c Commands
ca-name
ca-name
Syntax
ca-name ca-name
no ca-name
Context
[Tree] (config>port>ethernet>dot1x>macsec>sub-port ca-name)
Full Context
configure port ethernet dot1x macsec sub-port ca-name
Description
This command configures the Connectivity Association (CA) linked to this MACsec sub-port. The specified CA provides the MACsec parameter to be used or negotiated with other peers.
The no form of this command removes the CA from the MACsec sub-port.
Parameters
- ca-name
-
Specifies the appropriate ca to be used under this MACsec sub-port, up to 32 characters.
Platforms
7705 SAR Gen 2
ca-profile
ca-profile
Syntax
[no] ca-profile name
Context
[Tree] (config>ipsec>cert-profile>entry>send-chain ca-profile)
Full Context
configure ipsec cert-profile entry send-chain ca-profile
Description
This command specifies a CA certificate in the specified ca-profile to be sent to the peer.
Multiple configurations (up to seven) of this command are allowed in the same entry.
Parameters
- name
-
Specifies the profile name up to 32 characters.
Platforms
7705 SAR Gen 2
ca-profile
Syntax
ca-profile name [create]
no ca-profile name
Context
[Tree] (config>system>security>pki ca-profile)
Full Context
configure system security pki ca-profile
Description
This command creates a new ca-profile or enters the configuration context of an existing ca-profile. Up to 128 ca-profiles can be created in the system. A shutdown of the ca-profile will not affect the current up and running ipsec-tunnel or ipsec-gw that is associated with the ca-profile. However, authentication afterwards will fail with a shutdown ca-profile.
Executing a no shutdown command in this context causes the system to reload the configured cert-file and crl-file.
A ca-profile can be applied under the ipsec-tunnel or ipsec-gw configuration.
The no form of this command removes the name parameter from the configuration. A ca-profile cannot be removed until all the associated entities (ipsec-tunnel/gw) have been removed.
Parameters
- name
-
Specifies the name of the ca-profile up to 32 characters.
- create
-
Keyword used to create a new ca-profile. The create keyword requirement can be enabled or disabled in the environment>create context.
Platforms
7705 SAR Gen 2
ca-profile
Syntax
[no] ca-profile profile-name
Context
[Tree] (debug>certificate>auto-crl-update ca-profile)
[Tree] (debug>certificate>cmpv2 ca-profile)
[Tree] (debug>certificate>ocsp ca-profile)
Full Context
debug certificate auto-crl-update ca-profile
debug certificate cmpv2 ca-profile
debug certificate ocsp ca-profile
Description
This command debugs output of the specified CA profile.
-
Protection method of each message is logged.
-
All HTTP messages are logged. Format allows offline analysis using Wireshark.
-
In the event of failed transactions, saved certificates are not deleted from file system for further debug and analysis.
-
The system allows CMPv2 debugging for multiple ca-profile at the same time.
Parameters
- profile-name
-
Specifies the name of the CA profile, up to 32 characters.
Platforms
7705 SAR Gen 2
ca-profile
Syntax
[no] ca-profile name
Context
[Tree] (config>system>security>tls>cert-profile>entry>send-chain ca-profile)
Full Context
configure system security tls cert-profile entry send-chain ca-profile
Description
This command enables a certificate authority (CA) certificate in the specified CA profile to be sent to the peer. Up to seven configurations of this command are permitted in the same entry.
The no form of the command disables the transmission of a CA certificate from the specified CA profile.
Parameters
- name
-
Specifies the name of the certificate authority profile, up to 32 characters in length.
Platforms
7705 SAR Gen 2
cacert
cacert
Syntax
cacert est-profile name output output-cert-filename [force]
Context
[Tree] (admin>certificate>est cacert)
Full Context
admin certificate est cacert
Description
This command downloads a Certificate Authority (CA) certificate from an EST server specified by the EST profile. The downloaded certificate is imported and saved with the filename specified by the output-cert-filename.
Parameters
- name
-
Specifies the EST profile name, up to 32 characters
- output-cert-filename
-
Specifies the filename of the resulting CA certificate, up to 200 characters
- force
-
Overwrites the existing file with same filename
Platforms
7705 SAR Gen 2
cache-reset
cache-reset
Syntax
[no] cache-reset
Context
[Tree] (debug>router>rpki-session>packet cache-reset)
Full Context
debug router rpki-session packet cache-reset
Description
This command enables debugging for cache reset RPKI packets.
