5 minute rate 0 bps match: ip precedence 2 0 packets, 0 bytes 5 minute rate 0 bps class cmap2 poli
Chapter 32 Configuring PFC QoS Configuring PFC QoS By default, microflow policers affect only routed traffic. To enable microflow policing of bridged traffic on specified VLANs, perform this task: Command Purpose Step 1 Router(config)# interface {{vlan vlan_ID} | {type1 slot/port}} Selects the interface to configure. Step 2 Router(config-if)# mls qos bridged Enables microflow policing of bridged traffic, including bridge groups, on the VLAN.
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to disable PFC QoS on the VLAN 5 interface: Router# configure terminal Enter configuration commands, one per line. Router(config)# interface vlan 5 Router(config-if)# no mls qos Router(config-if)# end Router# End with CNTL/Z. This example shows how to verify the configuration: Router# show mls qos | begin QoS is disabled QoS is disabled on the following interfaces: Vl5 <...Output Truncated...
Chapter 32 Configuring PFC QoS Configuring PFC QoS Note Configuring a Layer 2 LAN port for VLAN-based PFC QoS preserves the policy map port configuration. The no mls qos vlan-based port command reenables any previously configured port commands. Configuring the Trust State of Ethernet LAN and OSM Ingress Ports By default, all ingress ports are untrusted.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Configuring the Ingress LAN Port CoS Value Note Whether or not PFC QoS uses the CoS value applied with the mls qos cos command depends on the trust state of the port and the trust state of the traffic received through the port. The mls qos cos command does not configure the trust state of the port or the trust state of the traffic received through the port.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Note • Enter the show queueing interface {ethernet | fastethernet | gigabitethernet | tengigabitethernet} slot/port | include type command to see the queue structure of a port (see the “Receive Queues” section on page 32-13 and the “Transmit Queues” section on page 32-21). • 1p1q0t ports have no configurable thresholds.
Chapter 32 Configuring PFC QoS Configuring PFC QoS To configure the drop thresholds, perform this task: Command Purpose Step 1 Router(config)# interface {fastethernet | gigabitethernet} slot/port Selects the interface to configure. Step 2 Router(config-if)# rcv-queue threshold queue_id thr1% thr2% thr3% thr4% {thr5% thr6% thr7% thr8%} Configures the receive-queue tail-drop threshold percentages.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Step 3 Step 4 Step 5 Command Purpose Router(config-if)# wrr-queue random-detect max-threshold queue_id thr1% [thr2%] Configures the high WRED-drop thresholds. Router(config-if)# no wrr-queue random-detect max-threshold [queue_id] Reverts to the default high WRED-drop thresholds. Router(config-if)# end Exits configuration mode. Router# show queueing interface type 1. 1 slot/port Verifies the configuration.
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to verify the configuration: Router# show queueing interface gigabitethernet 1/1 | begin Transmit queues Transmit queues [type = 1p2q2t]: Queue Id Scheduling Num of thresholds ----------------------------------------1 WRR low 2 2 WRR high 2 3 Priority 1 queue random-detect-max-thresholds ---------------------------------1 40[1] 70[2] 2 40[1] 70[2] <...Output Truncated...
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to configure receive queue 1/threshold 1 and transmit queue 1/threshold 1 for Gigabit Ethernet port 2/1: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z.
Chapter 32 Configuring PFC QoS Configuring PFC QoS • Threshold 0 is a nonconfigurable 100-percent tail-drop threshold on these port types: – 1p1q0t (receive) – 1p1q8t (receive) – 1p3q1t (transmit) – 1p2q1t (transmit) • The standard queue thresholds can be configured as either tail-drop or WRED-drop thresholds on these port types: – 1p1q8t (receive) – 1p3q1t (transmit) See the “Configuring Standard-Queue Drop Threshold Percentages” section on page 32-54 for more information about configuring threshold
Chapter 32 Configuring PFC QoS Configuring PFC QoS Mapping CoS Values to Standard Transmit-Queue Thresholds To map CoS values to standard transmit-queue thresholds, perform this task: Command Purpose Step 1 Router(config)# interface {fastethernet | gigabitethernet} slot/port Selects the interface to configure. Step 2 Router(config-if)# wrr-queue cos-map transmit_queue_# threshold_# cos1 [cos2 [cos3 [cos4 [cos5 [cos6 [cos7 [cos8]]]]]]] Maps CoS values to a standard transmit-queue threshold.
Chapter 32 Configuring PFC QoS Configuring PFC QoS When mapping CoS values to the strict-priority queues, note the following: • The queue number is always 1. • You can enter up to 8 CoS values to map to the queue. This example shows how to map CoS value 7 to the strict-priority queues on Gigabit Ethernet port 1/1: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z.
Chapter 32 Configuring PFC QoS Configuring PFC QoS To map CoS values to tail-drop thresholds, perform this task: Command Purpose Step 1 Router(config)# interface type1 slot/port Selects the interface to configure. Step 2 Router(config-if)# wrr-queue cos-map transmit_queue_# threshold_# cos1 [cos2 [cos3 [cos4 [cos5 [cos6 [cos7 [cos8]]]]]]] Maps CoS values to a tail-drop threshold. Step 3 Router(config-if)# no wrr-queue cos-map Reverts to the default mapping.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Allocating Bandwidth Between LAN-Port Transmit Queues The router transmits frames from one standard queue at a time using a WRR algorithm. WRR uses the ratio between queue weight values to decide how much to transmit from one queue before switching to the other. The more the ratio favors a queue, the more transmit bandwidth is allocated to it.
