6.4. Configuring IES with CLI
This section provides the information required to configure IP routing services; that is, direct forwarding of IP traffic between CE devices, and to configure IES for in-band management of the 7705 SAR over ATM links.
Topics in this section include:
6.5. Common Configuration Tasks
The following list provides a brief overview of the tasks that must be performed to configure IES.
- Associate the IES service with a customer ID.
- Create an IP interface on the 7705 SAR.
- Specify the IP address of the interface.
- Define interface parameters.
- Define SAP parameters.
- For IES spoke SDP applications only — define spoke SDP parameters.
- For IES applications only — configure VRRP (optional).
- For IES management service only—manually configure the remote address of the far-end router to which the NSP NFM-P is connected (far-end router must be enabled for IES service).*
- For IES management service only—create a static route to the remote router and to the NSP NFM-P.*
- Enable the service.
 | Note: *Remote address and static route configuration is beyond the scope of this document. For information, refer to the 7705 SAR Router Configuration Guide. |
6.6. Configuring IES Components
This section provides configuration examples for components of the IES service. Each component includes some or all of the following: introductory information, CLI syntax, a specific CLI example, and an example of the CLI display output.
Topics in this section include:
6.6.1. Creating an IES Service
Use the following CLI syntax to create an IES service.
The following example displays the IES service creation output.
6.6.2. Configuring Interface Parameters
Configure interface parameters for:
6.6.2.1. IES Management Service
Use the following CLI syntax to configure interface parameters for the IES management service.
The following example displays the IES interface creation output for the IES management service.
6.6.2.2. IES Service
Use the following CLI syntax to configure interface parameters for the IES service.
| Note: The IES interface can be configured as a loopback interface by issuing the loopback command instead of the sap command. The loopback flag cannot be set on an interface where a SAP is already defined, and a SAP cannot be defined on a loopback interface. |
The following example displays the IES interface creation output for the IES service.
6.6.2.3. IES IPv6 Service
Use the following CLI syntax to configure interface parameters for the IES IPv6 service.
The following example displays the IES interface IPv6 output.
6.6.3. Configuring IES SAP Parameters
Configure IES SAP parameters for:
6.6.3.1. IES Management SAP
Use the following CLI syntax to configure IES management SAP parameters.
| Note: The encapsulation type is always aal5mux-ip. |
The following example displays the IES SAP creation output.
6.6.3.2. IES Service SAP
Use the following CLI syntax to configure SAP parameters for the IES service.
| Note: A SAP cannot be defined if the loopback command is enabled on the interface. |
The following example displays the IES SAP creation output.
6.6.4. Configuring IES Spoke SDP Parameters
Use the following CLI syntax to configure spoke SDP parameters for the IES service.
The following example displays the IES spoke SDP creation output.
6.6.5. Configuring VRRP
Configuring VRRP policies and instances on service interfaces is optional. The basic owner and non-owner VRRP configurations on an IES interface must specify the backup ip-address parameter.
VRRP helps eliminate the single point of failure in a routed environment by using virtual router IP addresses shared between two or more routers connecting the common domain. VRRP provides dynamic failover of the forwarding responsibility to the backup router if the master becomes unavailable.
The VRRP implementation allows one master per IP subnet. All other VRRP instances in the same domain must be in backup mode.
For further information about VRRP CLI syntax and command descriptions, see the IES Command Reference.
The following displays an IES interface VRRP owner configuration:
6.6.6. Configuring a Security Zone Within IES
To configure NAT or firewall security, you must:
- configure a NAT or firewall security profile and policy in the config>security context
- in the config>security>profile context, specify the timeouts for the TCP/UDP/ICMP protocols and configure logging and application assurance parameters. This step is optional. If you do not configure the profile, a default profile is assigned.
- in the config>security>policy context, configure a security policy, specify the match criteria and the action to be applied to a packet if a match is found.
- configure a security zone and apply the policy ID to the zone, as shown in the CLI syntax below
The following example displays a NAT zone configuration output.
6.6.7. Configuring Serial Raw Socket Transport Within IES
Configure an IP transport subservice within an IES service in order to enable the transport of serial data using raw sockets.
The following example displays an IP transport subservice configuration output.
6.7. Service Management Tasks
This section discusses the following service management tasks:
6.7.1. Modifying IES Service Parameters
Existing IES service parameters can be modified, added, removed, enabled, or disabled.
To display a list of customer IDs, use the show>service>customer command.
Enter the parameters (such as description, interface information, or SAP information), and then enter the new information.
The following is an example of changing the IP MTU size.
6.7.2. Disabling an IES Service
An IES service can be shut down without deleting the service parameters.
Use the shutdown command to shut down an IES service.
6.7.3. Re-enabling an IES Service
Use the no shutdown command to re-enable a previously disabled IES service.
6.7.4. Deleting an IES Service
An IES service cannot be deleted until SAPs, spoke SDPs, and interfaces are shut down and deleted and the service is shut down on the service level.
Use the following CLI syntax to delete an IES service: