2.18. Card, MDA, and Port Command Reference

This command creates a text description for a configuration context to help identify the content in the configuration file.

The no form of this command removes any description string from the context.

This command administratively disables an entity. When disabled, an entity does not change, reset, or remove any configuration settings or statistics. The operational state of the entity is disabled as well as the operational state of any entities contained within.

The no form of this command administratively enables an entity.

This mandatory command enables the context to access the chassis card Input/Output Module (IOM), slot, and MDA CLI context.

The no form of this command cannot be used on fixed IOM and MDA cards that are auto equipped and auto provisioned. The IOM card is equipped and provisioned for slot 1.

This mandatory command adds a card type to the device configuration for the slot. The card type can be preprovisioned, meaning that the card does not need to be installed in the chassis.

A card must be provisioned before an MDA or port can be configured.

A card can only be provisioned in a slot that is vacant, meaning no other card can be provisioned (configured) for that particular slot.

A card can only be provisioned in a slot if the card type is allowed in the slot. An error message is generated if an attempt is made to provision a card type that is not allowed.

A high severity alarm is raised if an administratively enabled card is removed from the chassis. The alarm is cleared when the proper card type is installed or the configuration is modified. A low severity trap is issued when a card is removed that is administratively disabled.

An appropriate alarm is raised if a partial or complete card failure is detected. The alarm is cleared when the error condition ceases.

The no form of this command cannot be used as the card is fixed.

This mandatory command enables the MDA CLI context to configure MDAs.

This mandatory command provisions a specific MDA type to the device configuration for the slot. The MDA can be preprovisioned but an MDA must be provisioned before ports can be configured. Ports can be configured when the MDA is properly provisioned.

7210 SAS-D and 7210 SAS-Dxp (all platform variants) support only a fixed MDA. These platforms do not support an expansion slot. The fixed MDA (addressed as mda 1) is auto-equipped and auto-provisioned on bootup. It cannot be deleted.

The no form of this command displays an error message if performed on fixed MDAs.

This command enables Synchronous Ethernet on the Ethernet ports that support Synchronous Ethernet. When Synchronous Ethernet is enabled, the timing information is derived from the Ethernet ports.

Synchronous Ethernet is supported for both Ethernet SFP ports and fixed copper ports.

Refer to the 7210 SAS-D, Dxp, K 2F1C2T, K 2F6C4T, K 3SFP+ 8C Basic System Configuration Guide for more information about Synchronous Ethernet.

The no form of this command disables Synchronous Ethernet on the MDA.

Commands in this context configure QoS policy parameters on an access port.

Commands in this context configure QoS policy parameters on an access-uplink port.

Commands in this context configure QoS egress policy parameters for the access port on 7210 SAS-D and 7210 SAS-Dxp, and for the access-uplink port on 7210 SAS-D, 7210 SAS-Dxp, 7210 SAS-K 2F1C2T, 7210 SAS-K 2F6C4T, and 7210 SAS-K 3SFP+ 8C respectively.

This command configures pool policies.

Note: The default pool cannot be modified, deleted or created.

This command specifies an existing slope policy which defines high and low priority RED slope parameters. The policy is defined in the config>qos>slope-policy context.

This command associates a access-egress QoS policy to the access port.

The no form of this policy removes the explicit association of a user configured QoS policy and associates a default QoS policy with the port.

This command associates a network QoS policy with the access-uplink port.

This command specifies the network egress aggregate shaper rate for port queues. The shaper value limits the maximum bandwidth that port queues can receive from the total port bandwidth, with remaining port bandwidth shared by SAPs on the port. This command is only supported on hybrid ports.

The no form of this command removes the configured egress aggregate shaper rate.

This command associates a network QoS policy to a network port.

This command configures ports. Before a port can be configured, the chassis slot must be provisioned with a valid card type and the MDA parameter must be provisioned with a valid MDA type. (See card and mda commands.) All ports must be explicitly configured and enabled

This command enables DEI-based classification on access ports, network ports, access-uplink or hybrid ports.

If enabled, DEI value in the Ethernet packet header is used to determine the initial profile/color of the packet when the meter/policer used to police the FC is configured in color-aware mode. If the meter used to police the FC is configured in color-blind mode, then the DEI value of the packet has no effect. When in color-aware mode, DEI value of 0 is interpreted as in-profile or green packet and DEI value of 1 is interpreted as out-of-profile or yellow packet. In color-aware mode, the following behavior is accorded to packets classified with initial profile/color as in-profile/green and out-of-profile/yellow:

That is, in color-aware mode, yellow/out-of-profile packets cannot eat into the CIR bandwidth. It is exclusively reserved for green/in-profile packets.

The final profile assigned at ingress is used by egress to determine the WRED slope to use. The WRED slope determines whether the packet is eligible to be assigned a buffer and can be queued up on egress queue for transmission.

See the 7210 SAS-D, Dxp Quality of Service Guide for more information.

This command configures the scheduling behavior to the one specified in the policy (Strict, RR, WRR, WDRR, WRR/WDRR + Strict).

The no form of this command removes the policy from the port and makes the scheduling scheme of the port to strict.

This command configures an Ethernet port for access mode, access-uplink mode, hybrid mode, or network mode of operation.

The following modes are supported on the 7210 SAS platforms:

The functionality of the different modes is as follows:

The no form of this command reverts to the default value.

This command specifies the operational group to be monitored by the object under which it is configured. The oper-group name must be already configured under the config>system context before its name is referenced in this command.

The no form of this command removes the association from the configuration.

This command assigns a specific MAC address to an Ethernet port, Link Aggregation Group (LAG).

Only one MAC address can be assigned to a port. When multiple mac commands are entered, the last command overwrites the previous command. When the command is issued while the port is operational, IP will issue an ARP, if appropriate, and BPDUs are sent with the new MAC address. A default MAC address is assigned by the system from the chassis MAC address pool.

The no form of this command reverts the MAC address to the default value.

This command configures the maximum transmission unit (MTU) size for an Ethernet port. The Ethernet port level MTU parameter indirectly defines the largest physical packet the port can transmit or the far-end Ethernet port can receive. Packets received that are larger than the MTU value are discarded. Packets that cannot be fragmented at egress and exceed the MTU are discarded.