Chapter 32 Configuring PFC QoS Configuring PFC QoS When setting the receive-queue size ratio, note the following: • The rcv-queue queue-limit command configures ports on a per-ASIC basis. • Estimate the mix of strict priority-to-standard traffic on your network (for example, 80 percent standard traffic and 20 percent strict-priority traffic). • Use the estimated percentages as queue weights.
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to set the transmit-queue size ratio for Gigabit Ethernet port 1/2: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Mapping Received IP Precedence Values to Internal DSCP Values To configure the mapping of received IP precedence values to the DSCP value that PFC QoS uses internally on the PFC (see the “Internal DSCP Values” section on page 32-17), perform this task: Command Purpose Router(config)# mls qos map ip-prec-dscp dscp1 dscp2 dscp3 dscp4 dscp5 dscp6 dscp7 dscp8 Configures the received IP precedence to internal DSCP map.
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to configure internal DSCP values 0, 8, 16, 24, 32, 40, 48, and 54 to be mapped to egress CoS value 0: Router# configure terminal Enter configuration commands, one per line. End with CNTL/Z.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Note Note When you create a policer that does not use the pir keyword, and the maximum_burst_bytes parameter is equal to the normal_burst_bytes parameter (which occurs if you do not enter the maximum_burst_bytes parameter), the exceed-action policed-dscp-transmit keywords cause PFC QoS to mark traffic down as defined by the policed-dscp max-burst markdown map.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Configuring PFC QoS Statistics Data Export Note Release 12.1(11b)E and later releases support PFC QoS statistics data export.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Enabling PFC QoS Statistics Data Export for a Port To enable PFC QoS statistics data export for a port, perform this task: Command Purpose 1 Step 1 Router(config)# interface type Step 2 Router(config-if)# mls qos statistics-export Enables PFC QoS statistics data export for the port. Router(config-if)# no mls qos statistics-export Disables PFC QoS statistics data export for the port. Step 3 Router(config)# end Exits configuration mode.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Enabling PFC QoS Statistics Data Export for a Named Aggregate Policer To enable PFC QoS statistics data export for a named aggregate policer, perform this task: Command Purpose Router(config)# mls qos statistics-export aggregate-policer aggregate_policer_name Enables PFC QoS statistics data export for a named aggregate policer.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Enabling PFC QoS Statistics Data Export for a Class Map To enable PFC QoS statistics data export for a class map, perform this task: Command Purpose Router(config)# mls qos statistics-export class-map classmap_name Enables PFC QoS statistics data export for a class map. Router(config)# no mls qos statistics-export class-map classmap_name Disables PFC QoS statistics data export for a class map. Step 2 Router(config)# end Exits configuration mode.
Chapter 32 Configuring PFC QoS Configuring PFC QoS • For data from a VLAN interface: – Export type (“5” for a class map and VLAN) – Class map name – Direction (“in”) – PFC or DFC slot number – VLAN ID – Number of in-profile packets – Number of packets that exceed the CIR – Number of packets that exceed the PIR – Time stamp • For data from a port channel interface: – Export type (“6” for a class map and port channel) – Class map name – Direction (“in”) – PFC or DFC slot number – Port channel ID – Numbe
Chapter 32 Configuring PFC QoS Configuring PFC QoS This example shows how to set the PFC QoS statistics data export interval and verify the configuration: Router(config)# mls qos statistics-export interval 250 Router(config)# end Router# show mls qos statistics-export info QoS Statistics Data Export Status and Configuration information --------------------------------------------------------------Export Status : enabled Export Interval : 250 seconds Export Delimiter : | Export Destination : Not configured
Chapter 32 Configuring PFC QoS Configuring PFC QoS Table 32-3 Supported PFC QoS Data Export Facility Parameter Values (continued) Name Definition Name Definition auth security/authentication messages local3 reserved for local use syslog internal syslogd messages local4 reserved for local use lpr line printer subsytem local5 reserved for local use news netnews subsytem local6 reserved for local use uucp uucp subsystem local7 reserved for local use Table 32-4 lists the supported PF
Chapter 32 Configuring PFC QoS Configuring PFC QoS Setting the PFC QoS Statistics Data Export Field Delimiter To set the PFC QoS statistics data export field delimiter, perform this task: Command Purpose Router(config)# mls qos statistics-export delimiter delimiter_character Sets the PFC QoS statistics data export field delimiter.
Chapter 32 Configuring PFC QoS Configuring PFC QoS Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 33 Configuring NDE This chapter describes how to configure NetFlow Data Export (NDE) on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication and the Release 12.1 publications at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/index.
Chapter 33 Configuring NDE Understanding How NDE Works NDE Overview NDE makes routed-traffic statistics available for analysis by an external data collector. You can use NDE to analyze all IP unicast traffic that is Layer 3-switched on the PFC and all IP unicast traffic that is routed in software on the MSFC. The Supervisor Engine 2 stores NetFlow statistics in the NetFlow table. The NDE configuration has no effect on Layer 3 switching in hardware by the PFC2.
Chapter 33 Configuring NDE Understanding How NDE Works • full—A more-specific flow mask. The PFC creates and maintains a separate cache entry for each IP flow. A full entry includes the source IP address, destination IP address, protocol, and protocol-specific Layer 4 port information. • full-interface—The most-specific flow mask. Adds the source VLAN SNMP ifIndex to the information in the full flow mask. The full-interface flow mask is supported on Supervisor Engine 2 with Release 12.
