7.5. IES Services Command Reference for 7210 SAS-K 2F6C4T and 7210 SAS-K 3SFP+ 8C

This command enables the context to configure Internet Control Message Protocol (ICMP) parameters on an IES service.

This command enables responses to ICMP mask requests on the router interface.

If a local node sends an ICMP mask request to the router interface, the mask-reply command configures the router interface to reply to the request.

By default, the router instance replies to mask requests.

The no form of this command disables replies to ICMP mask requests on the router interface.

This command configures the rate for ICMP redirect messages issued on the router interface.

When routes are not optimal on this router and another router on the same subnetwork has a better route, the router can issue an ICMP redirect to alert the sending node that a better route is available.

The redirects command enables the generation of ICMP redirects on the router interface. The rate at which ICMP redirects are issued can be controlled with the optional number and seconds parameters by indicating the maximum number of redirect messages that can be issued on the interface for a specific time interval.

By default, the generation of ICMP redirect messages is enabled at a maximum rate of 100 per 10 second time interval.

The no form of this command disables the generation of ICMP redirects on the router interface.

This command configures the rate ICMP TTL expired messages are issued by the IP interface.

By default, generation of ICMP TTL expired messages is enabled at a maximum rate of 100 per 10 second time interval.

The no form of this command disables the limiting the rate of TTL expired messages on the router interface.

This command configures the rate for ICMP host and network destination unreachable messages issued on the router interface.

The unreachables command enables the generation of ICMP destination unreachables on the router interface. The rate at which ICMP unreachables are issued can be controlled with the optional number and time parameters by indicating the maximum number of destination unreachable messages that can be issued on the interface for a specific time interval.

By default, the generation of ICMP destination unreachable messages is enabled at a maximum rate of 10 per 60 second time interval.

The no form of this command disables the generation of ICMP destination unreachable messages on the router interface.

This command creates a SAP within a service. A SAP is a combination of port and encapsulation parameters that identify the service access point on the interface and within the router. Each SAP must be unique.

All SAPs must be explicitly created. If no SAPs are created within a service or on an IP interface, a SAP does not exist on that object.

Enter an existing SAP without the create keyword to edit SAP parameters. The SAP is owned by the service in which it was created.

A SAP can be associated with only a single service. A SAP can only be defined on a port that has been configured as an access port and access uplink port using the configure port port number ethernet mode access uplink command.

If a port is shut down, all SAPs on that port become operationally down. When a service is shut down, SAPs for the service are not displayed as operationally down although all traffic traversing the service will be discarded. The operational state of a SAP is relative to the operational state of the port on which the SAP is defined.

The no form of this command deletes the SAP with the specified port. When a SAP is deleted, all configuration parameters for the SAP are also deleted.

This command enables the context to configure DHCP parameters.

This command enables DHCP Option 82 (Relay Agent Information Option) parameters processing and enables the context for configuring Option 82 suboptions.

The no form of this command reverts the system to the default values.

This command configures the Relay Agent Information Option (Option 82) processing.

The no form of this command reverts to the default value.

This command configures the gateway interface address for the DHCP relay. A subscriber interface can include multiple group interfaces with multiple SAPs. The GI address is needed when the router functions as a DHCP relay to distinguish between the different subscriber interfaces and potentially between the group interfaces defined.

By default, the GI address used in the relayed DHCP packet is the primary IP address of a normal IES interface. Specifying the GI address allows the user to choose a secondary address.

This command configures the router to send an ASCII-encoded tuple in the circuit-id suboption of the DHCP packet.

To send a tuple in the circuit ID, the action replace command must be configured in the same context.

If disabled, the circuit-id suboption of the DHCP packet will be left empty.

The no form of this command reverts to the default value.

This command specifies what information goes into the remote ID suboption in the DHCP relay packet.

If disabled, the remote-id suboption of the DHCP packet will be left empty.

The no form of this command reverts to the default value.

This command configures the vendor-specific suboption of the DHCP relay packet.