The value specified for the MTU includes the destination MAC address, source MAC address, the Ethertype or Length field and the complete Ethernet payload. The MTU value does not include the preamble, start of frame delimiter, or the trailing CRC.

The no form of this command reverts to the default values.

This command enables Precision Time Protocol (PTP) port-based hardware timestamping on the port in both egress and ingress directions. For more information about PTP port-based hardware timestamping, including configuration guidelines, refer to the 7210 SAS-D, Dxp, K 2F1C2T, K 2F6C4T, K 3SFP+ 8C Basic System Configuration Guide.

The no version of this command disables PTP port-based hardware timestamping on the port.

This command specifies the port to assign for system use when using port loopback or for the mac-swap, mirroring, or testhead OAM tools. The system utilizes the resources of the port and the port is not available for configuring services.

The user cannot share a single port between multiple tools or applications if they intend to use the tools simultaneously. The system displays an error if the user tries to configure the same port for use with multiple OAM tools or if the user tries to use the tool without first configuring the port resources to be used by the tool.

The system verifies if any services are configured on the port specified with this command and if services are configured the command fails.

The no form of this command disables the use of this port by the specified OAM tool.

Note: On 7210 SAS-Dxp, this command must be used and the user needs to dedicate one front-panel port for use with the mirroring applications. On 7210 SAS-D (ETR and non-ETR variants), the user can use the 3 available internal ports (that is, port 1/1/11, 1/1/12, and 1/1/13) for use with either mac-swap or mirroring or testhead OAM tool. The user does not need to use this command and the internal port resources are automatically allocated to the ports by software to different OAM tools. On 7210 SAS-Dxp, the three internal ports (ports 1/1/13, 1/1/14, and 1/1/15) can be used for mac-swap, mirroring, or testhead OAM tools. Port 1/1/13 is a 1GE port and is recommended for applications with traffic up to 1Gbps. Ports 1/1/14 and 1/1/15 are 10GE ports and are recommended for applications with traffic greater than 1Gbps but less than 10Gbps. The loopback-no-svc-port command must be used to associate the port resources with the applications. A port can be used with a single application and cannot be shared by multiple applications.

This command enables the context for MACsec configuration. The MACsec MKA profile can be configured in this context.

This command configures a connectivity association (CA). MACsec CAs are applied to a port dot1x configuration to enable MACsec on that port.

The no form of this command removes the CA.

This command configures encryption of datapath PDUs. When all parties in the CA have the SAK, they use the cipher-suite algorithm in conjunction with the SAK to encrypt the datapath PDUs.

The no form of this command disables encryption of datapath PDUs.

This command puts 802.1Q tags in clear before SecTAG. The following modes are available: single-tag and dual-tag.

The no form of this command puts all dot1q tags after SecTAG and encrypts the tags.

Table 27 describes the encrypted dot1q and QinQ packet format when clear-tag-mode (single-tag or dual-tag) is configured.

This command enters a description for the CA.

The no form of this command removes the CA description.

This command specifies the offset of the encryption in MACsec packets.

The encryption-offset is distributed by MKA to all parties and is signaled via MACsec capabilities.

Table 28 describes the basic settings.

The no form of this command rejects all arriving traffic regardless of whether it is MACsec-secured.

This command enables encryption and authentication (ICV payload) for all PDUs.

The no form of this command specifies that all PDUs are transmitted with clear text but still authenticated and have the trailing ICV.

Specifies the size of the replay protection window.

This command must be configured to force packet discard when the system detects a packet that is not within the parameters configured for the replay-window-size command.

When this command is enabled, the sequence of the ID number of the received packets is checked. If the packet arrives out of sequence, and the difference between the packet numbers exceeds the replay window size, the packet is counted by the receiving port and then discarded; for example, if the replay protection window size is set to five and a packet assigned the ID of 1006 arrives on the receiving link immediately after the packet assigned the ID of 1000, the packet that is assigned the ID of 1006 is counted and discarded because it falls outside the parameters of the replay-window-size command.

Replay protection is especially useful for fighting man-in-the-middle attacks. A packet that is replayed by a man-in-the-middle attacker on the Ethernet link arrives on the receiving link out of sequence, so replay protection helps ensure the replayed packet is dropped instead of forwarded through the network.

Note: Replay protection should not be enabled in cases where packets are expected to arrive out of order.

This command specifies the size of the replay protection window.

This command must be configured to enable the replay-protection command.

When the number-of-packets parameter is set to 0, all packets that arrive out of order are dropped.

The no form of this command reverts to the default value.

This command shuts down the CA profile. All ports using this profile do not transmit PDUs, because this command shuts down MACsec for this profile.

The no form of this command enables the CA profile.

Commands in this context configure a Connectivity Association Key (CAK). A CAK is responsible for managing the MKA.

This command specifies which pre-shared key is the active transmitting pre-shared key. If there are two pre-shared keys configured, the arriving MACsec MKA can be decrypted using CAKs of both pre-shared keys; however, only the active PSK is used for Tx encryption of MKA PDUs.

This command specifies the key server priority used by the MKA protocol to select the key server when MACsec is enabled using static CAK security mode.

The no form of this command disables this command.

This command specifies the pre-shared key used to enable MACsec using static CAK security mode. This command also specifies the encryption algorithm used for encrypting the SAK.

A pre-shared key includes a connectivity association key name (CKN) and a CAK. The pre-shared key (the CKN and CAK) must match on both ends of a link.

A pre-shared key is configured on both devices at each end of a point-to-point link to enable MACsec using static CAK security mode. The MKA protocol is enabled after the successful MKA liveliness negotiation.

The encryption-type parameter is used for encrypting SAK and authentication of the MKA packet. The symmetric encryption key SAK needs to be encrypted (wrapped) using the above protocols. The AES key is derived using the pre-shared key.

The no form of this command removes the index.

Specifies the CAK for a pre-shared key. The following values are derived from CAK:

The no form of this command removes the value.

This command specifies the CKN for a pre-shared key.

CKN is appended to the MKA for identification of the CAK by the peer.

The no form of this command removes the CKN.

Commands in this context configure access parameters.

This context can only be used when configuring Ethernet LAN ports on an appropriate MDA.

This command enables speed and duplex autonegotiation on Fast Ethernet ports and enables far-end fault indicator support on gigabit ports.