Chapter 33 Configuring NDE Understanding How NDE Works Table 33-2 NDE Version 5 Flow Record Format Flow masks: • X=Populated • A=Additional field (see the “Populating Additional NDE Fields” section on page 33-10) Bytes Content Description 0–3 srcaddr Source IP address 4–7 dstaddr Destination IP address 8–11 nexthop Next hop router’s IP address Destination Destination Source Interface1 Destination Source Full X A 2 Full Interface1 X X X X X X X X A A A A X X 12–13 input Ing
Chapter 33 Configuring NDE Understanding How NDE Works Table 33-3 NDE Version 7 Header Format Bytes Content Description 0–1 version Netflow export format version number 2–3 count Number of flows exported in this packet (1–30) 4–7 SysUptime Current time in milliseconds since router booted 8–11 unix_secs Current seconds since 0000 UTC 1970 12–15 unix_nsecs Residual nanoseconds since 0000 UTC 1970 16–19 flow_sequence Sequence counter of total flows seen 20–24 reserved Unused (zero) by
Chapter 33 Configuring NDE Understanding How NDE Works Table 33-4 NDE Version 7 Flow Record Format (continued) Flow masks: • X=Populated • A=Additional field (see the “Populating Additional NDE Fields” section on page 33-10) Bytes Content Description 42–43 dst_as Autonomous system number of the destination, either origin or peer 44–45 src_mask Source address prefix mask bits 46–47 dst_mask Destination address prefix mask bits 48 Pad 2 is unused (zero) bytes pad2 49–50 MLS RP IP address of
Chapter 33 Configuring NDE Default NDE Configuration You can configure sampled NetFlow to use time-based sampling or packet-based sampling. Table 33-5 lists the time-based sampling rates and export intervals.
Chapter 33 Configuring NDE Configuring NDE Configuring NDE These sections describe how to configure NDE: Note • Configuring NDE on the PFC, page 33-8 • Configuring NDE on the MSFC, page 33-13 • Displaying the NDE Address and Port Configuration, page 33-14 • Configuring NDE Flow Filters, page 33-15 • Displaying the NDE Configuration, page 33-17 • You must enable NetFlow on the MSFC Layer 3 interfaces to support NDE on the PFC and on the MSFC.
Chapter 33 Configuring NDE Configuring NDE This example shows how to enable NDE from the PFC: Router(config)# mls nde sender Setting the Minimum IP MLS Flow Mask You can set the minimum granularity of the flow mask for the MLS cache on the PFC. The actual flow mask used will have at least the granularity specified by this command. For information on how the different flow masks work, see the “Flow Masks” section on page 33-2.
Chapter 33 Configuring NDE Configuring NDE Populating Additional NDE Fields With Release 12.1(13)E and later releases, you can configure NDE to populate the following additional fields in the NDE packets: • IP address of the next hop router • Egress interface SNMP ifIndex • Source autonomous system number • Destination autonomous system number Not all of the additional fields are populated with all flow masks. See the “NDE Versions” section on page 33-3 for additional information.
Chapter 33 Configuring NDE Configuring NDE A typical cache entry that is removed is the entry for flows to and from a Domain Name Server (DNS) or TFTP server. This entry might not be used again after it is created. The PFC saves space in the MLS cache for other data when it detects and ages out these entries. If you need to enable MLS fast aging time, initially set the value to 128 seconds.
Chapter 33 Configuring NDE Configuring NDE Configuring Sampled NetFlow Globally To configure sampled NetFlow globally, perform this task: Step 1 Step 2 Command Purpose Router(config)# mls sampling {time-based rate | packet-based rate [interval]} Enables sampled NetFlow and configures the rate. For packet-based sampling, optionally configures the export interval. Router(config)# no mls sampling Clears the sampled NetFlow configuration. Router(config)# end Exits configuration mode.
Chapter 33 Configuring NDE Configuring NDE Configuring NDE on the MSFC This section supplements the NetFlow procedures at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/switch_r/index.
Chapter 33 Configuring NDE Configuring NDE Configuring the NDE Destination To configure the destination IP address and UDP port to receive the NDE statistics, perform this task: Command Purpose Router(config)# ip flow-export destination ip_address udp_port_number Configures the NDE destination IP address and UDP port. Router(config)# no ip flow-export destination Clears the NDE destination configuration.
Chapter 33 Configuring NDE Configuring NDE Version 1 flow records 0 flows exported in 0 udp datagrams 0 flows failed due to lack of export packet 0 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues Router# Configuring NDE Flow Filters These sections describe NDE flow filters: • NDE Flow Filter Overview, page 33-15 • Configuring a Port Flow Filter, page 33-15 • Configuring a Host and Port Filter, page 33-16
Chapter 33 Configuring NDE Configuring NDE Configuring a Host and Port Filter To configure a host and TCP/UDP port flow filter, perform this task: Command Purpose Router(config)# mls nde flow {exclude | include} {destination ip_address mask | source ip_address mask {dest-port number | src-port number}} Configures a host and port flow filter for an NDE flow. Router(config)# no mls nde flow {exclude | include} Clears the port flow filter configuration.
Chapter 33 Configuring NDE Configuring NDE Clearing an NDE Flow Filter To clear the NDE flow filter and reset the filter to the default (all flows exported), perform this task: Command Purpose Router# clear mls nde flow {all | exclude | include} Clears the NDE flow filter.
Chapter 33 Configuring NDE Configuring NDE Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 34 Configuring Local SPAN and RSPAN This chapter describes how to configure local Switched Port Analyzer (SPAN) and remote SPAN (RSPAN) on the Cisco 7600 series routers. The Cisco 7600 series routers support RSPAN with Release 12.1(13)E and later releases.
Chapter 34 Configuring Local SPAN and RSPAN Understanding How Local SPAN and RSPAN Work Local SPAN Overview Local SPAN supports source ports, source VLANs, and destination ports on the same Cisco 7600 series router. Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs to a destination port for analysis (see Figure 34-1). For example, as shown in Figure 34-1, all traffic on Ethernet port 5 (the source port) is copied to Ethernet port 10.
