For feedback, use the following:
ipd_online_feedback@alcatel-lucent.com
Table of Contents Previous Next Index PDF

Triple Play Security Configuration Commands
Topics in this section include:
•
Triple Play Anti-Spoofing Commands
•
Triple Play Layer 2 Security Commands
•
ARP Handling Commands
•
Show Commands
 
 
Triple Play Anti-Spoofing Commands
anti-spoof
Syntax 
anti-spoof {ip | mac | ip-mac}
no anti-spoof
Context 
config>service>vpls>sap
config>service>ies>if>sap
Description 
This command enables anti-spoof filtering and optionally changes the anti-spoof matching type for the SAP.
The type of anti-spoof filtering defines what information in the incoming packet is used to generate the criteria to lookup an entry in the anti-spoof filter table. The type parameter (ip, mac, ip-mac) defines the anti-spoof filter type enforced by the SAP when anti-spoof filtering is enabled.
The no form of the command disables anti-spoof filtering on the SAP.
Default 
no anti-spoof
Parameters 
ip
Configures SAP anti-spoof filtering to use only the source IP address in its lookup. If a static host exists on the SAP without an IP address specified, the anti-spoof ip command will fail.
mac
Configures SAP anti-spoof filtering to use only the source MAC address in its lookup. If a static host exists on the SAP without a specified MAC address, the anti-spoof mac command will fail.
ip-mac
Configures SAP anti-spoof filtering to use both the source IP address and the source MAC address in its lookup. If a static host exists on the SAP without both the IP address and MAC address specified, the anti-spoof ip-mac command will fail.
anti-spoof
Syntax 
anti-spoof {ip | ip-mac}
no anti-spoof
Context 
config>service>ies>subscriber-interface>grp-if>sap
Description 
This command enables anti-spoof filtering and optionally change the anti-spoof matching type for the SAP.
The type of anti-spoof filtering defines what information in the incoming packet is used to generate the criteria to lookup an entry in the anti-spoof filter table. The type parameter (ip, ip-mac) defines the anti-spoof filter type enforced by the SAP when anti-spoof filtering is enabled.
The no form of the command disables anti-spoof filtering on the SAP.
Default 
no anti-spoof
Parameters 
ip
Configures SAP anti-spoof filtering to use only the source IP address in its lookup. If a static host exists on the SAP without an IP address specified, the anti-spoof ip command will fail.
ip-mac
Configures SAP anti-spoof filtering to use both the source IP address and the source MAC address in its lookup. If a static host exists on the SAP without both the IP address and MAC address specified, the anti-spoof ip-mac command will fail.
Triple Play Layer 2 Security Commands
split-horizon-group
Syntax 
[no] split-horizon-group [group-name] [residential-group]
Context 
config>service>vpls
Description 
This command creates a new split horizon group for the VPLS instance. Traffic arriving on a SAP or spoke SDP within this split horizon group will not be copied to other SAPs or spoke SDPs in the same split horizon group.
A split horizon group must be created before SAPs and spoke SDPs can be assigned to the group.
The split horizon group is defined within the context of a single VPLS. The same group-name can be re-used in different VPLS instances.
Up to 30 split horizon groups can be defined per VPLS instance.
The no form of the command removes the group name from the configuration.
Parameters 
group-name
Specifies the name of the split horizon group to which the SDP belongs.
residential-group
Defines a split horizon group as a residential split horizon group (RSHG). Doing so entails that:
a) SAPs which are members of this Residential Split Horizon Group will have:
–
Double-pass queuing at ingress as default setting (can be disabled)
–
STP disabled (can not be enabled)
–
ARP reply agent enabled per default (can be disabled)
–
MAC pinning enabled per default (can be disabled)
–
Besides the multicast downstream also broadcast packets are discarded thus also blocking the unknown, flooded traffic.
b) Spoke SDPs which are members of this Residential Split Horizon Group will have:
–
Downstream multicast traffic supported
–
Double-pass queuing is not applicable
–
STP is disabled (can be enabled)
–
ARP reply agent is not applicable (dhcp-lease-states are not supported on spoke SDPs)
–
MAC pinning enabled per default (can be disabled)
Default 
A split horizon group is by default not created as a residential-group.
 
