Mirror Service Configuration Command Reference

Command Hierarchies

Mirror Configuration Commands

config
— mirror
mirror-dest service-id [type mirror-type] [create]
— no mirror-dest service-id
description description-string
encap
layer-3-encap {ip-udp-shim | ip-gre} [create]
router {router-instance | service-name service-name}
— no router
gateway [create]
— no gateway
ip src ip-address dest ip-address
— no ip
udp src udp-port dest udp-port
— no udp
endpoint endpoint-name [create]
— no endpoint endpoint-name
description description-string
revert-time {revert-time | infinite}
fc fc-name
— no fc
— isa-aa-group aa-group-id traffic-direction
[no] remote-source
far-end ip-address [vc-id vc-id][ing-svc-label ing-vc-label | tldp] [icb]
— no far-end ip-address
spoke-sdp sdp-id:vc-id [create] [no-endpoint]
spoke-sdp sdp-id:vc-id [create] endpoint <name> [icb]
— no spoke-sdp sdp-id:vc-id
[no] acknowledgment
refresh-timer value
request-timer timer1 retry-timer timer2 [timeout-multiplier multiplier]
[no] shutdown
[no] control-word
egress
l2tpv3 egress-vc-label
— no l2tpv3 [egress-vc-label]
l2tpv3
cookie <cookie1> <cookie2>
vc-label ingress-vc-label
— no vc-label [ingress-vc-label]
[no] pw-path-id
agi route-identifier
— no agi
saii-type2 global-id:node-id:ac-id
— no saii-type2
taii-type2 global-id:node-id:ac-id
— no taii-type2
[no] shutdown
sap sap-id [create] [no-endpoint]
sap sap-id [create] endpoint name
— no sap
egress
qos policy-id
— no qos
service-name service-name
[no] shutdown
slice-size bytes
— no slice-size
spoke-sdp sdp-id:vc-id [create] [no-endpoint]
spoke-sdp sdp-id:vc-id [create] endpoint name [icb]
— no spoke-sdp sdp-id:vc-id
[no] acknowledgment
refresh-timer value
request-timer timer1 retry-timer timer2 [timeout-multiplier multiplier]
[no] shutdown
[no] control-word
egress
l2tpv3 egress-vc-label
— no l2tpv3 [egress-vc-label]
l2tpv3
cookie <cookie>
l2tpv3
cookie <cookie1> <cookie2>
vc-label ingress-vc-label
— no vc-label [ingress-vc-label]
precedence precedence-value | primary
— no precedence
[no] pw-path-id
agi route-identifier
— no agi
saii-type2 global-id:node-id:ac-id
— no saii-type2
taii-type2 global-id:node-id:ac-id
— no taii-type2
[no] shutdown
[no] shutdown

Lawful Intercept Commands

config
li
li-mac-filter filter-name [create]
description description-string
entry li-entry-id
— no entry
description description-string
match [frame-type {802dot3 | 802dot2-llc | 802dot2-snap ethernet_II}]
— no match
dst-mac ieee-address [mask]
— no dst-mac
src-mac ieee-address [mask]
— no src-mac
li-ip-filter filter-name [create]
description description-string
entry li-entry-id
— no entry
description description-string
match [protocols protocol-id]
— no match
dst-ip ipv4-address/mask
— no dst-ip
src-ip ipv4-address/mask
— no src-ip
li-ipv6-filter filter-name [create]
description description-string
entry li-entry-id
— no entry
description description-string
match [next-header next-header]
— no match
dst-ip ipv6-address/prefix-length
— no dst-ip
src-ip ipv6-address/prefix-length
— no src-ip
li-mac-filter li-mac-filter-name
mac-filter mac-filter-id
li-ip-filter li-ip-filter-name
ip-filter ip-filter-id
li-ipv6-filter li-ipv6-filter-name
ipv6-filter ipv6-filter-id
[no] li-reserved-block block-name [create]
description description-string
[no] start-entry entry-id count count
[no] ip-filter filter-id
[no] ipv6-filter filter-id
[no] mac-filter filter-id
[no] li-filter-lock-state {locked | unlocked-for-li-users | unlocked-for-all-users}
li-source service-id
ip-filter ip-filter-id [entry entry-id...] [intercept-id id] [session-id id]
— no ip-filter ip-filter-id
ipv6-filter ipv6-filter-id [entry entry-id...] [intercept-id intercept-id...] [session-id session-id...]
— no ipv6-filter ipv6-filter-id
li-ip-filter ip-filter-id [entry entry-id...] [intercept-id id] [session-id id]
— no li-ip-filter ip-filter-id
li-ipv6-filter ipv6-filter-id [entry entry-id...] [intercept-id intercept-id...] [session-id session-id...]
— no li-ipv6-filter ipv6-filter-id
mac-filter mac-filter-id entry entry-id [entry-id...] [intercept-id id] [session-id id]
— no mac-filter mac-filter-id
nat
[no] classic-lsn-sub router router-instance ip ip-address
session-id id
— no session-id
[no] dslite-lsn-sub router router-instance b4 ipv6-prefix
session-id id
— no session-id
ethernet-header [da ieee-address] [sa ieee-address] [etype ethertype]
[no] l2-aware-sub sub-ident-string
intercept-id id
session-id id
— no session-id
[no] nat64-lsn-sub router router-instance ip ipv6-prefix
intercept-id id
session-id id
— no session-id
sap sap-id {[ingress] [egress]} [intercept-id id] [session-id id]
— no sap sap-id
[no] shutdown
subscriber sub-ident-string [sap sap-id [ip ip-address] [mac ieee-address] |sla-profile sla-profile-name] [fc {[be] [l2] [af] [l1] [h2] [ef] [h1] [nc]}] {[ingress] [egress]} [intercept-id id] [session-id id]
— no subscriber sub-ident-string
[no] dsm-subscriber mac xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx
intercept-id [1..4294967295]
session-id [1..4294967295]
— no session-id
log
[no] log-id log-id
description description-string
filter filter-id
— no filter
from {[li]}
— no from
[no] shutdown
time-format {local | utc}
to memory [size]
to session
to snmp [size]
— mobility-gateway
df-peer df-peer-id df2-addr ip-address df2-port port df3-addr ip-address df3-port port
— no df-peer df-peer-id
local-interface ip-address [router router-instance]
operator op-id
— no operator
target target-type id string intercept intercept peer df-peer-id [liid li-identifier]
— no target target-type id string
[no] x2-iri-qos dscp {dscp-value | dscp-name}
[no] x3-cc-qos dscp {dscp-value | dscp-name}
x3-transport {tcp | udp} ulic-header {v0 | v1}
save

The following commands are also described in the Basic System Configuration Guide.

config
— bof
[no] li-local-save
[no] li-separate

The following commands are also described in the System Management Guide.

config
— system
— security
— user
[no] access [ftp] [snmp] [console] [li]
[no] profile user-profile-name
[no] li

Command Descriptions

Generic Commands

description

Syntax 
description description-string
no description
Context 
config>mirror>mirror-dest
config>li>log>log-id
config>li>li-filter>li-mac-filter
config>li>li-filter>li-mac-filter>entry
config>li>li-filter>li-ip-filter
config>li>li-filter>li-ip-filter>entry
config>li>li-filter>li-ipv6-filter
config>li>li-filter>li-ipv6-filter>entry
config>li>li-filter-block-reservation>li-reserved-block
Description 

This command creates a text description stored in the configuration file for a configuration context to help the administrator identify the content of the file.

The no form of the command removes the description string from the configuration.

Default 

There is no default description associated with the configuration context.

Parameters 
description-string—
The description character string. Allowed values are any string up to 80 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes.

shutdown

Syntax 
[no] shutdown
Context 
config>mirror>mirror-dest
debug>mirror-source
config>mirror>mirror-dest>spoke-sdp>egress
config>li>li-source
config>li>log>log-id
Description 

The shutdown command administratively disables an entity. When disabled, an entity does not change, reset, or remove any configuration settings or statistics. Many entities must be explicitly enabled using the no shutdown command.

The shutdown command administratively disables an entity. The operational state of the entity is disabled as well as the operational state of any entities contained within. Many objects must be shut down before they may be deleted.

Unlike other commands and parameters where the default state is not indicated in the configuration file, shutdown and no shutdown are always indicated in system generated configuration files.

The no form of the command puts an entity into the administratively enabled state.

Default 

See Special Cases below.

Special Cases 
Mirror Destination—
When a mirror destination service ID is shutdown, mirrored packets associated with the service ID are not accepted from the mirror source or remote source router. The associated mirror source is put into an operationally down mode. Mirrored packets are not transmitted out of the SAP or SDP. Each mirrored packet is silently discarded. If the mirror destination is a SAP, the SAP’s discard counters are incremented.

The shutdown command places the mirror destination service or mirror source into an administratively down state. The mirror-dest service ID must be shut down in order to delete the service ID, SAP or SDP association from the system.

The default state for a mirror destination service ID is shutdown. A no shutdown command is required to enable the service.

Mirror Source—
Mirror sources do not need to be shutdown in order to remove them from the system.

When a mirror source is shutdown, mirroring is terminated for all sources defined locally for the mirror-dest service ID. If the remote-source command has been executed on the mirror-dest associated with the shutdown mirror-source, mirroring continues for remote sources.

The default state for a mirror source for a given mirror-dest service ID is no shutdown. A shutdown command is required to disable mirroring from that mirror-source.

Mirror Destination Configuration Commands

enable-port-id

Syntax 
[no] enable-port-id
Context 
configure>mirror>mirror-dest
Description 

This command includes the mirrored packet system’s port-id. The system port ID can be used to identify which port the packet was received or sent on. Inclusion of the port-id is only supported for mirror-dest type ppp.

Default 

no enable-port-id

endpoint

Syntax 
endpoint endpoint-name [create]
no endpoint endpoint-name
Context 
configure>mirror>mirror-dest
configure>mirror>mirror-dest>sap
configure>mirror>mirror-dest>sdp
Description 

A mirror service supports two implicit endpoints managed internally by the system. The following applies to endpoint configurations.

Up to two (2) named endpoints may be created per service mirror/LI service. The endpoint name is locally significant to the service mirror/LI service.

  1. Objects (SAPs or SDPs) may be created on the service mirror/LI with the following limitations:
    1. two implicit endpoint objects (without explicit endpoints defined)
    2. one implicit and multiple explicit object with the same endpoint name
    3. multiple explicit objects each with one of two explicit endpoint names
  2. All objects become associated implicitly or indirectly with the implicit endpoints 'x' and 'y'.
  3. Objects may be created without an explicit endpoint defined.
  4. Objects may be created with an explicit endpoint defined.
  5. Objects without an explicit endpoint may have an explicit endpoint defined without deleting the object.
  6. Objects with an explicit endpoint defined may be dynamically moved to another explicit endpoint or may have the explicit endpoint removed.

Creating an object without an explicit endpoint:

  1. If an object on a mirror/LI service has no explicit endpoint name associated, the system attempts to associate the object with implicit endpoint 'x' or 'y'.
  2. The implicit endpoint cannot have an existing object association.
  3. If both 'x' and 'y' are available, 'x' will be selected.
  4. If an 'x' or 'y' association cannot be created, the object cannot be created.

Creating an object with an explicit endpoint name:

  1. The endpoint name must exist on the mirror/LI service.
  2. If this is the first object associated with the endpoint name:
    1. the object is associated with either implicit endpoint 'x' or 'y'
    2. the implicit endpoint cannot have an existing object associated
    3. if both 'x' and 'y' are available, 'x' will be selected
    4. if 'x' or 'y' is not available, the object cannot be created
    5. the implicit endpoint is now associated with the named endpoint
    6. f this is not the first object associated with the endpoint name:
    7. the object is associated with the named endpoint's implicit association

Changing an objects implicit endpoint to an explicit endpoint name

  1. If the explicit endpoint name is associated with an implicit endpoint, the object is moved to that implicit endpoint
  2. If the object is the first to be associated with the explicit endpoint name:
    1. the object is associated with either implicit endpoint 'x' or 'y'
    2. the implicit endpoint cannot have an existing object associated (except this one)
    3. if both 'x' and 'y' are available, 'x' will be selected
    4. if 'x' or 'y' is not available, the object cannot be moved to the explicit endpoint
    5. if moved, the implicit endpoint is now associated with the named endpoint

Changing an objects explicit endpoint to another explicit endpoint name

  1. If the new explicit endpoint name is associated with an implicit endpoint, the object is moved to that implicit endpoint
  2. If the object is the first to be associated with the new explicit endpoint name:
    1. the object is associated with either implicit endpoint 'x' or 'y'
    2. the implicit endpoint cannot have an existing object associated (except this one)
    3. if both 'x' and 'y' are available, 'x' will be selected
    4. if 'x' or 'y' is not available, the object cannot be moved to the new endpoint
    5. if moved, the implicit endpoint is now associated with the named endpoint

An explicitly named endpoint can have a maximum of one SAP and one ICB. Once a SAP is added to the endpoint, only one more object of type ICB sdp is allowed. The ICB sdp cannot be added to the endpoint if the SAP is not part of a MC-LAG instance. Conversely, a SAP which is not part of a MC-LAG instance cannot be added to an endpoint which already has an ICB sdp.