Chapter 34 Configuring Local SPAN and RSPAN Understanding How Local SPAN and RSPAN Work RSPAN Overview RSPAN supports source ports, source VLANs, and destination ports on different switches, which provides remote monitoring of multiple switches across your network (see Figure 34-2). The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. The RSPAN source ports can be trunks carrying the RSPAN VLAN.
Chapter 34 Configuring Local SPAN and RSPAN Understanding How Local SPAN and RSPAN Work Monitored Traffic These sections describe the traffic that SPAN (local or remote) can monitor: • Monitored Traffic Direction, page 34-4 • Monitored Traffic Type, page 34-4 • Duplicate Traffic, page 34-4 Monitored Traffic Direction You can configure SPAN sessions to monitor ingress network traffic (called ingress SPAN), or to monitor egress network traffic (called egress SPAN), or to monitor traffic flowing in bo
Chapter 34 Configuring Local SPAN and RSPAN Local SPAN and RSPAN Configuration Guidelines and Restrictions Source VLANs A source VLAN is a VLAN monitored for network traffic analysis. VLAN-based SPAN (VSPAN) uses a VLAN as the SPAN source. All the ports in the source VLANs become source ports. Destination Ports A destination port is a Layer 2 or Layer 3 LAN port to which SPAN sends traffic for analysis. When you configure a port as a SPAN destination port, it can no longer receive any traffic.
Chapter 34 Configuring Local SPAN and RSPAN Local SPAN and RSPAN Configuration Guidelines and Restrictions Local SPAN and RSPAN Source and Destination Limits These are the local SPAN and RSPAN source and destination limits: Sources and Destinations Local SPAN Sessions RSPAN Source Sessions RSPAN Destination Sessions Egress sources 1 (0 with a remote SPAN source session configured) 1 (0 with a local SPAN egress source session configured) 1 RSPAN VLAN Ingress sources 64 64 Destinations per sessi
Chapter 34 Configuring Local SPAN and RSPAN Local SPAN and RSPAN Configuration Guidelines and Restrictions • You cannot configure destination ports to receive ingress traffic. • Destination ports never participate in any spanning tree instance. Local SPAN includes BPDUs in the monitored traffic, so any BPDUs seen on the destination port are from the source port. RSPAN does not support BPDU monitoring.
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN • RSPAN does not support BPDU monitoring. • Do not configure RSPAN VLANs as sources in VSPAN sessions. • You can configure any VLAN as an RSPAN VLAN as long as all participating network devices support configuration of RSPAN VLANs and you use the same RSPAN VLAN for each RSPAN session in all participating network devices. • Entering SPAN configuration commands does not clear previously configured SPAN parameters.
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN Step 2 Step 3 Command Purpose Router(config-vlan)# remote-span Configures the VLAN as an RSPAN VLAN. Router(config-vlan)# no remote-span Clears the RSPAN VLAN configuration. Router(config-vlan)# end Updates the VLAN database and returns to privileged EXEC mode. Configuring Local or RSPAN Sources Note To configure an RSPAN source session, configure a source with an RSPAN VLAN as the destination.
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN This example shows how to configure a port as an unconditional IEEE 802.
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN This example shows how to remove sources for a session: Router(config)# no monitor session 2 source interface fastethernet 5/15 , 7/3 This example shows how to remove options for sources for a session: Router(config)# no monitor session 2 source interface gigabitethernet 1/2 Router(config)# no monitor session 2 source interface port-channel 102 tx This example shows how to remove VLAN filtering for a session: Router(config)# no
Chapter 34 Configuring Local SPAN and RSPAN Configuring Local SPAN and RSPAN Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 35 Configuring Web Cache Services Using WCCP This chapter describes how to configure the Cisco 7600 series routers to redirect traffic to cache engines (web caches) using the Web Cache Communication Protocol (WCCP), and describes how to manage cache engine clusters (cache farms).
Chapter 35 Configuring Web Cache Services Using WCCP Understanding WCCP WCCP Overview The Web Cache Communication Protocol (WCCP) is a Cisco-developed content-routing technology that allows you to integrate cache engines (such as the Cisco Cache Engine 550) into your network infrastructure. Note Cisco Systems replaced the Cache Engine 500 Series platforms with Content Engine Platforms in July 2001. Cache Engine Products were the Cache Engine 505, 550, 570, and 550-DS3.
Chapter 35 Configuring Web Cache Services Using WCCP Understanding WCCP • Note Layer 2 redirection takes place on the PFC and is not visible to the MSFC. The show ip wccp web-cache detail command on the MSFC displays statistics for only the first packet of a Layer 2 redirected flow, which provides an indication of how many flows, rather than packets, are using Layer 2 redirection. Entering the show mls entries command displays the other packets in the Layer 2 redirected flows.
Chapter 35 Configuring Web Cache Services Using WCCP Understanding WCCP 4. Once a stable view has been established, one cache engine is elected as the lead cache engine. (The lead is defined as the cache engine seen by all the cache engines in the cluster with the lowest IP address). This lead cache engine uses WCCP to indicate to the control router how IP packet redirection should be performed.
Chapter 35 Configuring Web Cache Services Using WCCP Understanding WCCP The multicast option is easier to configure because you need only specify a single address on each cache engine. This option also allows you to add and remove routers from a service group dynamically, without needing to reconfigure the cache engines with a different list of addresses each time. The following sequence of events details how WCCPv2 configuration works: 1. Each cache engine is configured with a list of routers. 2.
Chapter 35 Configuring Web Cache Services Using WCCP Restrictions for WCCPv2 MD5 Security WCCPv2 provides optional authentication that enables you to control which routers and cache engines become part of the service group using passwords and the HMAC MD5 standard. Shared-secret MD5 one-time authentication (set using the ip wccp [password [0-7] password] global configuration command) enables messages to be protected against interception, inspection, and replay.