mac-protect
Syntax 
mac-protect
Context 
config>service>vpls
Description 
This command indicates whether or not this MAC is protected on the MAC protect list. When enabled, the agent will protect the MAC from being learned or re-learned on a SAP, spoke SDP or mesh-SDP that has restricted learning enabled. The MAC protect list is used in conjunction with restrict-protected-src, restrict-unprotected-dst and auto-learn-mac-protect.
Default 
disabled
mac
Syntax 
[no] mac ieee-address
Context 
config>service>vpls>mac-protect
Description 
This command specifies the 48-bit IEEE 802.3 MAC address.
Parameters 
ieee-address
Specifies the 48-bit MAC address in the form aa:bb:cc:dd:ee:ff or aa-bb-cc-dd-ee-ff where aa, bb, cc, dd, ee, and ff are hexadecimal numbers.
[no] auto-learn-mac-protect
Syntax 
auto-learn-mac-protect
no auto-learn-mac-protect
Context 
config>service>vpls>sap
config>service>vpls>spoke-sdp
config>service>vpls >mesh-sdp
config>service>vpls>split-horizon-group
config>service>vpls>endpoint
config>service>pw-template
config>service>pw-template>split-horizon-group
Description 
This command enables the automatic protection of source MAC addresses learned on the associated object. MAC protection is used in conjunction with restrict-protected-src, restrict-unprotected-dst and mac-protect. When this command is applied or removed, the MAC addresses are cleared from the related object.
When the auto-learn-mac-protect is enabled on an SHG the action only applies to the associated SAPs (no action is taken by default for spoke SDPs in the SHG). In order to enable this function for spoke SDPs within a SHG, the auto-learn-mac-protect must be enabled explicitly under the spoke-SDP. If required, auto-learn-mac-protect can also be enabled explicitly under specific SAPs within the SHG.
Default 
no auto-learn-mac-protect
restrict-protected-src
Syntax 
restrict-protected-src [alarm-only | discard-frame]
no restrict-protected-src
Context 
config>service>vpls>sap
config>service>vpls>spoke-sdp
config>service>vpls>mesh-sdp
config>service>vpls>split-horizon-group
config>service>vpls>endpoint
config>service>pw-template>
config>service>pw-template>split-horizon-group
Description 
This command indicates how the agent will handle relearn requests for protected MAC addresses, either manually added using the mac-protect command or automatically added using the auto-learn-mac-protect command. While enabled all packets entering the configured SAP, spoke-SDP, mesh-SDP , or any SAP that is part of the configured split horizon group (SHG) will be verified not to contain a protected source MAC address. If the packet is found to contain such an address, the action taken depends on the parameter specified on the restrict-protected-src command, namely:
•
No parameter
The packet will be discarded, an alarm will be generated and the SAP, spoke-SDP or mesh-SDP will be set operationally down. The SAP, spoke-SDP or mesh-SDP must be shutdown and enabled (no shutdown) for this state to be cleared.
•
alarm-only
The packet will be forwarded, an alarm will be generated but the source MAC is not learned on the SAP/spoke-SDP/mesh-SDP.
•
discard-frame
The packet will be discarded and an alarm generated. The frequency of alarm generation is fixed to be at most one alarm per MAC address per FP2 per 10 minutes in a given VPLS service. This parameter is only applicable to automatically protected MAC addresses.
When the restrict-protected-src is enabled on an SHG the action only applies to the associated SAPs (no action is taken by default for spoke SDPs in the SHG). In order to enable this function for spoke SDPs within a SHG, the restrict-protected-src must be enabled explicitly under the spoke-SDP. If required, restrict-protected-src can also be enabled explicitly under specific SAPs within the SHG.
When this command is applied or removed, with either the alarm-only or discard-frame parameters, the MAC addresses are cleared from the related object.
The use of “restrict-protected-src discard-frame” is mutually exclusive with both the “restrict-protected-src [alarm-only]” command and with the configuration of manually protected MAC addresses within a given VPLS. “restrict-protected-src discard-frame” can only be enabled on SAPs on FP2 or later hardware or on SDPs where all network interfaces are on FP2 or later hardware.
Parameters 
alarm-only
Specifies that the packet will be forwarded, an alarm will be generated but the source MAC is not learned on the SAP/spoke-SDP/mesh-SDP.
Default
no alarm-only
discard-frame
Specifies that the packet will be discarded and an alarm generated. The frequency of alarm generation is fixed to be at most one alarm per FP2 per MAC address per 10 minutes within a given VPLS service.
Default
no discard-frame
Default 
no restrict-protected-src
restrict-unprotected-dst
Syntax 
restrict-unprotected-dst
no restrict-unprotected-dst
Context 
config>service>pw-template>split-horizon-group
config>service>vpls>split-horizon-group
config>service>vpls>sap
Description 
This command indicates how the system will forward packets destined to an unprotected MAC address, either manually added using the mac-protect command or automatically added using the auto-learn-mac-protect command. While enabled all packets entering the configured SAP or SAPs within a split-horizon-group (but not spoke or mesh-SDPs) will be verified to contain a protected destination MAC address. If the packet is found to contain a non-protected destination MAC, it will be discarded. Detecting a non-protected destination MAC on the SAP will not cause the SAP to be placed in the operationally down state. No alarms are generated.
If the destination MAC address is unknown, even if the packet is entering a restricted SAP, with restrict-unprotected-dst enabled, it will be flooded.
Default 
no restrict-unprotected-dst
mac-pinning
Syntax 
[no] mac-pinning
Context 
config>service>vpls>sap
config>service>vpls>spoke-sdp
config>service>vpls>mesh-sdp
Description 
Enabling this command will disable re-learning of MAC addresses on other SAPs within the VPLS. The MAC address will remain attached to a given SAP for duration of its age-timer.
The age of the MAC address entry in the FIB is set by the age timer. If mac-aging is disabled on a given VPLS service, any MAC address learned on a SAP/SDP with mac-pinning enabled will remain in the FIB on this SAP/SDP forever.
Every event that would otherwise result in re-learning will be logged (MAC address; original-SAP; new-SAP).
Note that MAC addresses learned during DHCP address assignment (DHCP snooping enabled) are not impacted by this command. MAC-pinning for such addresses is implicit.
Default 
When a SAP or spoke SDP is part of a Residential Split Horizon Group (RSHG), MAC pinning is activated at creation of the SAP. Otherwise MAC pinning is not enabled by default.
 