This command enables the sending of the MAC address in the vendor-specific suboption of the DHCP relay packet.

The no form of this command disables the sending of the MAC address in the vendor-specific suboption of the DHCP relay packet.

This command sends the pool name in the vendor-specific suboption of the DHCP relay packet.

The no form of this command disables the sending.

This command enables the sending of the SAP ID in the vendor-specific suboption of the DHCP relay packet.

The no form of this command disables the sending of the SAP ID in the vendor-specific suboption of the DHCP relay packet.

This command enables the sending of the service ID in the vendor-specific suboption of the DHCP relay packet.

The no form of this command disables the sending of the service ID in the vendor-specific suboption of the DHCP relay packet.

This command specifies the string in the vendor-specific suboption of the DHCP relay packet.

The no form of this command reverts to the default value.

This command specifies whether the system ID is encoded in the vendor-specific suboption of Option 82.

This command enables the relaying of plain BOOTP packets.

The no form of this command disables the relaying of plain BOOTP packets.

This command specifies a list of servers where requests will be forwarded. The list of servers can be entered as either IP addresses or fully qualified domain names. There must be at least one server specified for DHCP relay to work. If there are multiple servers, the request is forwarded to all of the servers in the list.

A maximum of 8 DHCP servers can be configured.

This command enables relaying of untrusted packets.

The no form of this command disables the relay.

This command associates a Quality of Service (QoS) policy with an ingress SAP or IP interface.

QoS egress policies are important for the enforcement of SLA agreements. The policy ID must be defined before associating the policy with a SAP. If the policy-id does not exist, an error is returned.

The qos command is used to associate ingress policies. The qos command only allows egress policies to be associated on SAP egress. Attempts to associate a QoS policy of the wrong type returns an error.

Only one egress QoS policy can be associated with a SAP at one time. Attempts to associate a second QoS policy of a specific type returns an error.

By default, if no specific QoS policy is associated with the SAP for egress, the default QoS policy is used.

The no form of this command removes the QoS policy association from the SAP, and the QoS policy reverts to the default value.

This command specifies the aggregate rate for the SAP shaper. The aggregate SAP shaper is available to limit only the unicast traffic and the BUM traffic across all the FCs of the SAP configured to use ingress queues. Specify the CIR rate and the PIR rate. Users must not oversubscribe the total bandwidth available for use by ingress queues.

The no form of this command disables the use of the SAP aggregate rate shaper. That is, the SAP can use up the maximum bandwidth available.

This command specifies the aggregate rate for the SAP shaper. The aggregate SAP shaper is available to limit only the unicast traffic and the BUM traffic across all the FCs of the SAP configured to use ingress queues. Specify the CIR rate and the PIR rate. Users must not oversubscribe the total bandwidth available for use by ingress queues.

The no form of this command disables the use of SAP aggregate rate shaper. That is, the SAP can use up the maximum bandwidth available.

This command configures the access SAP ingress aggregate policer. The rate of the SAP ingress aggregate policer must be specified. Users can optionally specify the burst size for the SAP aggregate policer. The aggregate policer monitors the ingress traffic on different FCs using policers to rate-limit the flow and determines the final disposition of the packet. The packet is either forwarded to an identified profile or dropped.

Note: The sum of CIR of the individual FCs configured under the SAP cannot exceed the PIR rate configured for the SAP. Although the 7210 SAS software does not block this configuration, it is not recommended. The queued traffic flows are not limited by the aggregate meter. That is, only metered flows can use the aggregate meter. Queued flows can use only aggregate shaper.

Table 74 lists the final disposition of the packet based on the operating rate of the per-FC policer and the per-SAP aggregate policer.

The SAP ingress meter counters increment the packet or octet counts based on the final disposition of the packet.

The no form of this command removes the aggregate policer from use.

This command associates a QoS policy with an ingress SAP or IP interface.

QoS ingress policies are important for the enforcement of SLA agreements. The policy ID must be defined before associating the policy with a SAP. If the policy-id does not exist, an error is returned.