Chapter 35 Configuring Web Cache Services Using WCCP Configuring WCCP • All cache engines in a cluster must be configured to communicate with all routers servicing the cluster. • Multicast addresses must be from 224.0.0.0 to 239.255.255.255. Configuring WCCP The following configuration tasks assume that you have already installed and configured the cache engines you want to include in your network.
Chapter 35 Configuring Web Cache Services Using WCCP Configuring WCCP Configuring a Service Group Using WCCPv2 WCCPv2 uses service groups based on logical redirection services, deployed for intercepting and redirecting traffic. The standard service is web cache, which intercepts TCP port 80 (HTTP) traffic and redirects that traffic to the cache engines. This service is referred to as a well-known service, because the characteristics of the web cache service are known by both the router and cache engines.
Chapter 35 Configuring Web Cache Services Using WCCP Configuring WCCP Inbound traffic can be configured to use Cisco Express Forwarding (CEF), distributed Cisco Express Forwarding (dCEF), Fast Forwarding, or Process Forwarding. Configuring WCCP for redirection for inbound traffic on interfaces allows you to avoid the overhead associated with CEF forwarding for outbound traffic.
Chapter 35 Configuring Web Cache Services Using WCCP Configuring WCCP Command Purpose Step 2 Router(config)# interface type number Specifies the interface to be configured for multicast reception. Step 3 Router(config-if)# ip wccp {web-cache | service-number} group-listen Enables the reception of IP multicast packets (content originating from the cache engines) on the interface specified in Step 2.
Chapter 35 Configuring Web Cache Services Using WCCP Verifying and Monitoring WCCP Configuration Settings To configure an MD5 password for use by the router in WCCP communications, perform this task in global configuration mode: Command Purpose Router(config)# ip wccp web-cache password password Sets an MD5 password on the router.
Chapter 35 Configuring Web Cache Services Using WCCP WCCP Configuration Examples • Setting a Password for a Router and Cache Engines Example, page 35-14 • Verifying WCCP Settings Example, page 35-14 Changing the Version of WCCP on a Router Example The following example shows the process of changing the WCCP version from the default of WCCPv2 to WCCPv1, and enabling the web-cache service in WCCPv1: Router# show ip wccp % WCCP version 2 is not enabled Router# configure terminal Router(config)# ip wccp
Chapter 35 Configuring Web Cache Services Using WCCP WCCP Configuration Examples . . . WCCP Redirect inbound is enabled WCCP Redirect exclude is disabled . . .
Chapter 35 Configuring Web Cache Services Using WCCP WCCP Configuration Examples The following example configures a router to redirect web-related packets received through interface ethernet 0/1, destined to any host except 209.165.196.51: Router(config)# access-list 100 deny ip any host 209.165.196.
Chapter 35 Configuring Web Cache Services Using WCCP WCCP Configuration Examples interface Ethernet1 ip address 10.4.1.1 255.255.255.0 no ip directed-broadcast ip wccp 99 redirect out no ip route-cache no ip mroute-cache ! interface Serial0 no ip address no ip directed-broadcast no ip route-cache no ip mroute-cache shutdown ! interface Serial1 no ip address no ip directed-broadcast no ip route-cache no ip mroute-cache shutdown ! ip default-gateway 10.3.1.1 ip classless ip route 0.0.0.0 0.0.0.0 10.3.1.
Chapter 35 Configuring Web Cache Services Using WCCP WCCP Configuration Examples Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 36 Configuring SNMP IfIndex Persistence This chapter describes how to configure the SNMP ifIndex persistence feature on Cisco 7600 series routers. Release 12.1(13)E and later releases support SNMP ifIndex persistence.
Chapter 36 Configuring SNMP IfIndex Persistence Configuring SNMP IfIndex Persistence Note To verify that ifIndex commands have been configured, use the more system:running-config command. Enabling and Disabling SNMP IfIndex Persistence Globally SNMP ifIndex persistence is disabled by default. To globally enableSNMP ifIndex persistence, perform this task: Command Purpose Router(config)# snmp-server ifindex persist Globally enables SNMP ifIndex persistence.
Chapter 36 Configuring SNMP IfIndex Persistence Configuration Examples To clear the interface-specific SNMP ifIndex persistence setting and configure the interface to use the global configuration setting, perform this task: Command Purpose Step 1 Router(config)# interface type slot/port Enters interface configuration mode for the specified interface. Note that the syntax of the interface command will vary depending on the platform you are using.
Chapter 36 Configuring SNMP IfIndex Persistence Configuration Examples Clearing SNMP IfIndex Persistence Configuration from a Specific Interface Example In the following example, any previous setting for SNMP ifIndex persistence on Ethernet interface 3/1 is removed from the configuration. If SNMP ifIndex persistence is globally enabled, SNMP ifIndex persistence will be enabled for Ethernet interface 3/1.
C H A P T E R 37 Configuring the Switch Fabric Module This chapter describes how to configure the Switch Fabric Module (SFM) for the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 37 Configuring the Switch Fabric Module Understanding How the Switch Fabric Module Works Switch Fabric Module Slots With a WS-C6513 chassis, install the Switch Fabric Modules in either slot 7 or 8. Note In a WS-C6513 chassis, only slots 9 through 13 support dual-switch fabric interface switching modules (for example, WS-X6816-GBIC). With all other chassis, install the Switch Fabric Modules in either slot 5 or 6.
Chapter 37 Configuring the Switch Fabric Module Configuring the Switch Fabric Module • Truncated mode—The router uses this mode for traffic between fabric-enabled modules when there are both fabric-enabled and nonfabric-enabled modules installed. In this mode, the router sends a truncated version of the traffic (the first 64 bytes of the frame) over the switch fabric channel.