There are three possible settings for autonegotiation:

When autonegotiation is enabled on a port, the link attempts to automatically negotiate the link speed and duplex parameters. If autonegotiation is enabled, the configured duplex and speed parameters are ignored.

When autonegotiation is disabled on a port, the port does not attempt to autonegotiate and will only operate at the speed and duplex settings configured for the port. Note that disabling autonegotiation on gigabit ports is not allowed as the IEEE 802.3 specification for gigabit Ethernet requires autonegotiation be enabled for far end fault indication.

If the autonegotiate limited keyword option is specified, the port will autonegotiate but will only advertise a specific speed and duplex. The speed and duplex advertised are the speed and duplex settings configured for the port. One use for limited mode is for multispeed gigabit ports to force gigabit operation while keeping autonegotiation enabled for compliance with IEEE 801.3.

7210 SAS requires that autonegotiation be disabled or limited for ports in a Link Aggregation Group to guarantee a specific port speed.

The no form of this command disables autonegotiation on this port.

This command configures the connection type on the Ethernet combo port. The combo port provides two physical interface options to the user, SFP or copper. This command lets the user specify the physical interface that will be used.

When configured as SFP port it allows for fiber based connectivity with the flexibility of using suitable optics for longer reach. When configured as a fixed copper port it provides cheaper connectivity for shorter reach. The SFP port support 100/1000 speeds and the copper port can support 10/100/1000Mbps speed.

When configured as 'auto', software will attempt to detect the type of interface in use based on whether the copper cable is plugged in or the SFP optic is plugged in. It is not allowed to plug in copper cable and SFP optics into the Ethernet combo port at the same time.

When combo port is used for SyncE, the connection type has to be set to either sfp or copper. SyncE is not supported with connection-type as auto.

The combo port can be configured either as a SFP port or a copper port or set for automatic detection. That is, both the interfaces cannot be used simultaneously (even when 'auto' is set, software selects one of the ports based on the interface plugged in).

This command configures Ethernet CRC Monitoring parameters.

This command specifies the error rate at which to declare the Signal Failure condition on an Ethernet interface.

The value represents a ratio of errored frames over total frames received over seconds of the sliding window. The CRC errors on the interface are sampled once per second. A default of 10 seconds is used when there is no additional window-size configured. The multiplier keyword is optional.

The no form of this command reverts to the default value of 1. If the multiplier keyword is omitted, the multiplier will return to the default value of 1.

This command specifies the error rate at which to declare the Signal Degrade condition on an Ethernet interface.

The value represents a ratio of errored frames over total frames received over seconds of the sliding window. The CRC errors on the interface are sampled once per second. A default of 10 seconds is used when there is no additional window-size configured.

The no form of this command reverts to the default value of 1. If the multiplier keyword is omitted, the multiplier will return to the default value of 1.

This command specifies sliding window size over which the Ethernet frames are sampled to detect signal fail or signal degrade conditions. The command is used jointly with the sf-threshold and the sd-threshold to configure the sliding window size.

This command brings a port operationally down in the event the systems has detected internal max transmit errors.

This command specifies the Ethertype expected when the port's encapsulation type is dot1q. Dot1q encapsulation is supported only on Ethernet interfaces.

When the dot1-etype is configured to a value other than 0x8100 (the default value) on a port, the outermost tag in the received packet is matched against the configured value and if there is a match then it is treated as a Dot1q packet and the VLAN ID is used to match against the configured Dot1q SAPs on the port to find the Dot1q SAP the packet should be matched to.

Note: This command does not change the etype used to match the inner tag for a QinQ SAP. The 7210 SAS devices always uses 0x8100 for matching the inner tag etype. That is, if this command is configured on a port configured for QinQ encapsulation, then it is ignored and 0x8100 is used always. This command is supported only for access ports and hybrid ports. On hybrid ports, it applies to all traffic (that is, traffic mapped to SAPs and network IP interfaces). It is not supported for network ports. Dot1q-preserve SAPs cannot be configured on dot1q encap ports configured to use Ethertype other than 0x8100. Priority tagged packet received with etype 0x8100 on a dot1q port configured with etype 0x9100 is classified as a priority tagged packet and mapped to a dot1q:0 SAP (if configured) and the priority tag is removed. Priority tagged packets received with etype 0x6666 (any value other than 0x8100) on a dot1q port configured with etype 0x9100 is classified as null-tagged packet and mapped to a dot1q:0 SAP (if configured) and the priority tag is retained and forwarded as expected. The maximum number of unique dot1q-etypes configurable per node is limited. The resources needed for configuration of dot1q-etype is shared by the default dot1q-etype, default qinq-etype and user configured values for qinq-etype. That is, the number of unique dot1q-etypes allowed decreases, if the number of unique qinq-etype configured is more. The converse is also true.

The no form of this command reverts the dot1q-etype value to the default.

This command enables the context for the configuration of the duplex mode of a Fast Ethernet port. If the port is configured to autonegotiate, this parameter is ignored.

This command configures the rate of traffic leaving the network.

The no form of this command reverts to the default value.

Note: For 7210 SAS-D and 7210 SAS-Dxp devices, the max-burst parameter configures a maximum-burst (in kilobits) associated with the egress-rate. This is an optional parameter; if not defined then, by default, it is set to 64 kbits for a 1G port and 98 kbits for a 10G port. The user cannot configure max-burst without configuring egress-rate. 7210 SAS-D devices do not support 10G ports. See the 7210 SAS-D, Dxp Quality of Service Guide for more information.

Commands in this context configure EFM-OAM attributes.

This command enables reactions to loopback control OAM PDUs from peers.

The no form of this command disables reactions to loopback control OAM PDUs.

This command configures the mode of OAM operation for this Ethernet port. These two modes differ in that active mode causes the port to continually send out efm-oam info PDUs while passive mode waits for the peer to initiate the negotiation process. A passive mode port cannot initiate monitoring activities (such as loopback) with the peer.

This command configures the transmit interval of OAM PDUs.

The minimum efm-oam session time-out value supported is 300 milliseconds. That is, user can configure transmit-interval 1 multiplier 3 as the minimum value. This is applicable to all platforms except for the 7210 SAS-D. On the 7210 SAS-D, the minimum transmit interval is 500 msec and multiplier is 4.