An explicitly named endpoint which does not have a SAP object can have a maximum of four SDPs which can include any of the following: a single primary SDP, one or many secondary SDPs with precedence, and a single ICB SDP.

The user can only add a SAP configured on a MC-LAG instance to this endpoint. Conversely, the user will not be able to change the mirror service type away from mirror service without first deleting the MC-LAG SAP.

The no form of the command removes the association of a SAP or a sdp with an explicit endpoint name. Removing an objects explicit endpoint association:

  1. The system attempts to associate the object with implicit endpoint 'x' or 'y'.
  2. The implicit endpoint cannot have an existing object association (except this one).
  3. If both 'x' and 'y' are available, 'x' will be selected.
  4. If an 'x' or 'y' association cannot be created, the explicit endpoint cannot be removed.
Parameters 
endpoint-name—
Specifies the endpoint name.
create—
Mandatory keyword to create this entry.

revert-time

Syntax 
revert-time {revert-time | infinite}
no revert-time
Context 
configure>mirror>mirror-dest>endpoint
Description 

This command has an effect only when used in conjunction with a endpoint which contains a SDP of type ‘primary’. It is ignored and has no effect in all other cases. The revert-timer is the delay in seconds the system waits before it switches the path of the mirror service from an active secondary SDP in the endpoint into the endpoint primary SDP after the latter comes back up.

The no form of the command resets the timer to the default value of 0. This means that the mirror-service path will be switched back to the endpoint primary sdp immediately after it comes back up.

Default 

0 — The VLL path will be switched back to the endpoint primary SDP immediately after it comes back up.

Parameters 
revert-time—
Specifies a delay, in seconds, the system waits before it switches the path of the mirror service from an active secondary SDP in the endpoint into the endpoint primary SDP after the latter comes back up.
Values—
0 to 600
infinite—
Forces the mirror/LI service path to never revert to the primary SDP as long as the currently active secondary -SDP is UP.

fc

Syntax 
fc fc-name
no fc
Context 
config>mirror>mirror-dest
Description 

This command specifies a forwarding class for all mirrored packets transmitted to the destination SAP or SDP overriding the default (be) forwarding class. All packets are sent with the same class of service to minimize out-of-sequence issues. The mirrored packet does not inherit the forwarding class of the original packet.

When the destination is on a SAP, a single egress queue is created that pulls buffers from the buffer pool associated with the fc-name.

When the destination is on an SDP, the fc-name defines the DiffServ-based egress queue that will be used to reach the destination. The fc-name also defines the encoded forwarding class of the encapsulation.

The fc configuration also affects how mirrored packets are treated at the ingress queuing point on the line cards. One ingress queue is used per mirror destination (service) and that will be an expedited queue if the configured FC is expedited (one of nc, h1, ef or h2). The ingress mirror queues have no CIR, but a line-rate PIR.

The no form of the command reverts the mirror-dest service ID forwarding class to the default forwarding class.

Default 

The best effort (be) forwarding class is associated with the mirror-dest service ID.

Parameters 
fc-name—
The name of the forwarding class with which to associate mirrored service traffic. The forwarding class name must already be defined within the system. If the fc-name does not exist, an error will be returned and the fc command will have no effect. If the fc-name does exist, the forwarding class associated with fc-name will override the default forwarding class.
Values—
be, l2, af, l1, h2, ef, h1, nc

isa-aa-group

Syntax 
isa-aa-group aa-group-id traffic-direction
Context 
config>mirror>mirror-dest
Description 

This command specifies ISA AA group parameters and applies only to the 7450 ESS and 7750 SR.

Parameters 
aa-group-id—
Specifies the particular application group to match against to resolve to an AQP action. If set to an empty string, no match on application group is done.
traffic-direction—
Specifies the traffic directions to match against to resolve to an AQP action. This allows different policer bandwidths to apply in each direction.

mirror-dest

Syntax 
mirror-dest service-id [type mirror-type] [create]
no mirror-dest
Context 
config>mirror
Description 

This command creates a context to set up a service that is intended for packet mirroring. It is configured as a service to allow mirrored packets to be directed locally (within the same router) or remotely, over the core of the network and have a far-end decode mirror encapsulation.

The mirror-dest service is comprised of destination parameters that define where the mirrored packets are to be sent. It also specifies whether the defined service-id will receive mirrored packets from far-end router over the network core.

The mirror-dest service IDs are persistent between boots of the router and are included in the configuration saves. The local sources of mirrored packets for the service ID are defined within the debug mirror mirror-source command that references the same service-id. Up to 255 mirror-dest service IDs can be created within a single system.

The mirror-dest command is used to create or edit a service ID for mirroring purposes. If the service-id does not exist within the context of all defined services, the mirror-dest service is created and the context of the CLI is changed to that service ID. If the service-id exists within the context of defined mirror-dest services, the CLI context is changed for editing parameters on that service ID. If the service-id exists within the context of another service type, an error message is returned and CLI context is not changed from the current context.

LI source configuration is saved using the li>save command.

The no form of the command removes a mirror destination from the system. The mirror-source or li-source associations with the mirror-dest service-id do not need to be removed or shutdown first. The mirror-dest service-id must be shutdown before the service ID can be removed. When the service ID is removed, all mirror-source or li-source commands that have the service ID defined will also be removed from the system.

Default 

No packet mirroring services are defined.

Parameters 
service-id—
The service identification identifies the service in the service domain. This ID is unique to this service and cannot be used by any other service, regardless of service type. The same service ID must be configured on every router that this particular service is defined on.

If particular a service ID already exists for a service, then the same value cannot be used to create a mirror destination service ID with the same value. For example:

If an Epipe service-ID 11 exists, then a mirror destination service-ID 11 cannot be created. If a VPLS service-ID 12 exists, then a mirror destination service-ID 12 cannot be created.

If an IES service-ID 13 exists, then a mirror destination service-ID 13 cannot be created.

Values—

service-id:

1 to 2147483647

svc-name:

64 characters maximum

type encap-type
The type describes the encapsulation supported by the mirror service.
Values—
The following values apply to the 7750 SR:
ether, frame-relay, ppp, ip-only, atm-sdu, satop-e1, satop-e3, satop-t1, cesopsn, cesopsn-cas
Values—
The following values apply to the 7950 XRS:
ether, ip-only
Values—
The following values apply to the 7450 ESS:
ether, frame-relay, ppp

remote-source

Syntax 
[no] remote-source
Context 
config>mirror>mirror-dest
Description 

This command is used on a destination router in a remote mirroring solution. The mirroring (packet copy) is performed on the source router and sent via an SDP to the destination router. Remote mirroring requires remote-source configuration on the destination router.

Remote mirroring allows a destination router to terminate SDPs from multiple remote source routers. This allows consolidation of packet sniffers/analyzers at a single or small set of points in a network (e.g., a sniffer/analyze farm, or lawful interception gateway).

A remote-source entry must be configured on the destination router for each source router from which mirrored traffic is being sent via SDPs.

A mirror destination service that is configured for a destination router must not be configured as for a source router.

Remote-source configuration is not applicable when routable LI encapsulation is being used on the mirror source router. Remote-source configuration is only used when a source router is sending mirrored traffic to a destination router via SDPs.

Two types of remote-source entries can be configured:

  1. far-end
  2. spoke-sdp

Certain remote-source types are applicable with certain SDP types. For descriptions of the command usage in the mirror-dest context, see far-end and spoke-sdp.

The 'no' form of the command removes all remote-source entries.

Default 

No remote source devices defined

far-end

Syntax 
far-end ip-address [vc-id vc-id] [ing-svc-label ing-vc-label | tldp] [icb]
no far-end ip-addr
Context 
config>mirror>mirror-dest>remote-source
Description 

This command is used on a destination router in a remote mirroring solution. See the description of the remote-source command for additional information.

When using L2TPv3, MPLS-TP or LDP IPv6 LSP SDPs in the remote mirroring solution, the destination node should be configured with remote-source>spoke-sdp entries. For all other types of SDPs, remote-source>far-end entries are used.

Up to 50 far-end entries can be specified.

Default 

No far end service ingress addresses are defined.

Parameters 
ip-address—
The service IP address (system IP address) of the remote device sending mirrored traffic to this mirror destination service. If 0.0.0.0 is specified, any remote is allowed to send to this service.
Values—
1.0.0.1 to 223.255.255.254
vc-id vc-id —
This is the virtual circuit identifier of the remote source. For mirror services, the vc-id defaults to the service-id. However, if the vc-id is being used by another service a unique vc-id is required to created an SDP binding. For this purpose the mirror service SDP bindings accepts vc-ids. This VC ID must match the VC ID used on the spoke-sdp that is configured on the source router.
ing-svc-label ing-svc-label
Specifies the ingress service label for mirrored service traffic on the far end device for manually configured mirror service labels.

The defined ing-svc-label is entered into the ingress service label table which causes ingress packet with that service label to be handled by this mirror-dest service.

The specified ing-svc-label must not have been used for any other service ID and must match the egress service label being used on the spoke-sdp that is configured on the source router. It must be within the range specified for manually configured service labels defined on this router. It may be reused for other far end addresses on this mirror-dest-service-id.

Values—
2048 to 18431
tldp—
Specifies that the label is obtained through signaling via the LDP.
icb—
Specifies that the remote source is an inter-chassis backup SDP binding.

sap

Syntax 
sap sap-id [create] [no-endpoint]
sap sap-id [create] endpoint name
no sap
Context 
config>mirror>mirror-dest
Description 

This command creates a service access point (SAP) within a mirror destination service. The SAP is owned by the mirror destination service ID.

The SAP is defined with port and encapsulation parameters to uniquely identify the (mirror) SAP on the interface and within the box. The specified SAP may be defined on an Ethernet access port with a dot1q, null, or q-in-q encapsulation type.

Only one SAP can be created within a mirror-dest service ID. If the defined SAP has not been created on any service within the system, the SAP is created and the context of the CLI will change to the newly created SAP. In addition, the port cannot be a member of a multi-link bundle, LAG, APS group or IMA bundle (applies to the 7450 ESS and 7750 SR).

If the defined SAP exists in the context of another service ID, mirror-dest or any other type, an error is generated.

Mirror destination SAPs can be created on Ethernet interfaces that have been defined as an access interface. If the interface is defined as network, the SAP creation returns an error.

When the no form of this command is used on a SAP created by a mirror destination service ID, the SAP with the specified port and encapsulation parameters is deleted.

Default 

No default SAP for the mirror destination service defined.

Parameters 
sap-id—
Specifies the physical port identifier portion of the SAP definition.
endpoint name
Specifies the name of the endpoint associated with the SAP.
no endpoint—
Removes the association of a SAP or a sdp with an explicit endpoint name.

cem

Syntax 
cem
Context 
config>mirror>mirror-dest>sap
Description 

This command enables the context to specify circuit emulation (CEM) mirroring properties. This command only applies to the 7750 SR and 7950 XRS.

Ingress and egress options cannot be supported at the same time on a CEM encap-type SAP. The options must be configured in either the ingress or egress contexts.

packet

Syntax 
packet jitter-buffer milliseconds [payload-size bytes]
packet payload-size bytes
no packet bytes
Context 
config>mirror>mirror-dest>sap>cem
Description 

This command specifies the jitter buffer size, in milliseconds, and payload size, in bytes. This command only applies to the 7750 SR and 7950 XRS.

Default 

The default value depends on the CEM SAP endpoint type, and if applicable, the number of timeslots:

Endpoint Type

Timeslots

Default Jitter Buffer (in ms)

unstructuredE1

n/a

5

unstructuredT1

n/a

5

unstructuredE3

n/a

5

unstructuredT3

n/a

5

nxDS0 (E1/T1)

N = 1

32

N = 2 to 4

16

N = 5 to 15

8

N >= 16

5

nxDS0WithCas (E1)

N

8

nxDS0WithCas (T1)

N

12

Parameters 
milliseconds—
Specifies the jitter buffer size in milliseconds (ms).

Configuring the payload size and jitter buffer to values that result in less than 2 packet buffers or greater than 32 packet buffers is not allowed.

Setting the jitter butter value to 0 sets it back to the default value.

Values—
1 — 250
payload-size bytes
Specifies the payload size (in bytes) of packets transmitted to the packet service network (PSN) by the CEM SAP. This determines the size of the data that will be transmitted over the service. If the size of the data received is not consistent with the payload size then the packet is considered malformed.
Values—
The default value depends on the CEM SAP endpoint type, and if applicable, the number of timeslots:

Endpoint Type

Timeslots

Default Payload Size (in bytes)

unstructuredE1

n/a

256

unstructuredT1

n/a

192

unstructuredE3

n/a

1024

unstructuredT3

n/a

1024

nxDS0 (E1/T1)

N = 1

64

N = 2 to 4

N x 32

N = 5 to 15

N x 16

N >= 16

N x 8

nxDS0WithCas (E1)

N

N x 16

nxDS0WithCas (T1)

N

N x 24

For all endpoint types except for nxDS0WithCas, the valid payload size range is from the default to 2048 bytes.