Chapter 37 Configuring the Switch Fabric Module Configuring the Switch Fabric Module When configuring the switching mode, note the following syntax information: Caution • To allow use of nonfabric-enabled modules or to allow fabric-enabled modules to use bus mode, enter the fabric switching-mode allow bus-mode command. • To prevent use of nonfabric-enabled modules or to prevent fabric-enabled modules from using bus mode, enter the no fabric switching-mode allow bus-mode command.
Chapter 37 Configuring the Switch Fabric Module Monitoring the Switch Fabric Module Configuring an LCD Message To configure a message for display on the LCD, perform this task: Command Purpose Router(config)# fabric lcd-banner d message d Configures a message for display on the LCD. Router(config)# no fabric lcd-banner Clears the message displayed on the LCD. When configuring a message for display on the LCD, note the following syntax information: • The d parameter is a delimiting character.
Chapter 37 Configuring the Switch Fabric Module Monitoring the Switch Fabric Module This example shows how to display module information: Router# show module 5 Mod Ports Card Type Model Serial No. --- ----- -------------------------------------- ------------------ ----------5 0 Switching Fabric Module WS-C6500-SFM SAD04420JR5 Mod MAC addresses Hw Fw Sw Status --- ---------------------------------- ------ ------------ ------------ ------5 0001.0002.0003 to 0001.0002.0003 1.0 6.1(3) 6.2(0.
Chapter 37 Configuring the Switch Fabric Module Monitoring the Switch Fabric Module Displaying the Fabric Status To display the fabric status of one or all switching modules, perform this task: Command Purpose Router# show fabric status [slot_number | all] Displays fabric status.
Chapter 37 Configuring the Switch Fabric Module Monitoring the Switch Fabric Module This example shows how to display fabric errors on all modules: Router# show fabric errors slot channel module crc 1 0 0 3 0 0 3 1 0 4 0 0 4 1 0 6 0 0 6 1 0 7 0 0 7 1 0 Router# module hbeat 0 0 0 0 0 0 0 0 0 module sync 0 0 0 0 0 0 0 0 0 fabric sync 0 0 0 0 0 0 0 0 0 Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
C H A P T E R 38 Power Management and Environmental Monitoring This chapter describes the power management and environmental monitoring features in the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco 7600 Series Router Cisco IOS Command Reference publication.
Chapter 38 Power Management and Environmental Monitoring Understanding How Power Management Works Enabling or Disabling Power Redundancy From global configuration mode, enter the power redundancy-mode combined | redundant commands to disable or enable redundancy (redundancy is enabled by default). You can change the configuration of the power supplies to redundant or nonredundant at any time. Specifying the combined keyword disables redundancy.
Chapter 38 Power Management and Environmental Monitoring Understanding How Power Management Works Table 38-1 Effects of Power Supply Configuration Changes (continued) Configuration Change Effect Power supply is removed with redundancy enabled • System log and syslog messages are generated. • No change in module status since power capability is unchanged. Power supply is removed with redundancy disabled • System log and syslog messages are generated.
Chapter 38 Power Management and Environmental Monitoring Understanding How Environmental Monitoring Works Using the CLI to Power Cycle Modules From global configuration mode, enter the power cycle module slot command to power cycle (reset) a module; the module powers off for 5 seconds and then powers on. Determining System Power Requirements System power requirements are dependent on the size of the power supply.
Chapter 38 Power Management and Environmental Monitoring Understanding How Environmental Monitoring Works Table 38-2 Environmental Monitoring for Supervisor Engine and Switching Modules Component Supervisor engine temperature sensor exceeds major threshold1 Alarm Type Major LED Indication 2 STATUS LED red Action 3 Syslog message and SNMP trap generated. If redundancy, system switches to redundant supervisor engine and the active supervisor engine shuts down.
Chapter 38 Power Management and Environmental Monitoring Understanding How Environmental Monitoring Works Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
A P P E N D I X A Acronyms Table A-1 defines the acronyms used in this publication.
Appendix A Table A-1 Acronyms List of Acronyms (continued) Acronym Expansion CEF Cisco Express Forwarding CHAP Challenge Handshake Authentication Protocol CIR committed information rate CLI command-line interface CLNS Connection-Less Network Service CMNS Connection-Mode Network Service COPS Common Open Policy Server COPS-DS Common Open Policy Server Differentiated Services CoS class of service CPLD Complex Programmable Logic Device CRC cyclic redundancy check CRF concentrator re
Appendix A Acronyms Table A-1 List of Acronyms (continued) Acronym Expansion DTR data terminal ready DXI data exchange interface EAP Extensible Authentication Protocol EARL Enhanced Address Recognition Logic EEPROM electrically erasable programmable read-only memory EHSA enhanced high system availability EIA Electronic Industries Association ELAN Emulated Local Area Network EOBC Ethernet out-of-band channel EOF end of file ESI end-system identifier FAT File Allocation Table FEC
Appendix A Table A-1 Acronyms List of Acronyms (continued) Acronym Expansion ISL Inter-Switch Link ISO International Organization of Standardization ISR Integrated SONET router LAN local area network LANE LAN Emulation LAPB Link Access Procedure, Balanced LCP Link Control Protocol LDA Local Director Acceleration LEC LAN Emulation Client LECS LAN Emulation Configuration Server LEM link error monitor LER link error rate LES LAN Emulation Server LLC Logical Link Control LTL L
Appendix A Acronyms Table A-1 List of Acronyms (continued) Acronym Expansion NET network entity title NetBIOS Network Basic Input/Output System NFFC NetFlow Feature Card NMP Network Management Processor NSAP network service access point NTP Network Time Protocol NVRAM nonvolatile RAM OAM Operation, Administration, and Maintenance ODM order dependent merge OSI Open System Interconnection OSM Optical Services Module OSPF open shortest path first PAE port access entity PAgP Por
Appendix A Table A-1 Acronyms List of Acronyms (continued) Acronym Expansion RIB routing information base RIF Routing Information Field RMON remote network monitor ROM read-only memory ROMMON ROM monitor RP route processor or rendezvous point RPC remote procedure call RPF reverse path forwarding RSPAN remote SPAN RST reset RSVP ReSerVation Protocol SAID Security Association Identifier SAP service access point SCM service connection manager SCP Switch-Module Configuration P
Appendix A Acronyms Table A-1 List of Acronyms (continued) Acronym Expansion TCAM Ternary Content Addressable Memory TCL table contention level TCP/IP Transmission Control Protocol/Internet Protocol TFTP Trivial File Transfer Protocol TIA Telecommunications Industry Association TopN Utility that allows the user to analyze port traffic by reports TOS type of service TLV type-length-value TTL Time To Live TVX valid transmission UDLD UniDirectional Link Detection Protocol UDP User
Appendix A Acronyms Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
I N D E X using with WCCP Numerics 35-10 access port, configuring 4K VLANs (support for 4,096 VLANs) 802.10 SAID (default) 9-2 ACEs and ACLs 9-6 23-1, 24-1 IPX MLS, flow masks and 802.