This command enables EFM OAM PDU tunneling. Enabling tunneling will allow a port mode Epipe SAP to pass OAM frames through the pipe to the far end.

The no form of this command disables tunneling.

This command configures the encapsulation method used to distinguish customer traffic on an Ethernet access port, or different VLANs on a port.

Note: On the 7210 SAS-D ETR, 7210 SAS-Dxp, 7210 SAS-K 2F1C2T, 7210 SAS-K 2F6C4T, and 7210 SAS-K 3SFP+ 8C, the qinq encapsulation type can be configured for both access and access-uplink ports. The null and dot1q encapsulation types can be specified only for access ports. On the 7210 SAS-K 2F6C4T and 7210 SAS-K 3SFP+ 8C, the null and dot1q encapsulation types can be specified for network ports. The dot1q and qinq encapsulation types can be specified for hybrid ports.

The no form of this command reverts to the default.

This command allows rate changes received in ETH-BN messages on a port-based MEP to update the egress rate used on the port. The egress rate is capped by the minimum of the configured egress-rate and the maximum port rate.

The no form of this command reverts to the default value.

Commands in this context configure 802.1ag CFM parameters.

This command provisions the maintenance endpoint (MEP).

The no form of this command removes the configuration.

Commands in this context configure ETH-BN message handling.

This command enables the reception and processing of eth-bn messages, and the retrieval and processing of the current bandwidth field for inclusion in dynamic egress rate adjustments.

The received rate is a Layer 2 rate, and is expected to be in Mb/s. If this rate is a link rate (including preamble, start frame delimiter, and inter-frame gap), it requires the configuration of frame-based accounting in the config>port>ethernet context.

The no form of this command disables the reception and processing of ETH-BN messages.

This command sets the pace for update messages to and from the eth-cfm subsystem to the QoS subsystem. The most recent update messages are held by the ETH-CFM subsystem, but the most recent update is held until the expiration of the pacing timer.

This command configures per port frame-based accounting. It can be enabled or disabled on each port. When enabled, all the shapers rates and queues statistics on that port also account for the Ethernet Layer 1 overhead (of 20 bytes) in both ingress and egress direction. That is all ingress queue shaper rates, egress queue shaper rates and aggregate SAP shaper rate account for the ethernet overhead.

The no form of this command disables frame-based-accounting.

This command configures port link dampening timers which reduce the number of link transitions reported to upper layer protocols. The hold-time value is used to dampen interface transitions.

When an interface transitions from an up state to a down state, it is immediately advertised to the rest of the system if the hold-time down interval is zero, but if the hold-time down interval is greater than zero, interface down transitions are not advertised to upper layers until the hold-time down interval has expired. Likewise, an interface is immediately advertised as up to the rest of the system if the hold-time up interval is zero, but if the hold-time up interval is greater than zero, up transitions are not advertised until the hold-time up interval has expired.

The no form of this command reverts to the default values.

This command enables LACP packet tunneling for the Ethernet port. When tunneling is enabled, the port will not process any LACP packets but will tunnel them instead. The port cannot be added as a member to a LAG group.

The no form of this command disables LACP packet tunneling for the Ethernet port.

This command associates the context to which it is configured to the operational group specified in the group-name. The oper-group group-name must be already configured under config>system context before its name is referenced in this command.

The no form of this command removes the association.

This command configures the Ethertype used for Q-in-Q encapsulation.

When the qinq-etype is configured to a value other than the default value on a port, the outermost tag in the received packet is matched against the configured value and the inner tag's etype is matched against the default value. If there is a match, it is treated as a QinQ packet and the outer VLAN ID and inner VLAN ID is used to match against the configured Q1.Q2 SAPs on the port to find the QinQ SAP the packet should be matched to. If only the outermost tag's etype matches the qinq-etype configured on the port and the VLAN ID matches any of the Q1.* SAP configured on the port, the packet is processed in the context of that SAP. If the outermost tag's etype does not match the configured qinq-etype, then the packet is considered to be a untagged packet.

Note: This command is supported only for access ports and hybrid ports. On hybrid ports, it applies to all traffic (that is, traffic mapped to SAPs and network IP interfaces). It is not supported for network ports. The maximum number of unique qinq-etypes configurable per node is limited. The resources needed for configuration of qinq-etype is shared by the default dot1q-etype, default qinq-etype and user configured values for qinq-etype. That is, the number of unique dot1q-etypes allowed decreases if the number of unique qinq-etype configured is more. The reverse is also true. The qinq-etype change is not allowed on hybrid port, if there is an interface or a SAP configured on the port.

The no form of this command reverts the qinq-etype value to the default value. The default value is not user configurable.

Commands in this context configure the counters associated with the egress port.

Commands in this context configure egress per queue statistics counter, which counts the total number of packets forwarded.

This command forces the copper port to be a master or slave or set it for automatic detection. Using a value of master ensures that the local node is the SyncE master. A SyncE master port distributes the system timing over the copper port to the remote peer node. Using a value of slave ensures that the local node is a SyncE slave. A SyncE slave port uses the incoming timing information.

With copper ports using 1G speed, the nodes need to determine who will be the master and slave with respect to clock used for transmission and reception. The master-slave relationship between the two ports of the nodes is determined during autonegotiation of the link parameters and is automated; there is no management intervention in this process. When this process is complete, the master port transmit clock will be used for receiving the packets on the slave port. However, when SyncE is in use, to maintain clock distribution hierarchy (for example, master will be synchronized to a stable reference and will distribute this clock to the slave) one needs to make sure that one of the ports behave as a master while the remote port of the link in question behaves as a slave.

For copper ports, when port-clock is set to automatic, the Ethernet interface will automatically negotiate clock mastership along with other link parameters with the far end. Depending upon the capabilities of the two ends, one will be master the other will be slave for clocking.

Note: This command is ignored for all ports, other than copper ports that support SyncE.

The no form of this command allows the node to automatically determine the master or slave status for the copper port based on the nodes capabilities exchanged during auto-negotiation. That is, depending on the peer setting, the local end could end up as either a master or a slave when the no form of this command is used.

The following conditions must be met before using SyncE on the fixed port copper ports:

This command configures the port speed of a fast Ethernet port when autonegotiation is disabled. If the port is configured to autonegotiate, the speed parameter is ignored. Speed cannot be configured for ports that are part of a LAG.

Note: On the 7210 SAS-Dxp, the 10 Mb/s port speed is not supported for an SFP port using a copper SFP.

This configures simple port loopback and port loopback with MAC swap. When the optional parameter internal is specified, it provides the port loopback without the mac-swap functionality. It enables physical layer loopback of the packets that egress on the SAPs created on an Ethernet port. The packets that egress are looped back into the node instead of being transmitted on to the line. After loopback, the packets ingress the system and are mapped to the same SAP from which they were egressed. The packets that are looped back are processed as per the service configuration of the SAP.

Note: The 7210 SAS-K 2F1C2T, 7210 SAS-K 2F6C4T, and 7210 SAS-K 3SFP+ 8C only support port loopback without MAC swap (that is, only the config>port>ethernet> loopback internal command applies). Port loopback with MAC swap is not supported on these platforms.

This command, when used with service-id and MAC address, provides the port loopback with mac-swap functionality. It enables a physical layer loopback, so that packets which egress on the SAPs created on an Ethernet port are looped back into the system. After loopback, on ingress to the system, the MAC addresses in the Ethernet header are swapped (that is the source MAC address and destination MAC address is exchanged with each other) by the system before being processed as per the service configuration of the SAP.

On 7210 SAS platforms, use of port loopback with mac-swap, requires resources of another port to be assigned for system use. Users need to assign the resources of either internal virtual port or the resource of the front panel port for use with this OAM tool using the command configure> system> loopback-no-svc-port {mirror | mac-swap| testhead} port-id. The number of internal virtual port resources available for use is different for different platforms and can be obtained using the command show> system> internal-loopback-ports detail. Based on the number of internal virtual port resources and the use of other OAM tool that require the resources of another port, the user might need to assign the resources of a front-panel port if the internal virtual port resources are not available.

Note: Port loopback without mac-swap does not require another port to be assigned for system use on any of the 7210 SAS platforms.

The following information describes guidelines for port loopback without mac-swap.

The following information describes guidelines for port loopback with mac-swap.

The recommended procedure for using port loopback with mac-swap is:

The no form of this command disables physical layer loopback on the Ethernet port.

Note: The loopback command is not saved in the configuration file across a reboot.

The following list is the recommended sequence of commands to be executed to perform loopback:

Enable the port, execute the command config>port> no shutdown.Enable the required services. The following list is the recommended sequence of commands to be executed to perform loopback when SFP or XFPs are inserted into the device:

The following list is the sequence of commands to be executed to perform loopback when SFP or XFPs are changed:

This command enables Ethernet Synchronous Status Message (SSM) capability on a synchronous Ethernet port. Synchronous Ethernet must be enabled on the MDA (using the sync-e command) before SSM can be enabled.

This command configures the encoding of synchronous status messages, that is, to select either SDH or SONET set of values. Configuring the code-type is only applicable to Synchronous Ethernet ports. It is not configurable on TDM ports. For the code-type, SDH refers to ITU-T G.781 Option-1,while SONET refers to G.781 Option 2 (equivalent to Telcordia GR-253-CORE).

This command forces the QL value transmitted from the SSM channel of the SONET/SDH port or the Synchronous Ethernet port to be set to QL-DUS/QL-DNU. This capability is provided to block the use of the interface for timing purposes from the 7210 SAS.

Commands in this context configure port-specific 802.1x authentication attributes. This context can only be used when configuring Fast Ethernet, Gigabit Ethernet, or 10-Gigabit Ethernet LAN ports on an appropriate MDA.

This command enables MAC-based authentication. To use MAC-based authentication, 802.1x authentication must first be enabled using the port-control auto command.

When MAC-based authentication is enabled, and the mac-auth-wait timer expires, the 7210 SAS begins listening on the port for valid Ethernet frames. The source MAC address of a received frame is used for MAC-based authentication.

MAC authentication and Dot1x authentication or VLAN authentication are mutually exclusive and cannot be configured on the same port.

The no form of this command disables MAC-based authentication.

This command configures the delay period before MAC authentication is activated.

The no form of this command disables the delay and allows MAC authentication to be used immediately.

This command configures the maximum number of times that the 7210 SAS will send an access request RADIUS message to the RADIUS server. If a reply is not received from the RADIUS server after the specified number attempts, the 802.1x authentication procedure is considered to have failed.

The no form of this command reverts to the default value.

This command configures the 802.1x authentication mode.

The no form of this command reverts to the default value.

This command configures the period between two authentication sessions during which no EAPOL frames are sent by the 7210 SAS.

The no form of this command reverts to the default value.

This command configures the RADIUS policy to be used for 802.1x authentication. An 802.1x RADIUS policy must be configured (under config>security>dot1x) before it can be associated to a port. If the RADIUS policy-id does not exist, an error is returned. Only one 802.1x RADIUS policy can be associated with a port at a time.

The no form of this command removes the RADIUS policy association.

This command configures the period after which re-authentication is performed. This value is only relevant if re-authentication is enabled.

The no form of this command reverts to the default value.

This command enables or disables periodic 802.1x re-authentication.

When re-authentication is enabled, the 7210 SAS will re-authenticate clients on the port every re-auth-period seconds.

The no form of this command reverts to the default value.

This command configures the period during which the 7210 SAS waits for the RADIUS server to responds to its access request message. When this timer expires, the 7210 SAS will re-send the access request message, up to the specified number times.

The no form of this command reverts to the default value.

This command configures the period during which the 7210 SAS waits for a client to respond to its EAPOL messages. When the supplicant-timeout expires, the 802.1x authentication session is considered to have failed.

The no form of this command reverts to the default value.

This command configures the period after which the 7210 SAS sends a new EAPOL request message.

The no form of this command reverts to the default value.

This command enables tunneling of dot1x frames. With dot1x tunneling enabled, dot1x frames received on the port are transparently forwarded to the remote end of the service. To forwards dot1x frames transparently the port on which tunneling is enabled must be configured with NULL SAP and the NULL SAP must be configured in an Epipe service. Tunneling is not supported for any other port encapsulation or when using any other service.