For nxDS0WithCas, the payload size divide by the number of timeslots must be an integer factor of the number of frames per trunk multiframe (for example, 16 for E1 trunk and 24 for T1 trunk).

For 1xDS0, the payload size must be a multiple of 2.

For NxDS0, where N > 1, the payload size must be a multiple of the number of timeslots.

For unstructuredE1, unstructuredT1, unstructuredE3 and unstructuredT3, the payload size must be a multiple of 32 bytes.

Configuring the payload size and jitter buffer to values that result in less than 2 packet buffers or greater than 32 packet buffer is not allowed.

Setting the payload size to 0 sets it back to the default value.

Values—
0, 16 to 2048

rtp-header

Syntax 
[no] rtp-header
Context 
config>mirror>mirror-dest>sap>cem
Description 

This command specifies whether an RTP header is used when packets are transmitted to the packet service network (PSN) by the CEM SAP. This command only applies to the 7750 SR and 7950 XRS.

Default 

no rtp-header

egress

Syntax 
egress
Context 
config>mirror>mirror-dest>sap
Description 

This command enables access to the context to associate an egress SAP Quality of Service (QoS) policy with a mirror destination SAP.

If no QoS policy is defined, the system default SAP egress QoS policy is used for egress processing.

ip-mirror

Syntax 
ip-mirror
Context 
config>mirror>mirror-dest>sap>egress
Description 

This command configures IP mirror information and only applies to the 7740 ESS and 7950 XRS.

sa-mac

Syntax 
sa-mac ieee-address da-mac ieee-address
no sa-mac
Context 
config>mirror>mirror-dest>sap>egress>ip-mirror
Description 

This command configures the source and destination MAC addresses for IP mirroring. This command only applies to the 7750 SR and 7950 XRS.

Parameters 
sa-mac ieee-address
Specifies the source MAC address. Multicast, Broadcast and zeros are not allowed.
da-mac ieee-address
Specifies the destination MAC address. Zeros are not allowed.

qos

Syntax 
qos policy-id
no qos
Context 
config>mirror>mirror-dest>sap>egress
Description 

This command associates a QoS policy with an egress SAP for a mirrored service.

By default, no specific QoS policy is associated with the SAP for egress, so the default QoS policy is used.

The no form of the command removes the QoS policy association from the SAP, and the QoS policy reverts to the default.

Default 

QoS policy-id 1.

Parameters 
policy-id—
The QoS policy ID to associate with SAP for the mirrored service. The policy ID must already exist.
Values—
1 to 65535

service-name

Syntax 
service-name service-name
no service-name
Context 
config>mirror>mirror-dest
Description 

This command specifies an existing service name, up to 64 characters in length, which adds a name identifier to a given service to then use that service name in configuration references as well as display and use service names in show commands throughout the system. This helps the service provider/administrator to identify and manage services.

slice-size

Syntax 
slice-size bytes
no slice-size
Context 
config>mirror>mirror-dest
Description 

This command enables mirrored frame truncation and specifies the maximum size, in bytes, of a mirrored frame that can be transmitted to the mirror destination.

This command enables mirroring larger frames than the destination packet decode equipment can handle. It also allows conservation of mirroring resources by limiting the size of the packet stream through the router and the core network.

When defined, the mirror slice-size creates a threshold that truncates a mirrored frame to a specific size. For example, if the value of 256 bytes is defined, a frame larger than 256 bytes will only have the first 256 bytes transmitted to the mirror destination. The original frame is not affected by the truncation. The mirrored frame size may increase if encapsulation information is added during transmission through the network core or out the mirror destination SAP to the packet/protocol decode equipment.

The actual capability of the router to transmit a sliced or non-sliced frame is also dictated by the mirror destination SDP path-mtu and/or the mirror destination SAP physical MTU. Packets that require a larger MTU than the mirroring destination supports are discarded if the defined slice-size does not truncate the packet to an acceptable size.

Notes:

  1. When configuring IP mirroring, packet slice will be rejected as an incorrect option as it will cause IP packets to be rejected by the next hop with an IP header verification error.
  2. Slice-size is not supported by CEM encap-types or IP-mirroring (applies to the 7750 SR and 7950 XRS).

The no form of the command disables mirrored packet truncation.

Default 

no slice-size — Mirrored packet truncation is disabled.

Parameters 
bytes—
The number of bytes to which mirrored frames will be truncated, expressed as a decimal integer.
Values—
128 to 9216

spoke-sdp

Syntax 
spoke-sdp sdp-id:vc-id [create] [no-endpoint]
spoke-sdp sdp-id:vc-id [create] endpoint name [icb]
no sdp sdp-id:vc-id
Context 
config>mirror>mirror-dest
config>mirror>mirror-dest>remote-source
Description 

This command binds an existing (mirror) service distribution path (SDP) to the mirror destination service ID.

Spoke SDPs are used to send and receive mirrored traffic between mirror source and destination routers in a remote mirroring solution. A spoke SDP configured in the remote-source context (remote-source>spoke-sdp) is used on the destination router. A spoke SDP configured in the mirror service context (mirror-dest>spoke-sdp) is used on the source router.

The destination node should be configured with remote-source>spoke-sdp entries when using L2TPv3, MPLS-TP or LDP IPv6 LSP SDPs in the remote mirroring solution. For all other types of SDPs, remote-source>far-end entries should be used.

Spoke SDPs are not applicable when routable LI encapsulation is employed (mirror-dest>encap).

A mirror destination service that is configured for a destination router must not be configured as for a source router.

The no form of the command removes the SDP binding from the mirror destination service.

Default 

No default SDP ID is bound to a mirror destination service ID. If no SDP is bound to the service, the mirror destination will be local and cannot be to another router over the core network.

Parameters 
sdp-id[:vc-id] —
A locally unique SDP identification (ID) number. The SDP ID must exist. If the SDP ID does not exist, an error will occur and the command will not execute.

For mirror services, the vc-id defaults to the service-id. However, there are scenarios where the vc-id is being used by another service. In this case, the SDP binding cannot be created. So, to avoid this, the mirror service SDP bindings now accepts vc-ids.

Values—
1 to 17407
endpoint name
Specifies the name of the endpoint associated with the SAP.
no endpoint—
Removes the association of a SAP or a SDP with an explicit endpoint name.
icb—
Indicates that the SDP is of type Inter-Chassis Backup (ICB). This is a special pseudowire used for MC-LAG and pseudowire redundancy application.

An explicitly named endpoint can have a maximum of one SAP and one ICB. Once a SAP is added to the endpoint, only one more object of type ICB SDP is allowed. The ICB SDP cannot be added to the endpoint if the SAP is not part of a MC-LAG instance. This means that all other SAP types cannot exist on the same endpoint as an ICB SDP since non Ethernet SAP cannot be part of a MC-LAG instance. Conversely, a SAP which is not part of a MC-LAG instance cannot be added to an endpoint which already has an ICB SDP.

An explicitly named endpoint, which does not have a SAP object, can have a maximum of four SDPs, which can include any of the following: a single primary SDP, one or many secondary SDPs with precedence, and a single ICB SDP.

Values—
Null. The user should explicitly configure this option at create time. The user can remove the ICB type simply by retyping the SDP configuration without the icb keyword.

control-channel-status

Syntax 
[no] control-channel-status
Context 
config>mirror>mirror-dest>remote-source>spoke-sdp
config>mirror>mirror-dest>spoke-sdp>
Description 

This command enables the configuration of static pseudowire status signaling on a spoke-SDP for which signaling for its SDP is set to OFF. For more information about control channel status configuration for the spoke-sdp, see the SR OS Services Guide.

Default 

no control-channel-status

acknowledgment

Syntax 
[no] acknowledgment
Context 
config>mirror>mirror-dest>remote-source>spoke-sdp>control-channel-status
config>mirror>mirror-dest>spoke-sdp>control-channel-status
Description 

This command enables the acknowledgment of control channel status messages. By default, no acknowledgment packets are sent.

refresh-timer

Syntax 
refresh-timer value
no refresh-timer
Context 
config>mirror>mirror-dest>remote-source>spoke-sdp>control-channel-status
config>mirror>mirror-dest>spoke-sdp>control-channel-status
Description 

This command configures the refresh timer for control channel status signaling packets. By default, no refresh packets are sent.

Default 

no refresh-timer

Parameters 
value—
Specifies the refresh timer value.

request-timer

Syntax 
request-timer timer1 retry-timer timer2 timeout-multiplier multiplier
no request-timer
Context 
config>mirror>mirror-dest>remote-source>spoke-sdp>control-channel-status
config>mirror>mirror-dest>spoke-sdp>control-channel-status
Description 

This command configures the control channel status request mechanism. When it is configured, control channel status request procedures are used. These augment the procedures for control channel status messaging from RFC 6478. This command is mutually exclusive with a non-zero refresh-timer value.

Parameters 
timer1—
Specifies the interval at which pseudowire status messages, including a reliable delivery TLV, with the “request” bit set, are sent.
Values—
10 to 65535 seconds
retry-timer timer2
Specifies the timeout interval if no response to a pseudowire status request is received. This parameter must be configured. A value of zero (0) disables retries.
Values—
0, 3 to 60 seconds
timeout-multiplier multiplier
If a requesting node does not receive a valid response to a pseudowire status request within this multiplier times the retry timer, then it will assume the pseudowire is down. This parameter is optional.
Values—
3 to 20 seconds

control-word

Syntax 
[no] control-word
Context 
config>mirror>mirror-dest>remote-source>spoke-sdp>control-channel-status
config>mirror>mirror-dest>spoke-sdp>control-channel-status
Description 

This command enables/disables the PW control word on spoke-sdps terminated on an IES or VPRN interface. The control word must be enabled to allow MPLS-TP OAM on the spoke-sdp

It is only valid for MPLS-TP spoke-sdps when used with IES and VPRN services.

Default 

no control-word

egress

Syntax 
egress
Context 
config>mirror>mirror-dest>spoke-sdp
config>mirror>mirror-dest>remote-source>spoke-sdp
Description 

This command enters the context to configure spoke SDP egress parameters.

ingress

Syntax 
ingress
Context 
config>mirror>mirror-dest>spoke-sdp
config>mirror>mirror-dest>remote-source>spoke-sdp
Description 

This command enters the context to configure spoke SDP ingress parameters.

l2tpv3

Syntax 
l2tpv3
Context 
config>mirror>mirror-dest>spoke-sdp>egress
config>mirror>mirror-dest>remote-source>spoke-sdp>ingress
Description 

This command enters the context to configure an RX/TX cookie for L2TPv3 egress spoke-SDP or for the remote-source ingress spoke-sdp.

cookie

Syntax 
cookie cookie1-value [cookie2-value]
no cookie
Context 
config>mirror>mirror-dest>spoke-sdp>egress>l2tpv3
config>mirror>mirror-dest>remote-source>spoke-sdp>ingress>l2tpv3
Description 

This command configures the RX/TX cookie for L2TPv3 spoke-SDPs for the mirror destination. The command can configure L2TPv3 a single cookie for the egress spoke-SDP or one or two cookies for the remote-source ingress spoke-sdp.

The purpose of the cookie is to provide validation against misconfiguration of service endpoints, and to ensure that the right service egress is being used.

When a cookie is not configured, SR OS assumes a value of 00:00:00:00:00:00:00:00. A cookie is not mandatory. An operator may delete the egress cookie or either or both ingress cookies.

Default 

no cookie1 cookie2

Parameters 
cookie1-value—
Specifies a 64-bit colon separated hex value.
cookie2-value—
Specifies a second 64-bit colon separated hex value.

vc-label

Syntax 
vc-label egress-vc-label
no vc-label [egress-vc-label]
Context 
config>mirror>mirror-dest>spoke-sdp>egress
config>mirror>mirror-dest>remote-source>spoke-sdp>egress
Description 

This command configures the spoke-SDP egress VC label.

Parameters 
egress-vc-label—
A VC egress value that indicates a specific connection.
Values—
16 to 1048575

vc-label

Syntax 
[no] vc-label vc-label
Context 
config>mirror>mirror-dest>spoke-sdp>egress
config>mirror>mirror-dest>remote-source>spoke-sdp>egress
Description 

This command configures the ingress VC label.

Parameters 
vc-label—
A VC ingress value that indicates a specific connection.
Values—
2048 to 18431

pw-path-id

Syntax 
[no] pw-path-id
Context 
config>service>epipe>spoke-sdp
config>service>cpipe>spoke-sdp
config>service>apipe>spoke-sdp
config>service>vpls>spoke-sdp
config>service>ies>interface>spoke-sdp
config>service>vprn>interface>spoke-sdp
Description 

This command enables the context to configure an MPLS-TP Pseudowire Path Identifier for a spoke-sdp. All elements of the PW path ID must be configured in order to enable a spoke-sdp with a PW path ID.