Index See STP BackboneFast blocking state, STP CBAC 15-8 boot bootldr command boot command TACACS+ 3-26, 3-27 23-4 CDP configuration task lists 3-22 boot config command overview 3-27 30-3 30-1 3-27 cdp enable command description 3-25 CEF 30-2 17-1 configuring 3-27 boot loader image MSFC2 3-25, 3-27 boot system command BPDU guard 3-22 17-5 supervisor engine 3-21, 3-26 boot system flash command examples 17-5 17-3 Layer 3 switching packet rewrite See STP BPDU guard 17-2 1
Index clear counters command file, saving 6-18 clearing IPX MLS cache entries clear interface command 20-13 interfaces changing settings configuration 19-6 clear ipx route command IPX MLS restiction 3-23 3-21 to 3-24 settings at startup 3-22 configuration register boot field 20-5 clear mls command listing value clearing IP MLS cache entries 19-12 clear mls ip multicast statistics command clearing IP MMLS statistics 18-19 clear mls ipx command clear mls nde flow command 20-13 3-24 mo
Index IP MLS 19-6 E IP MMLS 18-7 IPX MLS 20-5 EHSA supervisor engine UDLD enable command 11-4 enable mode 8-5 default gateway, configuring default NDE configuration default VLAN 1-1 3-10, 3-23 2-5 enabling 3-12 IP MLS, on router interfaces 33-7 19-7 IP MMLS 7-10 denial of service protection 6-16 destination flow mask 20-3 destination-ip flow mask on router interfaces 24-1 description command 18-11 IPX MLS, on router interfaces enabling IP MLS encapsulation 19-3, 33-2 desti
Index DFC restriction, see CSCdt27074 in the Release Notes interface port-channel command example protocol See protocol filtering 13-7 interface port-channel (command) filters, NDE 13-7 lacp system-priority clearing command example 33-16 destination TCP/UDP port, specifying configuring 13-8 load balancing configuring overview 33-6 protocol 33-16 firewall 13-5 PAgP 23-4 configuration process Understanding loading system image from 13-5 port-channel load-balance command security pr
Index IPX MLS enabling 20-2 forward-delay time, STP Internet Group Management Protocol 15-32 forwarding information base 21-9 24-5 frame distribution join messages 21-1 21-2 leave processing See EtherChannel load balancing enabling queries 21-11 21-3 query interval G configuring gateway, configuring snooping 3-12 global configuration mode 21-11 fast leave 2-5 global parameters, configuring 3-3 21-5 joining multicast group 21-2 leaving multicast group 21-4 understanding H
Index maintaining by specific flow 6-17 monitoring 19-11 cache entries, displaying 6-17 19-9 naming 6-16 debugging, on switch 19-14 range of 6-4 default configuration 19-6 restarting disabling 6-19 shutting down task on router interface displaying interface configuration 6-19 interfaces command enabling 6-4 interfaces range macro command destination-ip 19-3, 33-2 destination-source-ip Internal Sub Tree Protocol Internet Group Management Protocol ip flow See IGMP ip-full 3-1
Index enabling cache, displaying on router interfaces flow mask all entries 18-11 by destination address 18-3 flows by source address completely and partially switched Layer 3 MLS cache overview 18-4 20-10 20-10 cache entries, displaying clearing cache entries 18-2 20-9 20-13 configuration guidelines 18-2 packet rewrite interaction with other features 18-3 router MTU displaying interface information enabling globally 20-6 default configuration on router interface 18-11 switch 1
Index ISTP CEF 15-15 17-2 Layer 3 switching CEF J 17-2 Layer 4 port operations (ACLs) join messages, IGMP jumbo frames 23-3 leave processing, IGMP 21-2 enabling 6-10 K 21-11 link negotiation 6-8 load balancing 15-15 logical operation unit keyboard shortcuts See LOU 2-3 loop guard See STP loop guard L LOU description LACP system ID 23-4 determining maximum number of 13-4 23-4 Layer 2 configuring interfaces access port trunk 7-8 defaults 7-5 7-7 M 7-14 MAC address addin
Index configuring IP MLS IGMP snooping and 33-11 mls flow command NetFlow statistics configuring IP MLS 19-8, 33-9, 33-10 mls flow ipx command configuring IPX MLS flow mask 18-11, 18-12, 18-13, 18-14 mls nde flow command configuring a host and port filter configuring a host flow filter configuring a port filter 33-16 33-16 22-1 21-12 multicast, displaying routing table mls nde src_address command 20-6 joining 21-2 leaving 21-4 18-16 multicast multilayer switching See IP MMLS multicast
Index source host and destination TCP/UDP port, specifying 33-16 multicast 33-1 overview 33-1 20-3 packets multicast 23-11 PAgP specifying understanding destination host filters 33-16 destination TCP/UDP port filters protocol filters 13-3 passwords 33-16 33-16 NDE configuration, default configuring enable password 33-7 enable secret NetFlow Data Export 3-15 3-15 line password See NDE 3-16 static enable password Network-Based Application Recognition network fault tolerance 15-15
Index configuration guidelines command 25-6 configuring command example initializing authentication of a client manual reauthentication of a client quiet period port cost, STP 25-11 disabling enabling 25-8 switch-to-authentication-server retransmission time 25-13 switch-to-client frame-retransmission number switch-to-client retransmission time 25-12 6-15 See STP PortFast 25-14 PortFast BPDU filtering See STP PortFast BPDU filtering port negotiation 6-8 15-27 ports secure 25-2 displaying
Index secondary VLANs with primary VLANs VLANs as private isolated VLANs QoS classification (definition) definition 10-2 32-4 receive queue community isolated and ToS final L3 Switching Engine values 10-1 definition 10-2 secondary VLANs 32-54 QoS default configuration privileged EXEC mode QoS definitions 2-5 privileges 32-25 32-3 QoS drop thresholds changing default see QoS congestion avoidance 3-18 configuring QoS DSCP multiple levels 3-17 definition privilege level 3-18 inte
Index QoS mapping configuring time interval CoS values to DSCP values DSCP markdown values QoS strict priority receive queue 32-66 and CoS final values from L3 Switching Engine 32-67 IP precedence values to DSCP values QoS markdown QoS marking size ratio configuring 32-13 QoS MSFC 32-54 QoS transmit queues 32-21, 32-60, 32-61 QoS trust-cos 32-9 QoS multilayer switch feature card port keyword 32-12 QoS OSM egress port feature summary port keyword 32-12 feature summary 32-11, 32-12 Q
Index displaying supervisor engine configuration EHSA redundancy (RPR+) configuring See redundancy (RPR+) 5-1 RSTP 5-6 configuring supervisor engine redundancy command 15-13 port states 5-8 15-14 5-6, 5-7 route processor redundancy plus redundancy command 4-3 related documentation xxiii reload command 15-15 port roles 5-5 displaying supervisor engine configuration 5-2 3-23 S SAID 9-6 sample configuration reserved-range VLANs 3-2 to 3-10 Sampled NetFlow See VLANs description re
Index show cdp traffic command show mls ip multicast statistics command 30-3 show ciscoview package command show ciscoview version command show configuration command show debugging command show eobc command show history command displaying IP MMLS configuration 6-16 18-17 show mls ip source command 30-3 displaying IP MLS source address 19-10 show mls ipx command 6-3 displaying IPX MLS cache entries 2-4 show mls nde command 6-18 show interfaces command 18-17 show mls ip multicast summary
Index SPAN command example configuration guidelines configuring overview 34-10 16-13, 16-14 16-13, 16-14 spanning-tree cost 15-29, 15-30 16-8 15-27, 15-28 spanning-tree uplinkfast command 16-12 spanning-tree vlan command 15-23, 15-25, 15-26, 15-27 spanning-tree vlan cost command 15-29 spanning-tree vlan forward-time command 15-32 command example 15-33 spanning-tree vlan hello-time command configuring 15-22 bridge priority 15-30 15-23, 15-24 forward-delay time hello time maximum ag
Index topology spanning-tree uplinkfast 15-5 STP BackboneFast and MST command command example 15-16 configuring 16-12 understanding 16-13 figure 16-12 16-3 strict-priority queue adding a switch see QoS strict priority 16-7 spanning-tree backbonefast command configuring 16-13, 16-14 command example understanding 16-13, 16-14 redundancy spanning-tree portfast bpdu-guard 16-6 3-12 configuring 4-2, 5-5 See SPAN STP PortFast switch fabric module 15-16 BPDU filter configuring spa
Index switchport mode trunk 7-4, 7-9 switchport nonegotiate 7-4 troubleshooting IP MLS switchport trunk allowed vlan 7-11 switchport trunk encapsulation 7-9 trunks allowed VLANs 7-4 configuring 7-13 switchport trunk encapsulation isl 7-6 7-11 7-8 default interface configuration 7-4 switchport trunk encapsulation negotiate default 7-2 802.
Index see QoS untrusted VLAN database mode configuring UplinkFast URD defaults 18-10 user EXEC mode 9-1 configuring (tasks) See STP UplinkFast 9-9 9-6 extended range 2-5 ID (default) 9-2 9-6 interface assignment V name (default) VACLs configuring 23-11 examples 23-16 9-2 private See private VLANs Layer 3 VLAN interfaces Layer 4 port operations 23-15 protocol filtering and reserved range 23-3 27-1 9-2 support for 4,096 VLANs logging configuration example configuring 23-17
Index VLANs 9-3 modes client 8-2 server 8-2 transparent monitoring 8-2 8-10 overview 8-1 pruning configuration configuring overview 7-12 8-7 8-3 server, configuring statistics 8-8 8-10 transparent mode, configuring 8-8 version 2 enabling overview 8-7 8-3 W WCCP configuring on a router service groups 35-2, 35-14 35-8 specifying protocol version web browser interface 35-7 1-1 Web Cache Communication Protocol See WCCP 35-1 web caches See cache engines web cache services description
Index Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.