Additionally, dot1x protocol must be disabled on the port (using the command configure> port> ethernet> dot1x> port-control force-auth) before dot1x tunneling can be enabled using this command. If dot1x is configured to use either force-unauath or auto, then dot1x tunneling cannot be enabled. If dot1x tunneling is enabled, then the user cannot configure either force-unauth or auto.

The no form of this command disables dot1x tunneling.

This command enables VLAN-based authentication. To use VLAN-based authentication, 802.1x authentication must first be enabled using the port-control auto command.

When VLAN-based authentication is enabled, all traffic for all VLANs on the port is blocked. VLAN-tagged EAPOL messages are forwarded to the RADIUS server for authentication. If authentication is successful, the VLAN corresponding to the successfully authenticated VLAN-tagged EAPOL message is unblocked and traffic is processed for the configured service. If authentication fails, the VLAN continues to be blocked.

VLAN authentication and MAC authentication are mutually exclusive and cannot be configured on the same port.

The no form of this command disables VLAN-based authentication.

This command configures Ethernet loop detection attributes.

This command configures the time interval between keep-alive PDUs.

This command configures the minimum wait time before re-enabling the port after loop detection.

This command configures MACsec functionality for the port.

Note: When MACsec is configured on an Ethernet port, the oper MTU of the port is reduced by 32 bytes; for example, a configured MTU of 9212 results in an oper MTU of 9180 for a MACsec-enabled port. When a service or IP interface uses a MACsec-enabled port, an appropriate MTU value must be manually configured.

The no form of this command disables MACsec functionality for the port.

This command configures the CA linked to the MACsec port. The CA provides the MACsec parameter that is used or is negotiated with other peers.

The no form of this command removes the CA from the MACsec port.

This command configures the destination MAC address of the EAPoL to the unicast address of the MACsec peer, so that the EAPoL and MKA signaling is unicast between two peers.

The EAPoL destination MAC address uses a destination multicast MAC address of 01:80:C2:00:00:03. Some networks cannot tunnel these packets over the network or consume them, causing the MKA session to fail.

The no form of this command reverts to the default value.

This command configures the protocols for which packets are not secured with MACsec when MACsec is enabled on a port. When this command is enabled in a CA that is attached to an interface, MACsec is not enabled for all packets of the specified protocols that are sent and received on the link.

When this command is enabled on a port where MACsec is configured, packets of the specified protocols are sent and received in clear text.

This command configures the maximum number of peers allowed for the specified MACsec instance.

Note: The peer establishment is a race condition and operates on a first-come-first-served basis. For a security zone, only 32 peers are supported.

The no form of this command reverts to the default value.

This command specifies that all non-MACsec-secured traffic that is received on the port is dropped.

When this command is disabled, all arriving traffic is accepted, regardless of whether traffic is MACsec-secured.

Note: This command is available only at the NULL port level and does not have per-VLAN granularity.

The no form of this command disables the command.

This command shuts down MACsec functionality, including MKA negotiation, for the port. In the shutdown state, the port is not MACsec capable and all PDUs are transmitted and expected without encryption and authentication.

A valid CA that is different from another CA configured on a sub-port of this port, and also a max-peer value larger than 0, must be configured. In MACsec-enabled mode, packets are sent in clear text until the MKA session is up, and if the rx-must-be-encrypted command is configured on the port, all incoming packets without MACsec are dropped.

The no form of this command sets the port to MACsec-enabled mode.

Commands in this context configure Link Layer Discovery Protocol (LLDP) parameters on the specified port.

This command configures tunneling for LLDP frames that use the nearest-bridge-dest-mac as destination MAC address. If enabled using the tunnel-nearest-bridge-dest-mac command, all frames received with the appropriate destination mac address are forwarded transparently to the remote end of the service. To forward these frames transparently the port on which tunneling is enabled must be configured with NULL SAP and the NULL SAP must be configured in an Epipe service. Tunneling is not supported for any other port encapsulation or when using any other service.

Additionally, before enabling tunneling, admin status for LLDP dest-mac nearest-bridge must be set to disabled or Tx only, using the command admin-status available under configure> port> ethernet> lldp> dest-mac nearest-bridge. If admin-status for dest-mac nearest-bridge is set to receive and process nearest-bridge LLDPDUs (that is, if either rx or tx-rx is set) then it overrides the tunnel-nearest-bridge-dest-mac command.

Table 29 describes the behavior for LLDP with different values set in use for admin-status and when tunneling is enabled or disabled:

Note: Transparent forwarding of LLDP frames can be achieved using the standard defined mechanism when using the either nearest-non-tmpr or the nearest-customer as the destination MAC address in the LLDP frames. It is recommended that the customers use these MAC address where possible to conform to standards. This command allows legacy LLDP implementations that do not support these additional destinations MAC addresses to tunnel LLDP frames that use the nearest-bridge destination MAC address.

The no form of this command disable LLDP tunneling for frames using nearest-bridge destination MAC address.

This command configures destination MAC address parameters to use by LLDP.

This command specifies the desired administrative status of the local LLDP agent.

This command enables LLDP notifications.

The no form of this command disables LLDP notifications.

This command specifies how to encode the PortID TLV transmit to the peer. Some versions of the NSP NFM-P require the default tx-local (ifIndex value) setting to properly build the Layer Two topology map using LLDP. Changing this setting to transmit the ifName (tx-if-name) or ifAlias (tx-if-alias), instead of the ifIndex (tx-local), may affect the ability of the NSP NFM-P to build the Layer 2 topology map using LLDP.

The no form of this command reverts to the default value.

This command specifies which management address to transmit. The operator can choose to send the system IPv4 IP Address, system IPv6 address, or both.

Note: The system address is sent only once. When both options are configured, both system addresses are sent. The system address must be configured for the specific version of the protocol to send the management address.

This command specifies which LLDP TLVs to transmit.

The no form of this command reverts to the default value.

Commands in this context configure network port parameters.

Commands in this context configure access uplink egress port parameters.

This command configures an accounting policy that can apply to an interface.

An accounting policy must be configured before it can be associated to an interface. If the accounting policy-id does not exist, an error is returned.

Accounting policies associated with service billing can only be applied to SAPs. Accounting policies associated with network ports can only be associated with interfaces. Only one accounting policy can be associated with an interface at a time.