For an IES or VPRN spoke-sdp, the pw-path-id is only valid for Ethernet spoke-sdps.

The pw-path-id is only configurable if all of the following is true:

  1. The system is using network chassis mode D
  2. SDP signaling is off
  3. control-word is enabled (control-word is disabled by default)
  4. the service type is epipe, vpls, cpipe, apipe, or IES/VPRN interface
  5. mate SDP signaling is off for vc-switched services

The no form of the command deletes the PW path ID.

Default 

no pw-path-id

agi

Syntax 
agi agi
no agi
Context 
config>service>epipe>spoke-sdp>pw-path-id
config>service>cpipe>spoke-sdp>pw-path-id
config>service>apipe>spoke-sdp>pw-path-id
config>service>vpls>spoke-sdp>pw-path-id
config>service>ies>interface>>spoke-sdp>pw-path-id
config>service>vprn>interface>>spoke-sdp>pw-path-id
Description 

This command configures the attachment group identifier for an MPLS-TP PW.

Parameters 
agi—
Specifies the attachment group identifier.
Values—
0 to 4294967295

saii-type2

Syntax 
saii-type2 global-id:node-id:ac-id
no saii-type2
Context 
config>service>epipe>spoke-sdp>pw-path-id
config>service>cpipe>spoke-sdp>pw-path-id
config>service>apipe>spoke-sdp>pw-path-id
config>service>vpls>spoke-sdp>pw-path-id
config>service>ies>interface>>spoke-sdp>pw-path-id
config>service>vprn>interface>>spoke-sdp>pw-path-id
Description 

This command configures the source individual attachement identifier (SAII) for an MPLS-TP spoke-sdp. If this is configured on a spoke-sdp for which vc-switching is also configured (for example, it is at an S-PE), then the values must match those of the taii-type2 of the mate spoke-sdp.

Parameters 
global-id—
Specifies the global ID at the source PE or T-PE for the MPLS-TP PW for a spoke-SDP.
Values—
0 to 4294967295
node-id—
Specifies the node ID at the source PE or T-PE for the MPLS-TP PW for a spoke-SDP.
Values—
a.b.c.d or 0 to 4294967295
ac-id—
Specifies the attachment circuit ID at the source PE or T-PE for the MPLS-TP PW for a spoke-SDP. If this node is the source of the PW, then the AC ID must be set to a locally unique value.
Values—
1 to 4294967295

taii-type2

Syntax 
taii-type2 global-id:node-id:ac-id
no taii-type2
Context 
config>service>epipe>spoke-sdp>pw-path-id
config>service>cpipe>spoke-sdp>pw-path-id
config>service>apipe>spoke-sdp>pw-path-id
config>service>vpls>spoke-sdp>pw-path-id
config>service>ies>interface>>spoke-sdp>pw-path-id
config>service>vprn>interface>>spoke-sdp>pw-path-id
Description 

This command configures the target individual attachment identifier (TAII) for an MPLS-TP spoke-sdp. If this is configured on a spoke-sdp for which vc-switching is also configured (for example, it is at an S-PE), then the values must match those of the saii-type2 of the mate spoke-sdp.

Parameters 
global-id—
Specifies the global ID at the target PE or T-PE for the MPLS-TP PW for a spoke-SDP.
Values—
0 to 4294967295
node-id—
Specifies the node ID at the target PE or T-PE for the MPLS-TP PW for a spoke-SDP.
Values—
a.b.c.d or 0 to 4294967295
ac-id—
Specifies the attachment circuit ID at the target PE or T-PE for the MPLS-TP PW for a spoke-SDP. If this node is the source of the PW, then the AC ID must be set to a locally unique value.
Values—
1 to 4294967295

precedence

Syntax 
precedence precedence-value | primary
no precedence
Context 
config>mirror>mirror-dest>spoke-sdp>egress
Description 

This command indicates that the SDP is of type secondary with a specific precedence value or of type primary.

The mirror/LI service always uses the primary type as the active pseudowire and only switches to a secondary pseudowire when the primary is down. The mirror service switches the path back to the primary pseudowire when it is back up. The user can configure a timer to delay reverting back to primary or to never revert back.

If the active pseudowire goes down, the mirror service switches the path to a secondary sdp with the lowest precedence value. That is, secondary SDPs which are operationally up are considered in the order of their precedence value, 1 being the lowest value and 4 being the highest value. If the precedence value is the same, then the SDP with the lowest SDP ID is selected.

An explicitly named endpoint can have a maximum of one SAP and one ICB. Once a SAP is added to the endpoint, only one more object of type ICB SDP is allowed. An explicitly named endpoint, which does not have a SAP object, can have a maximum of four SDPs, which can include any of the following: a single primary SDP, one or many secondary SDPs with precedence, and a single ICB SDP.

An SDP is created with type secondary and with the lowest precedence value of 4.

Parameters 
prec-value—
The precedence of the SDP.
Values—
1 to 4
primary—
A special value of the precedence which assigns the SDP the lowest precedence and enables the revertive behavior.

encap

Syntax 
encap
Context 
config>mirror>mirror-dest
Description 

This command enters the encap branch in order to configure encapsulation options for the mirrored traffic. Note that the use of encap is mutually exclusive with sap or spoke-sdp options in the same mirror-dest. Only one type of encapsulation can be specified for a single mirror-dest. Slicing and encap are mutually exclusive in the same mirror-dest.

layer-3-encap

Syntax 
layer-3-encap {ip-udp-shim| ip-gre} [create]
no layer-3-encap
Context 
config>mirror>mirror-dest>encap
Description 

This command specifies the format of the routable encapsulation to add to each copied packet. Layer-3-encap takes precedence over ethernet-encap configuration in an li-source. No changes are allowed to the layer-3-encap once a gateway is configured.

Default 

no layer-3-encap

Parameters 
ip-udp-shim—
indicates the type of layer-3 encapsulation is an IPv4 header, UDP header and LI-Shim. Added to the mirrored packets.
ip-gre—
indicates the type of layer-3 encapsulation is nn IPv4 header and GRE header. Added to the mirrored packets. Only supported with mirror-dest type ip-only.

direction-bit

Syntax 
direction-bit
no direction-bit
Context 
config>mirror>mirror-dest>encap>layer-3-encap
Description 

This command is used to steal one bit from the intercept-id in the LI-Shim and use it to indicate the direction of traffic flow for an LI session. Using a direction bit may be used by a LI Mediation Gateway to distinguish between the two directions of traffic flow for an LI session when both directions share a common mirror-dest, intercept-id and session-id. If the direction bit is enabled then the Mirror Header Version (2 bit mhv) in the LI-Shim will be set to binary 01, and the next bit after the mhv is set to 0 for ingress traffic and 1 for egress traffic.

For NAT based LI, ingress means the traffic is arriving at the node from the subscriber host (applies to the 7450 ESS and 7750 SR).

No changes are allowed to the direction-bit configuration once a gateway is configured.

Default 

no direction-bit

router

Syntax 
router router-instance
router service-name service-name
no router
Context 
config>mirror>mirror-dest>encap>layer-3-encap
Description 

This command specifies the routing instance into which to inject the mirrored packets. The packets will be forwarded in the routing instance based on the configurable destination IP address in the inserted IP header. If a mirror-dest is configured to inject into a VPRN service, then that VPRN service cannot be deleted. A mirror-dest with layer-3-encap will be set to operationally down if the configured destination IP address is not reachable via an interface in the routing instance or service configured for the mirror-dest. No changes are allowed to the router configuration once a gateway is configured. A service must already exist before it is specified as a router-instance. Note that vprns and ies services share the same number space for the service-id, but ies services cannot be specified as the router-instance for routable LI encap.

Forwarding of routable encapsulated LI packets out an R-VPLS interface is not supported. A mirror-dest configured with routable encapsulation can be bound to a routing instance that also has an R-VPLS bound to it but the operator must ensure that the destination of the LI packets is not reachable via any R-VPLS interfaces. Any routable encapsulated LI packets that arrive at the egress of an R-VPLS interface are discarded. Parallel use of routable LI encapsulation and R-VPLS in the same routing instance is supported as long as the mirrored packets don't egress out the R-VPLS interface.

Default 

router “Base”

Parameters 
router-instance—
Specifies the router instance.
Values—
<router-name> | <service-id>

router-name

“Base”|name (Default is Base)

service-id

1 to 2147483647

service-name—
Specifies the service name. Specify a character string, 64 characters maximum.

gateway

Syntax 
gateway [create]
no gateway
Context 
config>mirror>mirror-dest>encap>layer-3-encap
Description 

Configures the parameters to send the mirrored packets to a remote destination gateway. Once a gateway is created, no changes to the layer-3-encap type, router or direction-bit are allowed.

Default 

None

ip

Syntax 
ip src ip-address dest ip-address
no ip
Context 
config>mirror>mirror-dest>encap>layer-3-encap>gateway
Description 

Configures the source IPv4 address and destination IPv4 address to use in the IPv4 header part of the routable LI encapsulation.

Default 

no ip

Parameters 
src ip-address
Specifies source IP address.
Values—
a.b.c.d
dest ip-address
Specifies destination IP address.
Values—
a.b.c.d

udp

Syntax 
udp src udp-port dest udp-port
no udp
Context 
config>mirror>mirror-dest>encap>layer-3-encap>gateway
Description 

Configures the source UDP port and destination UDP port to use in the UDP header part of the routable LI encapsulation.

Default 

no udp

Parameters 
src ip-address—
Specifies source UDP port.
Values—
1 to 65535
dest ip-address—
Specifies destination UDP port.
Values—
1 to 65535

Lawful Intercept Commands

li

Syntax 
li
Context 
config
Description 

This command configures the context to configure lawful intercept (LI) parameters.

li-filter

Syntax 
li-filter
Context 
config>li
Description 

This command enters the li-filter branch in order to create lawful intercept filter lists and entries.

li-mac-filter

Syntax 
li-mac-filter filter-name [create]
no li-mac-filter filter-name
Context 
config>li>li-filter
Description 

This command creates a Lawful Interception (LI) MAC filter list, or enters the CLI context for a LI MAC filter list. LI MAC filters are used as a manner to create confidential MAC filter based li-source entries. The LI MAC filter entries are inserted/merged into normal MAC filters as configured via the li-filter-associations and li-filter-block-reservation commands, but the LI MAC filter entries are not visible to users without LI permissions.

Parameters 
filter-name—
Specifies the name of the MAC filter. Filter names cannot start with an underscore character (e.g. “_my-filter”) and cannot use the name “default”.

li-ip-filter

Syntax 
li-ip-filter filter-name [create]
no li-ip-filter filter-name
Context 
config>li>li-filter
Description 

This command creates a Lawful Interception (LI) IPv4 filter list, or enters the CLI context for a LI IPv4 filter list. LI IPv4 filters are used as a manner to create confidential IPv4 filter based li-source entries. The LI IPv4 filter entries are inserted/merged into normal IPv4 filters as configured via the li-filter-associations and li-filter-block-reservation commands, but the LI IPv4 filter entries are not visible to users without LI permissions.

Parameters 
filter-name—
Specifies the name of the IPv4 address filter. Filter names cannot start with an underscore character (e.g. “_my-filter”) and cannot use the name “default”.

li-ipv6-filter

Syntax 
li-ipv6-filter filter-name [create]
no li-ipv6-filter filter-name
Context 
config>li>li-filter
Description 

This command creates a Lawful Interception (LI) IPv6 filter list, or enters the CLI context for a LI IPv6 filter list. LI IPv6 filters are used as a manner to create confidential IPv6 filter based li-source entries. The LI IPv6 filter entries are inserted/merged into normal IPv6 filters as configured via the li-filter-associations and li-filter-block-reservation commands, but the LI IPv6 filter entries are not visible to users without LI permissions.

Parameters 
filter-name—
Specifies the name of the IPv6 address filter. Filter names cannot start with an underscore character (e.g. “_my-filter”) and cannot use the name “default”.

entry

Syntax 
entry li-entry-id [create]
no entry li-entry-id
Context 
config>li>li-filter>li-ip-filter
config>li>li-filter>li-ipv6-filter
config>li>li-filter>li-mac-filter
Description 

This command creates or edits a Lawful Interception filter entry. Multiple entries can be created using unique entry-id numbers within the filter.

An entry in a LI filter always has an implicit action of “forward”.

The no form of the command removes the specified entry from the filter. Entries removed from the filter are immediately removed from all services or network ports where the associated filter is applied.

LI filter entries can be used as li-source entries.

The entry numbers for li filters serve purely as keys for managing the entries (deleting entries, etc). The order of LI filter entries is not guaranteed to match the entry numbers and s/w may reorder entries. Operators must use LI entries in a manner such that relative order of the LI entries amongst themselves is not important.