ARP Handling Commands
arp-reply-agent
Syntax 
arp-reply-agent [sub-ident]
no arp-reply-agen
Context 
config>service>vpls>sap
Description 
This command enables a special ARP response mechanism in the system for ARP requests destined to static or dynamic hosts associated with the SAP. The system responds to each ARP request using the host’s MAC address as the both the source MAC address in the Ethernet header and the target hardware address in the ARP header.
ARP replies and requests received on a SAP with arp-reply-agent enabled will be evaluated by the system against the anti-spoof filter entries associated with the ingress SAP (if the SAP has anti-spoof filtering enabled). ARPs from unknown hosts on the SAP will be discarded when anti-spoof filtering is enabled.
The ARP reply agent only responds if the ARP request enters an interface (SAP, spoke-SDP or mesh-SDP) associated with the VPLS instance of the SAP.
A received ARP request that is not in the ARP reply agent table is flooded to all forwarding interfaces of the VPLS capable of broadcast except the ingress interface while honoring split-horizon constraints.
Static hosts can be defined on the SAP using the host command. Dynamic hosts are enabled on the system by enabling the lease-populate command in the SAP’s dhcp context. In the event that both a static host and a dynamic host share the same IP and MAC address, the VPLS ARP reply agent will retain the host information until both the static and dynamic information are removed. In the event that both a static and dynamic host share the same IP address, but different MAC addresses, the VPLS ARP reply agent is populated with the static host information.
The arp-reply-agent command will fail if an existing static host on the SAP does not have both MAC and IP addresses specified. Once the ARP reply agent is enabled, creating a static host on the SAP without both an IP address and MAC address will fail.
The ARP-reply-agent may only be enabled on SAPs supporting Ethernet encapsulation.
The no form of the command disables ARP-reply-agent functions for static and dynamic hosts on the SAP.
Default 
not enabled
Parameters 
sub-ident
Configures the arp-reply-agent to discard ARP requests received on the SAP that are targeted for a known host on the same SAP with the same subscriber identification.
Hosts are identified by their subscriber information. For DHCP subscriber hosts, the subscriber hosts, the subscriber information is configured using the optional subscriber parameter string.
When arp-reply-agent is enabled with sub-ident:
•
If the subscriber information for the destination host exactly matches the subscriber information for the originating host and the destination host is known on the same SAP as the source, the ARP request is silently discarded.
•
If the subscriber information for the destination host or originating host is unknown or undefined, the source and destination hosts are not considered to be the same subscriber. The ARP request is forwarded outside the SAP’s Split Horizon Group.
•
When sub-ident is not configured, the arp-reply-agent does not attempt to identify the subscriber information for the destination or originating host and will not discard an ARP request based on subscriber information.
arp-populate
Syntax 
[no] arp-populate
Context 
config>service>ies>interface
config>service>ies>subscriber-int
Description 
This command, when enabled, disables dynamic learning of ARP entries. Instead, the ARP table is populated with dynamic entries from the DHCP lease state table (enabled with lease-populate), and optionally with static entries entered with the host command.
Enabling the arp-populate command will remove any dynamic ARP entries learned on this interface from the ARP cache.
The arp-populate command will fail if an existing static ARP entry exists for this interface.
The arp-populate command will fail if an existing static subscriber host on the SAP does not have both MAC and IP addresses specified.
Once arp-populate is enabled, creating a static subscriber host on the SAP without both an IP address and MAC address will fail.
When arp-populate is enabled, the system will not send out ARP requests for hosts that are not in the ARP cache. Only statically configured and DHCP learned hosts are reachable through an IP interface with arp-populate enabled. The arp-populate command can only be enabled on IES and VPRN interfaces supporting Ethernet encapsulation.
Use the no form of the command to disable ARP cache population functions for static and dynamic hosts on the interface. All static and dynamic host information for this interface will be removed from the system’s ARP cache.
Default 
not enabled
arp-timeout
Syntax 
arp-timeout seconds
no arp-timeout
Context 
config>service>ies>interface
config>service>ies>subscriber-interface>group-interface
Description 
This command configures the minimum time in seconds an ARP entry learned on the IP interface will be stored in the ARP table. ARP entries are automatically refreshed when an ARP request or gratuitous ARP is seen from an IP host, otherwise, the ARP entry is aged from the ARP table. If arp-timeout is set to a value of zero seconds, ARP aging is disabled.
When the arp-populate and lease-populate commands are enabled on an IES interface, the ARP table entries will no longer be dynamically learned, but instead by snooping DHCP ACK message from a DHCP server. In this case the configured arp-timeout value has no effect.
The default value for arp-timeout is 14400 seconds (4 hours).
The no form of this command restores arp-timeout to the default value.
Default 
14400 seconds
Parameters 
seconds
The minimum number of seconds a learned ARP entry will be stored in the ARP table, expressed as a decimal integer. A value of zero specifies that the timer is inoperative and learned ARP entries will not be aged.
Values
0 — 65535
authentication-policy
Syntax 
authentication-policy name
no authentication-policy
Context 
config>service>ies>sub-if>grp-if
Description 
This command assigns a RADIUS authentication policy to the interface.
The no form of this command removes the policy name from the group interface configuration.
Default 
no authentication-policy
Parameters 
name
Specifies the authentication policy name.
host-connectivity-verify
Syntax 
host-connectivity-verify [interval interval] [action {remove | alarm}][family family]
Context 
config>service>ies>sub-if>grp-if
Description 
This command enables subscriber host connectivity verification for all hosts on this interface. This tool will periodically scan all known hosts (from dhcp-state) and perform a UC ARP request. The subscriber host connectivity verification will maintain state (connected vs. not-connected) for all hosts.
Default 
no host-connectivity-verify
Parameters 
interval interval
The interval, expressed in minutes, which specifies the time interval at which all known sources should be verified. The actual rate is then dependent on number of known hosts and interval.
Values
1— 6000
Note that a zero value can be used by the SNMP agent to disable host-connectivity-verify.
action {remove | alarm}
Defines the action taken on a subscriber host connectivity verification failure for a given host. The remove keyword raises an alarm and removes dhcp-state and releases all allocated resources (queues, table entries and etc.). DHCP release will be signaled to corresponding DHCP server. Static hosts will be never removed. The alarm keyword raises an alarm indicating that the host is disconnected.
family family
The family configuration allows the host connectivity checks to be performed for IPv4 endpoint, IPv6 endpoint or both. With family IPv6 configured, host connectivity checks will be performed on the global unicast address (assigned via SLAAC or DHCPv6 IA_NA) and link-local address of a Layer 3 RG or bridged hosts. In case of SLAAC assignment, host connectivity can only be performed if the /128 is known (via downstream ND). DHCPv6 PD assigned prefixes will be removed if link-local address is determined to be unreachable via “host connectivity check”. Reachability checks for GUA and link-local address will be done simultaneously.
 