The no form of this command removes the accounting policy association from the network interface, and the accounting policy reverts to the default. No accounting policies are specified by default. You must explicitly specify a policy. If configured, the accounting policy configured as the default is used.

This command enables the collection of accounting and statistical data for the network interface. When applying accounting policies, the data, by default, is collected in the appropriate records and written to the designated billing file.

The no form of this command ensures that the statistics are still accumulated by the IOM cards, however, the CPU does not obtain the results and write them to the billing file.

If the collect-stats command is issued again (enabled), then the counters written to the billing file will include the traffic collected while the no collect-stats command was in effect.

This command specifies the existing network queue policy which defines queue parameters such as CIR and PIR rates, as well as forwarding-class to queue mappings. The network-queue policy is defined in the config>qos>network-queue context.

A default CBS is defined for the queues and this is not configurable.

This command enables the context for configuring Link Aggregation Group (LAG) attributes.

A LAG can be used to group multiple ports into one logical link. The aggregation of multiple physical links allows for load sharing and provides seamless redundancy. If one of the links fails, traffic will be redistributed over the remaining links.

There are three possible settings for autonegotiation:

When autonegotiation is enabled on a port, the link attempts to automatically negotiate the link speed and duplex parameters. If autonegotiation is enabled, the configured duplex and speed parameters are ignored.

When autonegotiation is disabled on a port, the port does not attempt to autonegotiate and will only operate at the speed and duplex settings configured for the port. Note that disabling autonegotiation on gigabit ports is not allowed as the IEEE 802.3 specification for gigabit Ethernet requires autonegotiation be enabled for far end fault indication.

If the autonegotiate limited keyword option is specified the port will autonegotiate but will only advertise a specific speed and duplex. The speed and duplex advertised are the speed and duplex settings configured for the port. One use for limited mode is for multispeed gigabit ports to force gigabit operation while keeping autonegotiation is enabled for compliance with IEEE 801.3.

The system requires that autonegotiation be disabled or limited for ports in a LAG to guarantee a specific port speed.

The no form of this command deletes the LAG from the configuration. Deleting a LAG can only be performed while the LAG is administratively shut down. Any dependencies such as IP-Interfaces configurations must be removed from the configuration before issuing the no lag command.

This command enables OSPF costing of a Link Aggregation Group (LAG) based on the available aggregated operational bandwidth.

The path cost is dynamically calculated based on the interface bandwidth. OSPF path cost can be changed through the interface metric or the reference bandwidth.

If dynamic cost is configured, then costing is applied based on the total number of links configured and the cost advertised is inversely proportional to the number of links available at the time. This is provided that the number of links that are up exceeds the configured LAG threshold value at which time the configured threshold action determines if, and at what cost, this LAG will be advertised.

For example:

Assume a physical link in OSPF has a cost associated with it of 100, and the LAG consists of four physical links. The cost associated with the logical link is 25. If one link fails then the cost would automatically be adjusted to 33.

If dynamic cost is not configured and OSPF autocost is configured, then costing is applied based on the total number of links configured. This cost will remain static provided the number of links that are up exceeds the configured LAG threshold value at which time the configured threshold action determines if and at what cost this LAG will be advertised.

If dynamic cost is configured and OSPF autocost is not configured, the cost is determined by the cost configured on the OSPF metric provided the number of links available exceeds the configured LAG threshold value at which time the configured threshold action determines if this LAG will be advertised.

If neither dynamic-cost nor OSPF autocost are configured, the cost advertised is determined by the cost configured on the OSPF metric provided the number of links available exceeds the configured LAG threshold value at which time the configured threshold action determines if this LAG will be advertised.

The no form of this command removes dynamic costing from the LAG.

This command configures the encapsulation method used to distinguish customer traffic on a LAG. The encapsulation type is configurable on a LAG port. The LAG port and the port member encapsulation types must match when adding a port member.

If the encapsulation type of the LAG port is changed, the encapsulation type on all the port members will also change. The encapsulation type can be changed on the LAG port only if there is no interface associated with it. If the MTU is set to a non default value, it will be reset to the default value when the encap type is changed. All traffic on the port belongs to a single service or VLAN.

Note: On the 7210 SAS-D ETR, 7210 SAS-Dxp, 7210 SAS-K 2F1C2T, 7210 SAS-K 2F6C4T, and 7210 SAS-K 3SFP+ 8C, the qinq encapsulation type can be configured for both access and access-uplink port LAGs. The null and dot1q encapsulation types can be specified only for access port LAGs. On the 7210 SAS-K 2F6C4T and 7210 SAS-K 3SFP+ 8C, the null and dot1q encapsulation types can be specified for network port LAGs. The dot1q and qinq encapsulation types can be specified for hybrid port LAGs.

The no form of this command reverts the default.

This command specifies the timer, in tenths of seconds, which controls the delay between detecting that a LAG is down (all active ports are down) and reporting it to the higher levels.

A non-zero value can be configured, for example, when active/standby signaling is used in a 1:1 fashion to avoid informing higher levels during the small time interval between detecting that the LAG is down and the time needed to activate the standby link.

This command enables the Link Aggregation Control Protocol (LACP) mode for aggregated Ethernet interfaces only. Per the IEEE 802.3ax standard (formerly 802.3ad), the LACP provides a standardized means for exchanging information between Partner Systems on a link. This allow their Link Aggregation Control instances to reach agreement on the identity of the Link Aggregation Group to which the link belongs, move the link to that Link Aggregation Group, and enable its transmission and reception functions in an orderly manner. LACP can be enabled on a maximum of 256 ports.

This command specifies the interval signaled to the peer and tells the peer at which rate it should transmit.

This command enables LACP message transmission on standby links.

The no form of this command disables LACP message transmission. This command should be disabled for compatibility when using active/standby groups. This forces a timeout of the standby links by the peer. Use the no form if the peer does not implement the proper behavior regarding the lacp sync bit.

This command adds ports (links) to a Link Aggregation Group (LAG).

The port configuration of the first port added to the LAG is used as a basis to compare to subsequently added ports. If a discrepancy is found with a newly added port, that port is not added to the LAG.

The maximum number of ports allowed in a LAG depends on the platform. The following are the limits per platform.