Parameters 
li-entry-id—
Identifies the Lawful Interception filter entry.
Values—
1 to 65536

match

Syntax 
match [frame-type {802dot3 | 802dot2-llc | 802dot2-snap | ethernet_II}]
no match
Context 
config>li>li-filter>li-mac-filter>entry
Description 

This command creates the context for entering/editing match criteria for the filter entry and specifies an Ethernet frame type for the entry.

If more than one match criteria (within one match statement) are configured then all criteria must be satisfied (AND function) for a match to occur.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry.

Parameters 
frame-type—
Filters can continue to be edited by all users even when an li-source references an entry in that filter.
Values—
802dot3, 802dot2-llc, 802dot2-snap, ethernet_II
Values—
802dot3
802dot3—
Specifies the frame type is Ethernet IEEE 802.3.
802dot2-llc—
Specifies the frame type is Ethernet IEEE 802.2 LLC.
802dot2-snap—
Specifies the frame type is Ethernet IEEE 802.2 SNAP.
ethernet_II—
Specifies the frame type is Ethernet Type II.

match

Syntax 
match [protocols protocols-id]
no match
Context 
config>li>li-filter>li-ip-filter>entry
Description 

This command enables context to enter match criteria for LI IPv4 filter and optionally allows specifying protocol value to match on.

If more than one match criterion are configured then all criteria must be satisfied for a match to occur (logical “AND”). Multiple criteria must be configured within a single match context for a given entry.

The no form removes the match criteria for the entry

Parameters 
protocol—
The protocol keyword configures an IP protocol to be used as an IP filter match criterion. The protocol type such as TCP or UDP is identified by its respective protocol number.
protocol-id—
Configures the decimal value representing the IP protocol to be used as an IP filter match criterion. Well known protocol numbers include ICMP(1), TCP(6), UDP(17). The no form the command removes the protocol from the match criteria.
Values—
0 to 255 (values can be expressed in decimal, hexadecimal, or binary - DHB)
Keywords for the 7750 SR:
none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp, igmp, igp, ip, ipv6, ipv6-frag, ipv6-icmp, ipv6-no-nxt, ipv6-opts, ipv6-route, isis, iso-ip, l2tp, ospf-igp, pim, pnni, ptp, rdp, rsvp, stp, tcp, udp, vrrp
Keywords for the 7450 ESS:
none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp, igmp, igp, ip, isis, iso-ip, l2tp, ospf-igp, pim, pnni, ptp, rdp, rsvp, stp, tcp, udp, vrrp
* — udp/tcp wildcard

Protocol

Protocol ID

Description

icmp

1

Internet Control Message

igmp

2

Internet Group Management

ip

4

IP in IP (encapsulation)

tcp

6

Transmission Control

egp

8

Exterior Gateway Protocol

igp

9

Any private interior gateway (used by Cisco for IGRP)

udp

17

User Datagram

rdp

27

Reliable Data Protocol

ipv6

41

IPv6

ipv6-route

43

Routing Header for IPv6

ipv6-frag

44

Fragment Header for IPv6

idrp

45

Inter-Domain Routing Protocol

rsvp

46

Reservation Protocol

gre

47

General Routing Encapsulation

ipv6-icmp

58

ICMP for IPv6

ipv6-no-nxt

59

No Next Header for IPv6

ipv6-opts

60

Destination Options for IPv6

iso-ip

80

ISO Internet Protocol

eigrp

88

EIGRP

ospf-igp

89

OSPFIGP

ether-ip

97

Ethernet-within-IP Encapsulation

encap

98

Encapsulation Header

pnni

102

PNNI over IP

pim

103

Protocol Independent Multicast

vrrp

112

Virtual Router Redundancy Protocol

l2tp

115

Layer Two Tunneling Protocol

stp

118

Spanning Tree Protocol

ptp

123

Performance Transparency Protocol

isis

124

ISIS over IPv4

crtp

126

Combat Radio Transport Protocol

crudp

127

Combat Radio User Datagram

match

Syntax 
match [next-header next-header]
no match
Context 
config>li>li-filter>li-ipv6-filter>entry
Description 

This command enables context to enter match criteria for LI IPv6 filter and optionally allows specifying IPv6 next-header value to match on.

If more than one match criterion are configured then all criteria must be satisfied for a match to occur (logical “AND”). Multiple criteria must be configured within a single match context for a given entry.

The no form removes the match criteria for the entry

Parameters 
next-header—
Specifies the IPv6 next header to match. Note that this parameter is analogous to the protocol parameter used in IP-Filter match criteria.
Values—
[0 to 42 | 45 to 49 | 52 to 59 | 61 to 255] — protocol numbers accepted in decimal, hexadecimal, or binary - DHB
Keywords: none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp, igmp, igp, ip, ipv6, ipv6-icmp, ipv6-no-nxt, isis, iso-ip, l2tp, ospf-igp, pim, pnni, ptp, rdp, rsvp, stp, tcp, udp, vrrp
* — udp/tcp wildcard

dst-mac

Syntax 
dst-mac ieee-address [mask]
no dst-mac
Context 
config>li>li-filter>li-mac-filter>entry>match
Description 

Configures a destination MAC address or range to be used as a MAC filter match criterion.

The no form of the command removes the destination mac address as the match criterion.

Default 

no dst-mac

Parameters 
ieee-address—
Enter the 48-bit IEEE mac address to be used as a match criterion.
Values—
HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is a hexadecimal digit
ieee-address-mask—
This 48-bit mask can be configured using:

Format Style

Format Syntax

Example

Decimal

DDDDDDDDDDDDDD

281474959933440

Hexadecimal

0xHHHHHHHHHHHH

0x0FFFFF000000

Binary

0bBBBBBBB...B

0b11110000...B

To configure so that all packets with a destination MAC OUI value of 00-03-FA are subject to a match condition then the entry should be specified as: 003FA000000 0xFFFFFF000000

Values—
0xFFFFFFFFFFFF (exact match)
Values—
0x00000000000000 — 0xFFFFFFFFFFFF

src-mac

Syntax 
src-mac ieee-address [ieee-address-mask]
no src-mac
Context 
config>li>li-filter>li-mac-filter>entry>match
Description 

Configures a source MAC address or range to be used as a MAC filter match criterion.

The no form of the command removes the source mac as the match criteria.

Default 

no src-mac

Parameters 
ieee-address—
Enter the 48-bit IEEE mac address to be used as a match criterion.
Values—
HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is a hexadecimal digit
ieee-address-mask—
This 48-bit mask can be configured using:

Format Style

Format Syntax

Example

Decimal

DDDDDDDDDDDDDD

281474959933440

Hexadecimal

0xHHHHHHHHHHHH

0x0FFFFF000000

Binary

0bBBBBBBB...B

0b11110000...B

To configure so that all packets with a source MAC OUI value of 00-03-FA are subject to a match condition then the entry should be specified as: 003FA000000 0xFFFFFF000000

Values—
0xFFFFFFFFFFFF (exact match)
Values—
0x00000000000000 to 0xFFFFFFFFFFFF

dst-ip

Syntax 
dst-ip {ip-address/mask | ip-address ipv4-address-mask}
Context 
config>li>li-filter>li-ip-filter>entry>match
Description 

This command configures destination IP address LI filter match criterion.

The no form of this command removes any configured destination IP address. The match criterion is ignored.

Default 

none

Parameters 
ip-address—
Any address specified as dotted quad.
Values—
a.b.c.d
mask—
Eight 16-bit hexadecimal pieces representing bit match criteria.
Values—
1 to 32
ipv4-address-mask—
Any mask expressed in dotted quad notation.
Values—
0.0.0.0 to 255.255.255.255

dst-ip

Syntax 
dst-ip {ipv6-address/prefix-length | ipv6-address ipv6-address-mask}
Context 
config>li>li-filter>li-ip-filter>entry>match
Description 

This command configures destination IPv6 address LI filter match criterion.

The no form of this command removes any configured destination IPv6 address. The match criterion is ignored.

Default 

none

Parameters 
ipv6-address—
Any IPv6 address entered as:.
Values—
x:x:x:x:x:x:x:x (eight 16-bit pieces)
x:x:x:x:x:x:d.d.d.d
x - [0 to FFFF]H
d - [0 to 255]D
prefix-length—
Prefix length.
Values—
1 to 128
ipv6-address-mask—
Any IPv6 address mask expressed as:
Values—
x:x:x:x:x:x:x:x (eight 16-bit pieces)
x:x:x:x:x:x:d.d.d.d
x - [0 to FFFF]H
d - [0 to 255]D

dst-port

Syntax 
dst-port {lt | gt | eq} dst-port-number
dst-port port-list-name
dst-port range dst-port-number dst-port-number
no dst-port
Context 
config>li>li-filter>li-ip-filter>entry>match
config>li>li-filter>li-ipv6-filter>entry>match
Description 

This command configures a destination TCP or UDP port number or port range for an IP LI filter match criterion. Note that an entry containing Layer 4 match criteria will not match non-initial (2nd, 3rd, etc) fragments of a fragmented packet since only the first fragment contains the Layer 4 information.

The no form of the command removes the destination port match criterion.

Default 

none

Parameters 
lt | gt | eq—
Specifies the operator to use relative to dst-port-number for specifying the port number match criteria.

lt Specifies all port numbers less than dst-port-number match.

gt Specifies all port numbers greater than dst-port-number match.

eq Specifies that dst-port-number must be an exact match.

eq—
Specifies the operator to use relative to dst-port-number for specifying the port number match criteria. The eq keyword specifies that dst-port-number must be an exact match.
dst-port-number—
The destination port number to be used as a match criteria expressed as a decimal integer.
Values—
0 to 65535
port-list-name—
A string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.
range start end
Specifies an inclusive range of port numbers to be used as a match criteria. The destination port numbers start-port and end-port are expressed as decimal integers.
Values—
0 to 65535

src-ip

Syntax 
src-ip {ip-address/mask | ip-address ipv4-address-mask}
Context 
config>li>li-filter>li-ip-filter>entry>match
Description 

This command configures source IP address LI filter match criterion.

The no form of this command removes any configured source IP. The match criterion is ignored.

Default 

no src-ip

Parameters 
ip-address—
Any address specified as dotted quad.
Values—
a.b.c.d
mask—
Eight 16-bit hexadecimal pieces representing bit match criteria.
Values—
1 to 32
ipv4-address-mask—
Any mask expressed in dotted quad notation.
Values—
0.0.0.0 to 255.255.255.255

src-ip

Syntax 
src-ip {ipv6-address/prefix-length | ipv6-address ipv6-address-mask}
no src-ip
Context 
config>li>li-filter>li-ipv6-filter>entry>match
Description 

This command configures source IPv6 address LI filter match criterion.

The no form of this command removes any configured source IPv6 address. The match criterion is ignored.

Default 

no src-ip

Parameters 
ipv6-address—
Any IPv6 address entered as:.
Values—
x:x:x:x:x:x:x:x (eight 16-bit pieces)
x:x:x:x:x:x:d.d.d.d
x - [0 to FFFF]H
d - [0 to 255]D
prefix-length—
Prefix length.
Values—
1 to 128
ipv6-address-mask—
Any IPv6 address mask expressed as:
Values—
x:x:x:x:x:x:x:x (eight 16-bit pieces)
x:x:x:x:x:x:d.d.d.d
x - [0 to FFFF]H
d - [0 to 255]D

src-port

Syntax 
src-port {lt | gt | eq} src-port-number
src-port port-list port-list-name
src-port range src-port-number src-port-number
no src-port
Context 
config>li>li-filter>li-ip-filter>entry>match
config>li>li-filter>li-ipv6-filter>entry>match
Description 

This command configures a source TCP or UDP port number or port range for an IP LI filter match criterion. Note that an entry containing Layer 4 match criteria will not match non-initial (2nd, 3rd, etc) fragments of a fragmented packet since only the first fragment contains the Layer 4 information.

The no form of the command removes the source port match criterion.

Default 

no src-port

Parameters 
lt | gt | eq—
Specifies the operator to use relative to src-port-number for specifying the port number match criteria.

lt Specifies all port numbers less than src-port-number match.

gt Specifies all port numbers greater than src-port-number match.

eq Specifies that src-port-number must be an exact match.

src-port-number—
The source port number to be used as a match criteria expressed as a decimal integer.
Values—
0 to 65535
port-list-name—
A string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes. <<R12.0>>
range start end
Specifies an inclusive range of port numbers to be used as a match criteria. The source port numbers start-port and end-port are expressed as decimal integers.
Values—
0 to 65535

li-filter-block-reservation

Syntax 
li-filter-block-reservation
Context 
config>li
Description 

This command enters the li-filter-block-reservation branch in order to create lawful intercept filter reservations.

li-reserved-block

Syntax 
li-reserved-block block-name [create]
no li-reserved-block block-name
Context 
config>li>li-filter-block-reservation
Description 

This command creates or edits an LI reserved block. An LI reserved block allows an operator to define where entries from an LI filter should be inserted into a normal filter. The block reserves a configurable number of entries in the normal filter that can only be used for entries inserted from associated LI filters. The LI filter entries that get inserted into the reserved block in each normal filter are not visible to non-LI operators. The block also defines to which normal filters the reservation will be applied.