The qos command is used to associate ingress policies. The qos command only allows ingress policies to be associated on SAP ingress. Attempts to associate a QoS policy of the wrong type returns an error.

Only one ingress QoS policy can be associated with a SAP at one time. Attempts to associate a second QoS policy of a specific type returns an error.

By default, if no specific QoS policy is associated with the SAP for ingress, the default QoS policy is used.

The no form of this command removes the QoS policy association from the SAP, and the QoS policy reverts to the default value.

This command enables local proxy ARP. When local proxy ARP is enabled on an IP interface, the system responds to all ARP requests for IP addresses belonging to the subnet with its own MAC address, and therefore will become the forwarding point for all traffic between hosts in that subnet. When the local-proxy-arp command is enabled, ICMP redirects on the ports associated with the service are automatically blocked.

This command configures a local DHCP server. A local DHCP server can serve multiple interfaces but is limited to the routing context in which it was created.

This command specifies that the interface is a loopback interface that has no associated physical interface. As a result, the associated IES interface cannot be bound to a SAP.

You can configure an IES interface as a loopback interface by issuing the loopback command instead of the sap command. The loopback flag cannot be set on an interface where a SAP is already defined, and a SAP cannot be defined on a loopback interface.

This command configures the IP maximum transmit unit (MTU) (packet) for this interface.

Because this connects a Layer 2 to a Layer 3 service, this parameter can be adjusted under the IES interface.

The MTU that is advertised from the IES size is the following:

MINIMUM ((SdpOperPathMtu - EtherHeaderSize), (Configured ip-mtu))

By default (for Ethernet network interface) if no ip-mtu is configured, it is (1568 - 14) = 1554.

The no form of this command reverts to the default value.

This command creates or edits a Virtual Router ID (VRID) on the service IP interface. A VRID is internally represented in conjunction with the IP interface name. This allows the VRID to be used on multiple IP interfaces while representing different virtual router instances.

Two VRRP nodes can be defined on an IP interface. One, both, or none may be defined as an owner. The vrrp virtual-router-id context defines the configuration parameters for the VRID.

The no form of this command removes the specified VRID from the IP interface. This terminates VRRP participation for the virtual router and deletes all references to the VRID. The VRID does not need to be shut down to remove the virtual router instance.

This command assigns a simple text password authentication key to generate master VRRP advertisement messages and validate received VRRP advertisement messages.

The authentication-key command is one of the few commands not affected by the presence of the owner keyword. If simple text password authentication is not required, this command is not required. If the command is re-executed with a different password key defined, the new key is used immediately.

If a no authentication-key command is executed, the password authentication key is restored to the default value. The authentication-key command may be executed at any time, altering the simple text password used when authentication-type password authentication method is used by the virtual router instance. The authentication-type password command does not need to be executed before defining the authentication-key command.

To change the current in-use password key on multiple virtual router instances:

By default, the authentication data field contains the value 0 in all 16 octets.

The no form of this command restores the default null string to the value of key.

This command configures virtual router IP addresses for the interface.

This command enables the use of bidirectional forwarding (BFD) to control the state of the associated protocol interface. By enabling BFD on a specific protocol interface, the state of the protocol interface is tied to the state of the BFD session between the local node and the remote node. The parameters used for the BFD are set using the BFD command under the IP interface.

The no form of this command removes BFD from the associated BGP protocol peering.

This command configures a VRRP initialization delay timer.

This command allows the master instance to dictate the master down timer (non-owner context only).

This command sets the advertisement timer and indirectly sets the master down timer on the virtual router instance. The message-interval setting must be the same for all virtual routers participating as a virtual router. Any VRRP advertisement message received with an Advertisement Interval field different from the virtual router instance configured message-interval value will be silently discarded.

This command is available in both non-owner and owner vrrp virtual-router-id nodal contexts. If the message-interval command is not executed, the default message interval of 1 second is used.

The no form of this command reverts to the default value.

This command enables the non-owner master to reply to ICMP echo requests directed to the virtual router instance IP addresses. The ping request can be received on any routed interface.