All ports added to a LAG must share the same characteristics (speed, duplex, and so on). An error message is displayed when adding ports that do not share the same characteristics. Hold timers must be 0. Ports that are part of a LAG must be configured with autonegotiation set to limited mode or disabled. No ports are defined as members of a LAG.

The no form of this command removes ports from the LAG.

This command configures the behavior for the Link Aggregation Group (LAG) if the number of operational links is equal to or below a threshold level.

The no form of this command reverts to the default values.

This command specifies which selection criteria should be used to select the active sub-group.

This command specifies how the state of a member port is signaled to the remote side when the status corresponding to this member port has the standby value.

Commands in this context configure redundancy operations.

Commands in this context configure multi-chassis parameters.

This command configures the MC-LAG peer.

This command configures the authentication key used between this node and the multi-chassis peer. The authentication key can be any combination of letters or numbers.

This command adds a text description for the ring path.

The no form of this command removes the text description.

This command configures a G.8032 protected Ethernet ring. G.8032 Rings may be configured as major rings with two paths (a&b).

The no form of this command deletes the Ethernet ring specified by the ring-id.

This command configures the guard time for an Eth-Ring. The guard timer is standard and is configurable from 100 ms to 2 seconds

The no form of this command reverts to the default guard-time.

This command configures the revert time for an Eth-Ring. It ranges from 60 seconds to 720 second by 1 second intervals.

The no form of this command means non-revertive mode and revert time essentially is 0 meaning the revert timers are not set.

This command configures eth-ring dampening timers.

This command specifies the timer, which controls the delay between detecting that ring path is down and reporting it to the G.8032 protection module. If a non-zero value is configured, the CPM will wait for the time specified in the value parameter before reporting it to the G.8032 protection module.

Note: This down-timeout parameter applies only to ring path CCM. It does NOT apply to the ring port link state. To dampen ring port link state transitions, use hold-time parameter from the physical member port.

This command specifies the timer, which controls the delay between detecting that ring path is up and reporting it to the G.8032 protection module. If a non-zero value is configured, the CPM will wait for the time specified in the value parameter before reporting it to the G.8032 protection module.

Note: This parameter applies only to ring path CCM. It does NOT apply to the member port link state. To dampen member port link state transitions, use hold-time parameter from the physical member port.

The no form of this command reverts the up and down timer to the default values.

This command configures the G.8032 Ring Protection Link (RPL) type as owner or neighbor. When RPL owner or neighbor is specified, either the a or b path must be configured with the RPL end command. An owner is responsible for operation of the RPL link. Configuring the RPL as neighbor is optional (can be left as no rpl-node) but if the command is used the nbr is mandatory.

The no form of this command removes the connection to the RPL link.

This optional command configures the MAC address of the RPL control. The default is to use the chassis MAC for the ring control. This command allows the chassis MAC to be overridden with another MAC address.

The no form of this command removes the RPL link.

This command specifies this ring-id to be sub-ring as defined in G.8032. By declaring the ring as a sub-ring object, the ring will only have one valid path and the sub-ring will be connected to a major ring or a VPLS instance. The virtual-link parameter declares that a sub-ring is connected to another ring and that control messages can be sent over the attached ring to the other side of the sub-ring. The non-virtual channel parameter declares that a sub-ring may be connected to a another ring or to a VPLS instance but that no control messages from the sub-ring use the attached ring or VPLS instance. The non-virtual channel behavior is standard G.8032 capability.

The no form of this command deletes the sub-ring and its virtual channel associations.

This command configures the backward compatibility logic for the Ethernet rings.

This command assigns the ring (major or sub-ring) path to a port and defines the Ring APS tag. Rings typically have two paths, a and b.

The no form of this command removes the path a or b.

This command adds a text description for the ring path.

The no form of this command removes the text description.

This command configures the G.8032 path as a ring protection link end. The ring should be declared as either a RPL owner or RPL neighbor for this command to be allowed. Only path a or path b can be declared an RPL-end.

The no form of this command sets the rpl-end to default no rpl-end.

Commands in this context configure ETH-CFM parameters.

This command provisions an 802.1ag maintenance endpoint (MEP).

The no form of this command reverts to the default values.

This command enables the generation of CCM messages.

The no form of this command disables the generation of CCM messages.

This command specifies the priority value for CCMs and LTMs transmitted by the MEP.

The no form of this command removes the priority value from the configuration.

This command enables the context of the CC state by the Ethernet ring for consideration in the protection algorithm. The use of control-mep command is recommended if fast failure detection is required, especially when Link Layer OAM does not provide the required detection time.

The no form of this command disables the use of the CC state by the Ethernet ring.

This command enables eth-test functionality on MEP. For this test to work, operators need to configure ETH-test parameters on both sender and receiver nodes. The ETH-test then can be done using the following OAM commands:

oam eth-cfm eth-test mac-address mep mep-id domain md-index association ma-index [priority priority] [data-length data-length]

A check is done for both the provisioning and test to ensure the MEP is an Y.1731 MEP (MEP provisioned with domain format none, association format icc-based). If not, the operation fails. An error message in the CLI and SNMP will indicate the problem.

This command configures the test pattern for eth-test frames.

The no form of this command removes the values from the configuration.

This command specifies the lowest priority defect that is allowed to generate a fault alarm.

This command specifies the MAC address of the MEP.

The no form of this command reverts the MAC address of the MEP back to that of the port (if the MEP is on a SAP) or the bridge (if the MEP is on a spoke-SDP).

This command enables one way delay threshold time limit.

This command administratively enables or disables the MEP.

The no form of this command disables or enables the MEP.

This command administratively enables or disables the path.

The no form of this command disables or enables the path.

This command administratively enables/disables the Ethernet ring.

The no form of this command disables/enables the ring.

This command adds a text description for the eth-tunnel.

The no form of this command removes the text description.

This command associates a split horizon group to which this port or LAG belongs. For LAGs, all the member ports of the LAG are added to the split horizon group. The split-horizon-group must be configured in the config context.

Configuring or removing the association of the port requires the following conditions to be satisfied:

The no form of this command removes the port or all member ports of the LAG from the split horizon group.

Note: The environment option is not supported on the 7210 SAS-D.

This command displays general chassis status information.