Parameters 
block-name—
Specifies the name of the MAC filter. Block names cannot start with an underscore character (e.g. “_my-filter”) and cannot use the name “default”.

start-entry

Syntax 
start-entry entry-id count count
no start-entry
Context 
config>li>li-filter-block-reservation>li-reserved-block
Description 

This command defines a block of reserved filter entries that are used to insert LI filter entries into a normal filter.

Default 

no start-entry

Parameters 
entry-id—
The entry identification identifies the start of a block of reserved filter entries.
Values—
1 to 65536
count—
This parameter identifies the number of entries in the block.
Values—
1 to 8192

mac-filter

Syntax 
mac-filter filter-id
no mac-filter
Context 
config>li>li-filter-block-reservation>li-reserved-block
Description 

This command configures to which normal MAC filters the entry reservation is applied.

Parameters 
filter-id—
The filter identification identifies the normal MAC filters.
Values—
1—65536 | <name:64 char max>

ip-filter

Syntax 
ip-filter filter-name create
no ip-filter
Context 
config>li>li-filter-block-reservation>li-reserved-block
Description 

This command configures to which normal IPv4 address filters the entry reservation is applied.

Parameters 
filter-id—
The filter identification identifies the normal IPv4 address filters.
Values—
1 to 65536 | <name:64 char max>

ipv6-filter

Syntax 
ipv6-filter filter-name create
no ipv6-filter
Context 
config>li>li-filter-block-reservation>li-reserved-block
Description 

This command configures to which normal IPv6 address filters the entry reservation is applied.

Parameters 
filter-id—
The filter identification identifies the normal IPv6 address filters.
Values—
1 to 65536 | <name:64 char max>

li-filter-associations

Syntax 
li-filter-associations
Context 
config>li
Description 

This command enters the li-filter-associations branch in order to define which LI filter entries get inserted into which normal filters.

li-mac-filter

Syntax 
li-mac-filter filter-name
no li-mac-filter filter-name
Context 
config>li>li-filter-assoc
Description 

Specifies the li-mac-filter that will have its entries inserted into a list of normal mac filters.

Parameters 
filter-name—
Specifies the name of the LI MAC filter. Filter names cannot start with an underscore character (e.g. “_my-filter”) and cannot use the name “default”. 32 chars maximum.

mac-filter

Syntax 
mac-filter filter-id
no mac-filter filter-id
Context 
config>li>li-filter-assoc>li-mac-fltr
Description 

Specifies the MAC filter(s) into which the entries from the specified li-mac-filter are to be inserted. The li-mac-filter and mac-filter must already exist before the association is made. If the normal MAC filter is deleted then the association is also removed (and not re-created if the MAC filter comes into existence in the future).

Parameters 
filter-id—
The filter identification identifies the MAC filters.
Values—
1 to 65536 | <name:64 char max>

li-ip-filter

Syntax 
li-ip-filter filter-name
no li-ip-filter filter-name
Context 
config>li>li-filter-assoc
Description 

Specifies the li-ip-filter that will have its entries inserted into a list of normal IP filters.

Parameters 
filter-name—
Specifies an existing li-ip-filter. 32 chars maximum.

ip-filter

Syntax 
ip-filter filter-id
no ip-filter filter-id
Context 
config>li>li-filter-assoc>li-ip-fltr
Description 

Specifies the IP-filter(s) into which the entries from the specified li-ip-filter are to be inserted. The li-ip-filter and ip-filter must already exist before the association is made. If the normal ip-filter is deleted then the association is also removed (and not re-created if the ip-filter comes into existence in the future).

Parameters 
filter-id—
An existing IP filter policy
Values—
1 to 65536 | <name:64 char max>

li-ipv6-filter

Syntax 
li-ipv6-filter filter-name
no li-ipv6-filter filter-name
Context 
config>li>li-filter-assoc
Description 

Specifies the li-ipv6-filter that will have its entries inserted into a list of normal IPv6 filters.

Parameters 
filter-name—
An existing li-ipv6-filter. 32 chars maximum.

ipv6-filter

Syntax 
ipv6-filter filter-id
no ipv6-filter filter-id
Context 
config>li>li-fltr-assoc>li-ipv6-fltr
Description 

Specifies the IP-filter(s) into which the entries from the specified li-ipv6-filter are to be inserted. The li-ipv6-filter and ipv6-filter must already exist before the association is made. If the normal ipv6-filter is deleted then the association is also removed (and not re-created if the ipv6-filter comes into existence in the future).

Parameters 
filter-id—
An existing IPv6 filter policy
Values—
1 to 65536 | <name:64 char max>

li-filter-lock-state

Syntax 
li-filter-lock-state {locked | unlocked-for-li-users | unlocked-for-all-users}
no li-filter-lock-state
Context 
config>li
Description 

This command configures the lock state of the filters used by LI. With the configurable filter lock for LI feature an LI user can control the behavior of filters when they are used for LI.

In previous releases, when a filter entry was used as a Lawful Intercept (LI) mirror source criteria, all subsequent attempts to modify the filter were then blocked to avoid having the LI session impacted by a non-LI user.

The no form of the command reverts to the default.

Default 

locked

Parameters 
locked—
When an li-source criteria is configured that references any entry of filter Y, then filter Y can no longer be changed (until there are no longer any li-sources references to entries of filter Y).
unlocked-for-li-users—
Filters can continue to be edited by LI users only even when an li-source references an entry in that filter.
unlocked-for-all-users—
Filters can continue to be edited by all users even when an li-source references an entry in that filter.

li-source

Syntax 
[no] li-source service-id
Context 
config>li
Description 

This command configures a lawful intercept (LI) mirror source.

Parameters 
service-id—
The service identification identifies the service in the service domain. This ID is unique to this service and cannot be used by any other service, regardless of service type. The same service ID must be configured on every router that this particular service is defined on.
Values—
service-id:1 to 2147483647
svc-name:64 characters maximum

ip-filter

Syntax 
ip-filter ip-filter-id [entry entry-id...] [intercept-id intercept-id...] [session-id session-id...]
no ip-filter ip-filter-id
Context 
config>li>li-source
Description 

This command enables lawful interception (LI) of packets that match specific entries in an existing IP filter.

The ip-filter command directs packets which match the defined list of entry IDs to be intercepted to the destination referenced by the mirror-dest-service-id of the mirror-source.

The IP filter must already exist in order for the command to execute. Filters are configured in the config>filter context. If the IP filter does not exist, an error will occur. If the filter exists but has not been associated with a SAP or IP interface, an error is not generated but mirroring will not be enabled (there are no packets to mirror). Once the IP filter is defined to a SAP, IP interface or subscriber, mirroring is enabled.

If the IP filter is defined as ingress, only ingress packets are intercepted. Ingress packets are sent to the destination prior to any ingress packet modifications.

If the IP filter is defined as egress, only egress packets are intercepted. Egress packets are sent to the destination after all egress packet modifications.

An entry-id within an IP filter can only be intercepted to a single destination. If the same entry-id is defined multiple times, an error occurs and only the first definition is in effect.

By default, no packets matching any IP filters are intercepted. Interception of IP filter entries must be explicitly defined.

When the no command is executed with the entry keyword and one or more entry-id’s, interception of that list of entry-id’s is terminated within the ip-filter-id. If an entry-id is listed that does not exist, an error will occur and the command will not execute. If an entry-id is listed that is not currently being intercepted, no error will occur for that entry-id and the command will execute normally.

Parameters 
ip-filter-id—
The IP filter ID whose entries are to be intercepted. If the ip-filter-id does not exist, an error will occur and the command will not execute. Intercepting packets will commence when the ip-filter-id is defined on a SAP or IP interface.
entry entry-id
The IP filter entries to use as match criteria for lawful intercept (LI). The entry keyword begins a list of entry-id’s for interception. Multiple entry-id entries can be specified with a single command. Each entry-id must be separated by a space. Up to <N><n> 8 entry IDs may be specified in a single command.

If an entry-id does not exist within the IP filter, an error occurs and the command will not execute.

If the filter’s entry-id is renumbered within the IP filter definition, the old entry-id is removed but the new entry-id must be manually added to the configuration to include the new (renumbered) entry’s criteria.

intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.
Values—
1 to 4294967295 (32b) for nat li-source entries that are using a mirror service that is not configured with routable encap
1 to 1073741824 (30b) for all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and no direction-bit.
1 to 536870912 (29b) for all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and with the direction-bit enabled.
session-id session-id
This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim). For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.
Values—
1 to 4,294,967,295 (32b)

ipv6-filter

Syntax 
ipv6-filter ipv6-filter-id [entry entry-id...] [intercept-id intercept-id...] [session-id session-id...]
no ipv6-filter ipv6-filter-id
Context 
config>li>li-source
Description 

This command enables lawful interception (LI) of packets that match specific entries in an existing IPv6 filter. This command applies only to the 7750 SR and 7950 XRS.

The ipv6-filter command directs packets which match the defined list of entry IDs to be intercepted to the destination referenced by the mirror-dest-service-id of the mirror-source.

The IPv6 filter must already exist in order for the command to execute. Filters are configured in the config>filter context. If the IPv6 filter does not exist, an error will occur. If the filter exists but has not been associated with a SAP or IPv6 interface, an error is not generated but mirroring will not be enabled (there are no packets to mirror). Once the IPv6 filter is defined to a SAP, IPv6 interface or subscriber, mirroring is enabled (subscriber mirroring applies only to the 7750 SR).

If the IPv6 filter is defined as ingress, only ingress packets are intercepted. Ingress packets are sent to the destination prior to any ingress packet modifications.

If the IPv6 filter is defined as egress, only egress packets are intercepted. Egress packets are sent to the destination after all egress packet modifications.

An entry-id within an IPv6 filter can only be intercepted to a single destination. If the same entry-id is defined multiple times, an error occurs and only the first definition is in effect.

By default, no packets matching any IPv6 filters are intercepted. Interception of IPv6 filter entries must be explicitly defined.

When the no command is executed with the entry keyword and one or more entry-id’s, interception of that list of entry-id’s is terminated within the ipv6-filter-id. If an entry-id is listed that does not exist, an error will occur and the command will not execute. If an entry-id is listed that is not currently being intercepted, no error will occur for that entry-id and the command will execute normally.

Parameters 
ipv6-filter-id—
The IPv6 filter ID whose entries are to be intercepted. If the ipv6-filter-id does not exist, an error will occur and the command will not execute. Intercepting packets will commence when the ipv6-filter-id is defined on a SAP or IPv6 interface.
entry entry-id
The IPv6 filter entries to use as match criteria for lawful intercept (LI). The entry keyword begins a list of entry-id’s for interception. Multiple entry-id entries can be specified with a single command. Each entry-id must be separated by a space. Up to <N><n> 8 entry IDs may be specified in a single command.

If an entry-id does not exist within the IPv6 filter, an error occurs and the command will not execute.

If the filter’s entry-id is renumbered within the IPv6 filter definition, the old entry-id is removed but the new entry-id must be manually added to the configuration to include the new (renumbered) entry’s criteria.

intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.
Values—
1 to 4294967295 (32b) For nat li-source entries that are using a mirror service that is not configured with routable encap
Values—
1t o 1,073,741,824 (30b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and no direction-bit.
Values—
1 to 536,870,912 (29b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and with the direction-bit enabled.
session-id session-id
This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim). For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.
id—
The session-id value to insert into the header of the mirrored packets.
Values—
1 to 4,294,967,295 (32b)

li-ip-filter

Syntax 
li-ip-filter filter-name entry li-entry-id [li-entry-id...(upto 8 max)] [intercept-id intercept-id [intercept-id...(upto 8 max)]] [session-id session-id [session-id...(upto 8 max)]]
no li-ip-filter filter-name [entry li-entry-id [li-entry-id...(upto 8 max)]]
Context 
config>li>li-source
Description 

This command enables lawful interception (LI) of packets that match specific entries in an existing LI IP filter that has been associated with a normal IP filter. The specification of an li-ip-filter entry as an li-source means that packets matching the li-ip-filter entry will be intercepted on all interfaces/saps/etc. where the associated normal ip-filter(s) are applied.

Parameters 
filter-name—
The name of the li-ip-filter. 32 characters maximum
entry li-entry-id
The entry id in the li-ip-filter that is to be used as an li-source criteria.
Values—
1 to 65535
intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.
session-id session-id
The session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (con¬fig>mirror>mirror-dest>encap#ip-udp-shim). For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.

li-ipv6-filter

Syntax 
li-ipv6-filter filter-name entry li-entry-id [li-entry-id...(upto 8 max)] [intercept-id intercept-id [intercept-id...(upto 8 max)]] [session-id session-id [session-id...(upto 8 max)]]
no li-ipv6-filter filter-name [entry li-entry-id [li-entry-id...(upto 8 max)]]
Context 
config>li>li-source
Description 

This command enables lawful interception (LI) of packets that match specific entries in an existing LI IPv6 filter that has been associated with a normal IPv6 filter. The specification of an li-ipv6-filter entry as an li-source means that packets matching the li-ipv6-filter entry will be intercepted on all interfaces/saps/etc. where the associated normal ip-filter(s) are applied.