local-proxy-arp
Syntax 
[no] local-proxy-arp
Context 
config>service>ies>interface
config>service>ies>subscriber-interface>group-interface
Description 
This command enables local proxy ARP. When local proxy ARP is enabled on an IP interface, the system responds to all ARP requests for IP addresses belonging to the subnet with its own MAC address, and thus will become the forwarding point for all traffic between hosts in that subnet.
When local-proxy-arp is enabled, ICMP redirects on the ports associated with the service are automatically blocked.
Default 
no local-proxy-arp
remote-proxy-arp
Syntax 
[no] remote-proxy-arp
Context 
config>service>ies>interface
config>service>ies>subscriber-interface>group-interface
Description 
This command enables or disables remote proxy ARP on the interface.
Default 
no remote-proxy-arp
proxy-arp-policy
Syntax 
proxy-arp-policy policy-name [policy-name...(up to 5 max)]
no proxy-arp-policy
Context 
config>service>ies>interface
config>service>ies>subscriber-interface>group-interface
Description 
This command specifies an existing policy-statement to analyze match and action criteria that controls the flow of routing information to and from a given protocol, set of protocols, or a particular neighbor.
Default 
none
Parameters 
policy-name
The export route policy name. Allowed values are any string up to 32 characters long composed of printable, 7-bit ASCII characters excluding double quotes. If the string contains special characters (#, $, spaces, etc.), the entire string must be enclosed within double quotes.
The specified name(s) must already be defined.
static-arp
Syntax 
static-arp ip-address ieee-mac-address
no static-arp ip-address [ieee-mac-address]
Context 
config>service>ies>interface
Description 
This command configures a static address resolution protocol (ARP) entry associating a subscriber IP address with a MAC address for the core router instance. This static ARP appears in the core routing ARP table. A static ARP can only be configured if it exists on the network attached to the IP interface.
If an entry for a particular IP address already exists and a new MAC address is configured for the IP address, the existing MAC address will be replaced with the new MAC address.
The no form of the command removes a static ARP entry.
Default 
None
Parameters 
ip-address
Specifies the IP address for the static ARP in IP address dotted decimal notation.
ieee-mac-address
Specifies the 48-bit MAC address for the static ARP in the form aa:bb:cc:dd:ee:ff or aa-bb-cc-dd-ee-ff where aa, bb, cc, dd, ee and ff are hexadecimal numbers. Allowed values are any non-broadcast, non-multicast MAC and non-IEEE reserved MAC addresses.
 