Ping must not have been disabled at the management security level (either on the parental IP interface or based on the ping source host address). When ping reply is not enabled, ICMP echo requests to non-owner master virtual IP addresses are silently discarded.

Non-owner backup virtual routers never respond to ICMP echo requests regardless of the setting of ping reply configuration.

The ping-reply command is available only in non-owner vrrp virtual-router-id nodal context. If the ping-reply command is not executed, ICMP echo requests to the virtual router instance IP addresses are silently discarded.

The no form of this command reverts to the default operation of discarding all ICMP echo request messages destined to the non-owner virtual router instance IP addresses.

This command associates a VRRP priority control policy with the virtual router instance (non-owner context only).

This command provides the ability to override an existing non-owner master to the virtual router instance. Enabling preempt mode is recommended for correct operation of the base priority and VRRP policy ID definitions on the virtual router instance. If the virtual router cannot preempt an existing non-owner master, the affect of the dynamic changing of the in-use priority is greatly diminished.

The preempt command is available only in the non-owner vrrp virtual-router-id nodal context. The owner may not be preempted because the priority of non-owners can never be higher than the owner. The owner always preempts all other virtual routers when it is available.

Non-owner virtual router instances only preempt when preempt is set and the current master has an in-use message priority value less than the virtual router instance in-use priority.

A master non-owner virtual router allows itself to be preempted only when the incoming VRRP advertisement message priority field value is one of the following:

The no form of this command prevents a non-owner virtual router instance from preempting another, less desirable virtual router. Use the preempt command to revert to the default mode.

This command configures a specific priority value for the virtual router instance. In conjunction with an optional policy command, the base-priority is used to derive the in-use priority of the virtual router instance.

The priority command is available only in the non-owner vrrp virtual-router-id nodal context. The priority of owner virtual router instances is permanently set to 255 and cannot be changed. For non-owner virtual router instances, if the priority command is not executed, the base-priority is set to 100.

The no form of this command reverts to the default value of 100.

This command enables the non-owner master to reply to SSH requests directed at the virtual router instance IP addresses. The SSH request can be received on any routed interface. SSH must not have been disabled at the management security level (either on the parent IP interface or based on the SSH source host address). Proper login and CLI command authentication is still enforced.

When the ssh-reply command is not enabled, SSH packets to non-owner master virtual IP addresses are silently discarded. Non-owner backup virtual routers never respond to SSH regardless of the SSH reply configuration.

The ssh-reply command is available only in non-owner vrrp virtual-router-id nodal context. If the ssh-reply command is not executed, SSH packets to the virtual router instance IP addresses are silently discarded.

The no form of this command reverts to the default operation of discarding all SSH packets destined to the non-owner virtual router instance IP addresses.

This command allows the forwarding of packets by a standby router.

The no form of this command specifies that a standby router should not forward traffic sent to the virtual router MAC address. The standby router should forward traffic sent to the real MAC address of the standby router.

This command enables the non-owner master to reply to TCP port 23 Telnet requests directed at the virtual router instance IP addresses. The Telnet request can be received on any routed interface. Telnet must not have been disabled at the management security level (either on the parent IP interface or based on the Telnet source host address). Proper login and CLI command authentication is still enforced.

When the telnet-reply command is not enabled, TCP port 23 Telnet packets to non-owner master virtual IP addresses are silently discarded.

Non-owner backup virtual routers never respond to Telnet requests regardless of the telnet-reply configuration.

The telnet-reply command is available only in non-owner VRRP nodal context. If the telnet-reply command is not executed, Telnet packets to the virtual router instance IP addresses are silently discarded.

The no form of this command revert to the default operation of discarding all Telnet packets destined to the non-owner virtual router instance IP addresses.

This command enables a non-owner master to reply to traceroute requests directed to the virtual router instance IP addresses.

This command is valid only if the VRRP virtual router instance associated with this entry is a non-owner.

A non-owner backup virtual router never responds to such traceroute requests regardless of the traceroute reply status.