Parameters 
filter-name—
The name of the li-ipv6-filter. 32 characters maximum.
entry li-entry-id
The entry id in the li-ipv6-filter that is to be used as an li-source criteria.
Values—
1 to 65535
intercept-id intercept-id
The intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.
session-id session-id
The session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim). For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.

li-mac-filter

Syntax 
li-mac-filter filter-name entry li-entry-id [li-entry-id...(upto 8 max)] [intercept-id intercept-id [intercept-id...(upto 8 max)]] [session-id session-id [session-id...(upto 8 max)]]
no li-mac-filter filter-name [entry li-entry-id [li-entry-id...(upto 8 max)]]
Context 
config>li>li-source
Description 

This command enables lawful interception (LI) of packets that match specific entries in an existing LI MAC filter that has been associated with a normal MAC filter. The specification of an li-mac-filter entry as an li-source means that packets matching the li-mac-filter entry will be intercepted on all interfaces/saps/etc where the associated normal mac-filter(s) are applied.

Parameters 
filter-name—
The name of the li-mac-filter. 32 characters maximum.
li-entry-id—
The entry id in the li-mac-filter that is to be used as an li-source criteria.
Values—
1 to 65535
intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.
session-id session-id
This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim). For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.

mac-filter

Syntax 
mac-filter mac-filter-id entry [entry-id...] [intercept-id intercept-id...] [session-id session-id...]
no mac-filter mac-filter-id
Context 
config>li>li-source
Description 

This command enables lawful interception (LI) of packets that match specific entries in an existing MAC filter. Multiple entries can be created using unique entry-id numbers within the filter. The router implementation exits the filter on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

An entry may not have any match criteria defined (in which case, everything matches) but must have at least the keyword action for it to be considered complete. Entries without the action keyword will be considered incomplete and hence will be rendered inactive.

An entry-id within an MAC filter can only be intercepted to a single destination. If the same entry-id is defined multiple times, an error occurs and only the first definition is in effect.

The no form of the command removes the specified entry from the IP or MAC filter. Entries removed from the IP or MAC filter are immediately removed from all services or network ports where that filter is applied.

Parameters 
mac-filter-id—
Specifies the MAC filter ID. If the mac-filter-id does not exist, an error will occur and the command will not execute.
entry entry-id
The MAC filter entries to use as match criteria.
intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.
Values—
1 to 4294967295 (32b) For nat li-source entries that are using a mirror service that is not configured with routable encap
Values—
1 to 1,073,741,824 (30b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and no direction-bit.
Values—
1 to 536,870,912 (29b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and with the direction-bit enabled.
session-id session-id
This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim). For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.
Values—
1 to 4,294,967,295 (32b)

nat

Syntax 
nat
Context 
config>li>li-source
Description 

This command enables the context to configure LI NAT parameters and only applies to the 7450 ESS and 7750 SR.

classic-lsn-sub

Syntax 
[no] classic-lsn-sub router router-instance ip ip-address
Context 
config>li>li-source>nat
Description 

This command configures a classic LSN subscriber sources and only applies to the 7450 ESS and 7750 SR.

The no form of the command removes the parameter from the configuration.

Parameters 
router router-instance
Specifies the router instance the pool belongs to, either by router name or service ID.
Values—
router-name: “Base” | “management”
Values—
Base
ip ip-address
Specifies the IP address in a.b.c.d format.

intercept-id

Syntax 
intercept-id id
no intercept-id
Context 
config>li>li-source>nat>classic-lsn-sub
config>li>li-source>nat>dslite-lsn-sub
config>li>li-source>nat>ethernet-header
config>li>li-source>nat>l2-aware-sub
config>li>li-source>nat>nat64-lsn-sub
Description 

This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs.

For nat mirroring (a nat li-source entry type), when the mirror service is not configured with any routable encap (for example, no ip-udp-shim or ip-gre configured under config>mirror>mirror-dest>encap), the presence of a configured intercept-id against an li-source (nat) entry will cause the insertion of the intercept-id after a configurable mac-da, mac-sa and etype (configured under li-source>nat>ethernet-header), at the front of each packet mirrored for that particular li-source entry. If there is no intercept-id configured (for a nat entry using a mirror service without routable encap), then a configurable mac-da and mac-sa are added to the front of the packets (but no intercept-id). In both cases a non-configurable etype is also added immediately before the mirrored customer packet. Note that routable encapsulation configured in the mirror-dest takes precedence over the ethernet-header configuration in the li-source nat entries. If routable encapsulation is configured, then the ethernet-header config is ignored and no mac header is added to the packet (the encap is determined by the mirror-dest in this case).

For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.

The no form of the command removes the value from the configuration.

Default 

no intercept-id (an id of 0, or no id)

Parameters 
id
The intercept-id value to insert into the header of the mirrored packets.
Values—
1 to 4294967295 (32b) For nat li-source entries that are using a mirror service that is not configured with routable encap
Values—
1 to 1,073,741,824 (30b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and no direction-bit.
Values—
1 to 536,870,912 (29b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and with the direction-bit enabled.

session-id

Syntax 
session-id id
no session-id
Context 
config>li>li-source>nat>classic-lsn-sub
config>li>li-source>nat>dslite-lsn-sub
config>li>li-source>nat>ethernet-header
config>li>li-source>nat>l2-aware-sub
config>li>li-source>nat>nat64-lsn-sub
Description 

This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs.

The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap# ip-gre-shim).

For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.

The no form of the command removes the session-id from the configuration which results in the default value being used.

Default 

no session-id (an id of 0, or no id)

Parameters 
id—
The session-id value to insert into the header of the mirrored packets.
Values—
1 to 4,294,967,295 (32b)

dslite-lsn-sub

Syntax 
[no] dslite-lsn-sub router router-instance b4 ipv6-prefix
Context 
config>li>li-source>nat
Description 

This command configures the Dual Stack Lite LSN subscriber source and only applies to the 7450 ESS and 7750 SR.

The no form of the command removes the value from the configuration.

Parameters 
router router-instance
Specifies the router instance the pool belongs to, either by router name or service ID.
Values—
router-name: “Base” | “management”
Values—
Base
b4 ipv6-prefix
Specifies the IPv6 address.
Values—

ipv6-prefix:

<prefix>/<length>

prefix

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x to [0 to FFFF]H

d t o[0t o 255]D

<length>

[0 to 128]

ethernet-header

Syntax 
ethernet-header [da ieee-address] [sa ieee-address] [etype ethertype]
no ethernet-header
Context 
config>li>li-source>nat
Description 

This command configures the Ethernet header for the NAT sources and only applies to the 7450 ESS and 7750 SR.

The no form of the command removes the values from the configuration.

l2-aware-sub

Syntax 
[no] l2-aware-sub sub-ident-string
Context 
config>li>li-source>nat
Description 

This command configures a Layer-2-Aware subscriber source and only applies to the 7450 ESS and 7750 SR.

The no form of the command removes the values from the configuration.

Parameters 
sub-ident-string—
Specifies a source name.

sap

Syntax 
sap sap-id {[ingress] [egress]} [intercept-id intercept-id...] [session-id session-id...]
no sap sap-id
Context 
config>li>li-source
Description 

This command creates a service access point (SAP) within an LI configuration. The specified SAP must define a FastE, GigE, or XGigE, or XGigE access port with a dot1q, null, or q-in-q encapsulation type.

The intercept-id parameter configures the intercept IDs that is inserted into the packet header for all mirrored packets of the associated li-source entry.

The session-id parameter inserts the specified IDs into the packet header for all mirrored packets of the associated li-source entry.

When the no form of this command is used on a SAP, the SAP with the specified port and encapsulation parameters is deleted.

Default 

none

Parameters 
sap-id—
Specifies the physical port identifier portion of the SAP definition.
egress—
Specifies that packets egressing the SAP should be mirrored. Egress packets are mirrored to the mirror destination after egress packet modification.
ingress—
Specifies that packets ingressing the SAP should be mirrored. Ingress packets are mirrored to the mirror destination prior to ingress packet modification.
intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs.

For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.

Values—
1 to 4294967295 (32b) For nat li-source entries that are using a mirror service that is not configured with routable encap
Values—
1 to 1,073,741,824 (30b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and no direction-bit.
Values—
1 to 536,870,912 (29b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and with the direction-bit enabled.
session-id session-id
This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs.

The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim).

For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.

Values—
1 to 4,294,967,295 (32b)

subscriber

Syntax 
subscriber sub-ident-string [sap sap-id [ip ip-address] [mac ieee-address]|sla-profile sla-profile-name] [fc {[be] [l2] [af] [l1] [h2] [ef] [h1] [nc]}] {[ingress] [egress]} [intercept-id intercept-id...] [session-id session-id...]
no subscriber sub-ident-string
Context 
config>li>li-source
Description 

This command adds hosts of a subscriber to mirroring service and only applies to the 7450 ESS and 7750 SR.

Parameters 
sub-ident-string—
Specifies the name of the subscriber identification policy.
sap-id—
Specifies the physical port identifier portion of the SAP definition.
ip-address—
The service IP address (system IP address) of the remote device sending LI traffic. If 0.0.0.0 is specified, any remote router is allowed to send to this service.
Values—
1.0.0.1 to 223.255.255.254
mac mac-address
Specify this optional parameter when defining a static host. The MAC address must be specified for anti-spoof ip-mac and arp-populate. Multiple static hosts may be configured with the same MAC address given that each definition is distinguished by a unique IP address.
sla-profile-name—
Each host of a subscriber can use a different sla-profile. This option allows interception of only the hosts using the specified sla-profile. In some deployments sla-profiles are assigned per type of traffic. There can be, for example, a specific sla-profile for voice traffic (which could be used for all SIP-hosts).
Values—
32 characters maximum.
fc—
The name of the forwarding class with which to associate LI traffic. The forwarding class name must already be defined within the system. If the fc-name does not exist, an error will be returned and the fc command will have no effect. If the fc-name does exist, the forwarding class associated with fc-name will override the default forwarding class.
Values—
be, l2, af, l1, h2, ef, h1, nc
ingress—
Specifies information for the ingress policy.
egress—
Specifies information for the egress policy.
intercept-id intercept-id
This command configures the intercept-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This intercept-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs.

For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, an intercept-id field (as part of the routable encap) is always present in the mirrored packets. If there is no intercept-id configured for an li-source entry, then the default value will be inserted. When the mirror service is configured with ip-gre routable encap, no intercept-id is inserted and none should be specified against the li-source entries.

Values—
1 to 4294967295 (32b) For nat li-source entries that are using a mirror service that is not configured with routable encap
Values—
1 to 1,073,741,824 (30b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and no direction-bit.
Values—
1 to 536,870,912 (29b) For all types of li-source entries that are using a mirror service with routable ip-udp-shim encap and with the direction-bit enabled.
session-id session-id
This command configures the session-id that is inserted into the packet header for all mirrored packets of the associated li-source entry. This session-id can be used (for example by a downstream LI Gateway) to identify the particular LI session to which the packet belongs. The session-id is only valid and used for mirror services that are configured with ip-udp-shim routable encap (config>mirror>mirror-dest>encap#ip-udp-shim).

For all types of li-source entries (filter, nat, sap, subscriber), when the mirror service is configured with ip-udp-shim routable encap, a session-id field (as part of the routable encap) is always present in the mirrored packets. If there is no session-id configured for an li-source entry, then the default value will be inserted. When a mirror service is configured with ip-gre routable encap, no session-id is inserted and none should be specified against the li-source entries.

Values—
1 to 4,294,967,295 (32b)

wlan-gw

Syntax 
wlan-gw
Context 
config>li>li-source
Description 

This command enters the wlan-gw context under li-source to create li-source related configuration.

Default 

none

dsm-subscriber

Syntax 
[no] dsm-subscriber mac xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx
Context 
config>li>li-source>wlan-gw
Description 

This command configures the DSM UE source.

Default 

none

Parameters 
mac xx:xx...
Specifies the MAC address.
Values—
mac-addr: xx:xx:xx:xx:xx:xx example: 00:0c:f1:99:85:b8
or XX:XX:XX:XX:XX:XX example: 00-0C-F1-99-85-B8

intercept-id

Syntax 
intercept-id [1..4294967295]
no intercept-id
Context 
config>li>li-source>wlan-gw
Description 

This command configures the intercept-id inserted in the packet header for all mirrored packets of the associated li-source. When the mirror-service is configured with the ip-udp-shim routable encaps, intercept-id field (as part of the routable encap) is always present in the mirrored packets. The intercept-id can be used by the LIG to identify a particular LI session to which the packet belongs.