Show Commands
arp
Syntax 
arp
Context 
show>service>id
Description 
This command displays the ARP cache entries for this service.
Output 
Show All Service-ID Output
The following table describes the show command output fields:
 
Label
Description  
IP Address
Specifies the IP address of the ARP cach entry.
MAC Address
Specifies the MAC address associated with the IP address.
Type
Other
Learned through normal ARP queries.
 
Static
Configured by static-arp commands.
 
Managed
Learned from DHCP snooping or configured by host commands.
Age
Indicates age of the ARP entry.
Interface
Indicates the name of the IP interface.
Port
Indicates the port that the entry was learned on.
Sample Output
A:ALA-A# show service id 100 base ===============================================================================
ARP Table
===============================================================================
IP Address      MAC Address       Type    Age       Interface         Port
-------------------------------------------------------------------------------
101.1.0.1       00:00:66:66:66:01 Other   00h00m00s ies-100-101.1.0.1 1/1/4
200.1.1.2       00:00:5e:00:01:64 Other   00h00m00s ies-100-200.1.1.2 1/1/3
200.1.1.201     00:00:22:2e:a5:61 Static  00h00m00s ies-100-200.1.1.2 1/1/3
200.1.1.202     00:00:22:2e:a5:62 Static  00h00m00s ies-100-200.1.1.2 1/1/3
===============================================================================
A:ALA-A#