Default 

none

Parameters 
1..4294967295—
Specifies the intercept ID inserted in the LI header.

session-id

Syntax 
session-id [1..4294967295]
no session-id
Context 
config>li>li-source>wlan-gw
Description 

This command configures the session-id inserted in the packet header for all mirrored packets of the associated li-source. When the mirror-service is configured with the ip-udp-shim routable encaps, session-id field (as part of the routable encap) is always present in the mirrored packets. The session-id can be used by the LIG to identify a particular LI session to which the packet belongs.

Default 

none

Parameters 
1..4294967295—
The session-id inserted in the LI header.

log

Syntax 
log
Context 
config>li
Description 

This command enables the context to configure an event log for Lawful Intercept.

log-id

Syntax 
[no] log-id log-id
Context 
config>li>log
Description 

This command configures an LI event log destination. The log-id is used to direct events, alarms/traps, and debug information to respective destinations.

Parameters 
log-id—
The log ID number, expressed as a decimal integer.
Values—
1 to 100

filter

Syntax 
filter filter-id
no filter
Context 
config>li>log>log-id
Description 

This command adds an event filter policy with the log destination.

The filter command is optional. If no event filter is configured, all events, alarms and traps generated by the source stream will be forwarded to the destination.

An event filter policy defines (limits) the events that are forwarded to the destination configured in the log-id. The event filter policy can also be used to select the alarms and traps to be forwarded to a destination snmp-trap-group.

The application of filters for debug messages is limited to application and subject only.

Accounting records cannot be filtered using the filter command.

Only one filter-id can be configured per log destination.

The no form of the command removes the specified event filter from the log-id.

Default 

no filter — No event filter policy is specified for a log-id.

Parameters 
filter-id—
The event filter policy ID is used to associate the filter with the log-id configuration. The event filter policy ID must already be defined in config>log>filter filter-id.
Values—
1 to 1000

from

Syntax 
from {[li]}
no from
Context 
config>li>log>log-id
Description 

This command configures a bit mask that specifies the log event source stream(s) to be forwarded to the destination specified in the log destination (memory, session, SNMP). Events from more than one source can be forwarded to the log destination.

Parameters 
li—
Specifies the li event stream that contains all events configured for Lawful Intercept activities.

If the requester does not have access to the li context, the event stream will fail.

time-format

Syntax 
time-format {local | utc}
Context 
config>li>log>log-id
Description 

This command specifies whether the time should be displayed in local or Coordinated Universal Time (UTC) format.

Default 

utc

Parameters 
local —
Specifies that timestamps are written in the system’s local time.
utc—
Specifies that timestamps are written using the UTC value. This was formerly called Greenwich Mean Time (GMT) and Zulu time.

to

Syntax 
to memory [size]
to session
to snmp [size]
Context 
config>li>log>log-id
Description 

This command enables the context to configure the destination type for the event log.

The source of the data stream must be specified in the from command prior to configuring the destination with the to command.

The to command cannot be modified or re-entered. If the destination or maximum size of an SNMP or memory log needs to be modified, the log ID must be removed and then re-created.

Parameters 
size—
The size parameter indicates the number of events that can be stored into memory.
Values—
100
Values—
50 to 1024

save

Syntax 
save
Context 
config>li
Description 

This command is required to save LI configuration parameters.

df-peer

Syntax 
df-peer df-peer-id df2-addr ip-address df2-port port df3-addr ip-address df3-port port
no df-peer df-peer-id
Context 
config>li>mobile
Description 

This command provisions a Delivery Function Peer, which includes Delivery Function2 used for IRI as well as Delivery Function3 used for CC, of a Lawful Intercept Gateway. This command only applies to the 7450 ESS and 7750 SR.

The no form of the command removes the Delivery Function Peer information from the configuration.

Parameters 
df-peer-id—
Configures Delivery Function Peer parameters.
Values—
1 to 16
df2-addr ip-address
Specifies the Delivery Function2 address. This is the IP address of the Delivery Function where the IRI is to be sent.
df2-port port
Specifies the DF2 port number. This is the TCP port of the Delivery Function where the IRI is to be sent.
df3-addr ip-address
Specifies the Delivery Function3 address. This is the IP address of the Delivery Function where the CC is to be sent.
df3-port port
Specifies the DF3 port number. This is the TCP port of the Delivery Function where the CC is to be sent.

local-interface

Syntax 
local-interface ip-address [router router-instance]
no local-interface
Context 
config>li>mobile
Description 

This command configures the source IP address used by the xGW/GGSN for Lawful Intercept (LI) interface. This command only applies to the 7450 ESS and 7750 SR.

The no form of the command reverts to the default.

Default 

no local-interface

Parameters 
ip-address—
Specifies the source IP address.
Values—

ipv4-address

a.b.c.d

ipv6-address

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x to [0 to FFFF]H

d to [0 to 255]D

router router-instance
Specifies the router instance up to 32 characters in length.

target

Syntax 
target target-type id string intercept intercept peer df-peer-id [liid li-identifier]
no target target-type id string
Context 
config>li>mobile
Description 

This command configures a target for interception and assigns the Delivery Function Peer that receives the Intercept Related Information (IRI) and Content of Communication (CC) for this target. This command only applies to the 7450 ESS and 7750 SR.

All IRI and CC messages for this target are sent to the newly specified DF peer, subsequent to target modifications.

Only IMSI is currently supported as a target Identifier initially. Modifying the target command’s parameters does not require a shutdown/no shutdown of the GW.

The no form of the command de-activates a target that is being intercepted.

Parameters 
target-type—
Specifies the type of surveillance target identifier to be provisioned.
Values—
imsi, imei, msisdn
id string
uniquely identifies a target for the interception up to 15 characters in length.
liid li-identifier
uniquely identifies the LI identifier up to 25 characters in length.
intercept intercept
Specifies the interception type for the target. The intercept type is allowed to change from IRI to IRI+CC and from IRI+CC to IRI,
Values—
iri — Intercept Related Information iricc —Intercept Related Information (IRI) and Content of Communication (CC)
Values—
iri
peer df-peer-id
Specifies the Delivery Function (DF) Peer associated with the target.
Values—
1 to 16
Values—
1

x2-iri-qos

Syntax 
[no] x2-iri-qos dscp {dscp-value | dscp-name}
Context 
config>li>mobile
Description 

This command specifies the DSCP to be set for IRI (Intercept Related Information) messages sent to a LIG (Lawful Intercept Gateway). The no form of the command reverts to the default. This command only applies to the 7450 ESS and 7750 SR.

Default 

disable

Parameters 
dscp-value—
Specifies the DSCP value.
Values—
0 to 63
dscp-name—
Specifies the DSCP name.
Values—
none|be|ef|cp1|cp2|cp3|cp4|cp5|cp6|cp7|cp9|cs1|cs2| cs3|cs4|cs5|nc1|nc2|af11|af12|af13|af21|af22|af23| af31|af32|af33|af41|af42|af43|cp11|cp13|cp15|cp17| cp19|cp21|cp23|cp25|cp27|cp29|cp31|cp33|cp35|cp37| cp39|cp41|cp42|cp43|cp44|cp45|cp47|cp49|cp50|cp51| cp52|cp53|cp54|cp55|cp57|cp58|cp59|cp60|cp61|cp62|cp63

x3-cc-qos

Syntax 
[no] x3-cc-qos dscp {dscp-value | dscp-name}
Context 
config>li>mobile
Description 

This command specifies the DSCP to be set for CC (content of Communication) traffic sent to a LIG (Lawful Intercept Gateway). The no form of the command reverts to the default. This command only applies to the 7450 ESS an 7750 SR.

Applies to Transport Protocol and ULIC-Header versions:

  1. TCP with ULICv1
  2. UDP with ULICv1
  3. UDP with ULICv0
Default 

disable

Parameters 
dscp-value—
Specifies the DSCP value.
Values—
0 to 63
dscp-name—
Specifies the DSCIP name.
Values—
none|be|ef|cp1|cp2|cp3|cp4|cp5|cp6|cp7|cp9|cs1|cs2| cs3|cs4|cs5|nc1|nc2|af11|af12|af13|af21|af22|af23| af31|af32|af33|af41|af42|af43|cp11|cp13|cp15|cp17| cp19|cp21|cp23|cp25|cp27|cp29|cp31|cp33|cp35|cp37| cp39|cp41|cp42|cp43|cp44|cp45|cp47|cp49|cp50|cp51| cp52|cp53|cp54|cp55|cp57|cp58|cp59|cp60|cp61|cp62|cp63

x3-transport

Syntax 
x3-transport {tcp | udp} ulic-header {v0 | v1}
Context 
config>li>mobile
Description 

This command specifies the transport option for an X3 interface, along with the ULIC Header version to be used. The same transport option is supported to all the Delivery Function (DF) peers in a service provider network. Changing the option requires a GW shutdown/no shutdown. This command applies only to the 7450 ESS and 7750 SR.

Following are the valid combinations of Transport protocol and ULIC Header versions supported:

  1. TCP with ULIC Header v1
  2. UDP with ULIC Header v1
  3. UDP with ULIC Header v0

The no form of the command reverts to the default.

Default 

disable

Parameters 
tcp—
Specifies to use TCP as the transport option for an X3 interface.
Values—
Only ULIC Header V1 is supported with this option.
udp—
Specifies to use UDP as the transport option for an X3 interface.
Values—
Only ULIC Header V0 is supported with this option.
ulic-header—
Specifies the header option.
v0—
Specifies ULIC v0 Header option.
v1—
Specifies ULIC v1 Header option.

operator

Syntax 
operator-id op_id
no operator-id
Context 
config>li>mobile
Description 

This command is used to configure the operator identifier for an operator’s deployment. The configured value is used to populate the operator-identifier field of the Network-Identifier IE. The “No” form of the command reverts to the default. This command applies only to the 7450 ESS and 7750 SR.

Default 

op_id

Parameters 
op-id
Specifies the operator identifier, string of up to 5 alphanumeric characters.

Other LI Configuration Commands

The following commands are also described in the Basic System Configuration Guide. Other LI commands are described in the System Management Guide.

li-local-save

Syntax 
[no] li-local-save
Context 
bof
Description 

This command specifies whether or not lawful intercept (LI) configuration is allowed to be save to a local file. Modifying this command will not take affect until the system is rebooted.

Default 

li-local-save

li-separate

Syntax 
[no] li-separate
Context 
bof
Description 

This command specifies whether or not a non-LI user has access to lawful intercept (LI) information. When this command is enabled, a user who does not have LI access will not be allowed to access CLI or SNMP objects in the li context. Modifying this command will not take affect until the system is rebooted.

When the no li-separate command is set (the default mode), those who are allowed access to the config>system>security>profile context and user command nodes are allowed to modify the configuration of the LI parameters. In this mode, a user that has a profile allowing access to the config>li and/or show>li command contexts can enter and use the commands under those nodes.

When the li-separate command is configured, only users that have the LI access capabilities set in the config>system>security>user>access li context are allowed to access the config>li and/or show>li command contexts. A user who does not have LI access is not allowed to enter the config>li and show>li contexts even though they have a profile that allows access to these nodes. When in the li-separate mode, only users with config>system>security>user>access li set in their user account have the ability modify the setting LI parameters in either their own or others profiles and user configurations.

Default 

no li-separate

access

Syntax 
[no] access [ftp] [snmp] [console] [li]
Context 
config>>system>security>user
Description 

This command grants a user permission for FTP, SNMP, console or lawful intercept (LI) access.

If a user requires access to more than one application, then multiple applications can be specified in a single command. Multiple commands are treated additively.

The no form of command removes access for a specific application.

no access denies permission for all management access methods. To deny a single access method, enter the no form of the command followed by the method to be denied, for example, no access FTP denies FTP access.

Default 

No access is granted to the user by default.

Parameters 
ftp—
Specifies FTP permission.
snmp—
Specifies SNMP permission. This keyword is only configurable in the config>system>security>user context and applies to the 7450 ESS and 7750 SR.
console—
Specifies console access (serial port or Telnet) permission.
li—
Allows user to access CLI commands in the lawful intercept (LI) context.

profile

Syntax 
[no] profile user-profile-name
Context 
config>system>security
Description 

This command creates a context to create user profiles for CLI command tree permissions.

Profiles are used to either deny or permit user console access to a hierarchical branch or to specific commands.

Once the profiles are created, the user command assigns users to one or more profiles. You can define up to 16 user profiles but a maximum of 8 profiles can be assigned to a user. The user-profile-name can consist of up to 32 alphanumeric characters.

The no form of the command deletes a user profile.

Default 

user-profile default

Parameters 
user-profile-name—
The user profile name entered as a character string. The string is case sensitive and limited to 32 ASCII 7-bit printable characters with no spaces.

li

Syntax 
li
Context 
config>system>security>profile
Description 

This command enables the Lawful Intercept (LI) profile identifier.

Default 

no li