The no form of this command disables debugging for cache reset RPKI packets.
Platforms
7705 SAR Gen 2
cache-response
cache-response
Syntax
[no] cache-response
Context
[Tree] (debug>router>rpki-session>packet cache-response)
Full Context
debug router rpki-session packet cache-response
Description
This command enables debugging for cache response RPKI packets.
The no form of this command disables debugging for cache response RPKI packets.
Platforms
7705 SAR Gen 2
cak
cak
Syntax
cak hex-string [hash | hash2 | custom]
no cak
Context
[Tree] (config>macsec>conn-assoc>static-cak>pre-shared-key cak)
Full Context
configure macsec connectivity-association static-cak pre-shared-key cak
Description
Specifies the connectivity association key (CAK) for a pre-shared key. Two values are derived from CAK.
-
Key Encryption Key (KEK), this is used to encrypt the MKA and SAK (symmetric key used for data path PDUs) to be distributed between all members.
-
Integrity Check Value (ICK), this is used to authenticate the MKA and SAK PDUs to be distributed between all members.
The no form of this command removes the value.
Parameters
- hex-string
-
Specifies the value of the CAK.
- hash
-
Keyword, specifying the hash scheme.
- hash2
-
Keyword, specifying the hash scheme.
- custom
-
Specifies the custom encryption for management interface.
Platforms
7705 SAR Gen 2
called-station-id
called-station-id
Syntax
[no] called-station-id
Context
[Tree] (config>ipsec>rad-auth-plcy>include called-station-id)
[Tree] (config>ipsec>rad-acct-plcy>include called-station-id)
Full Context
configure ipsec radius-authentication-policy include-radius-attribute called-station-id
configure ipsec radius-accounting-policy include-radius-attribute called-station-id
Description
This command includes called station ID attributes.
The no form of this command excludes called station ID attributes.
Default
no called-station-id
Platforms
7705 SAR Gen 2
calling-station-id
calling-station-id
Syntax
[no] calling-station-id
Context
[Tree] (config>ipsec>rad-auth-plcy>include calling-station-id)
[Tree] (config>ipsec>rad-acct-plcy>include calling-station-id)
Full Context
configure ipsec radius-authentication-policy include-radius-attribute calling-station-id
configure ipsec radius-accounting-policy include-radius-attribute calling-station-id
Description
This command enables the inclusion of the calling-station-id attribute in RADIUS authentication requests and RADIUS accounting messages.
Default
no calling-station-id
Platforms
7705 SAR Gen 2
cancel-commit
cancel-commit
Syntax
[no] cancel-commit
Context
[Tree] (configure>system>security>profile>netconf>base-op-authorization cancel-commit)
Full Context
configure system security profile netconf base-op-authorization cancel-commit
Description
This command enables the NETCONF <cancel-commit> RPC.
The no form of this command disables the RPC.
Default
no cancel-commit
The operation is enabled by default in the built-in system-generated administrative profile.
Platforms
7705 SAR Gen 2
candidate
candidate
Syntax
candidate
Context
[Tree] (candidate)
Full Context
candidate
Description
Commands in this context edit candidate configurations.
Commands in the candidate CLI branch, except candidate edit, are available only when in edit-cfg mode.
Platforms
7705 SAR Gen 2
candidate
Syntax
[no] candidate
Context
[Tree] (config>system>netconf>capabilities candidate)
Full Context
configure system netconf capabilities candidate
Description
This command allows the SR OS NETCONF server to access the candidate configuration datastore. Configuring this command also enables using commit and discard-changes.
When configure system management-interface configuration-mode is set to classic, the candidate capability is disabled, even if this command is configured.
The no form of the command disables the SR OS NETCONF server from accessing the candidate datastore. If the candidate is disabled, requests that reference the candidate datastore return an error, and when a NETCONF client establishes a new session, the candidate capability is not advertised in the SR OS NETCONF Hello message.
Default
candidate
Platforms
7705 SAR Gen 2
cannot-change-password
cannot-change-password
Syntax
[no] cannot-change-password
Context
[Tree] (config>system>security>user>console cannot-change-password)
Full Context
configure system security user console cannot-change-password
Description
This command allows a user the privilege to change their password for both FTP and console login.
To disable a user’s privilege to change their password, use the cannot-change-password form of this command.
The cannot-change-password flag is not replicated when a user copy is performed. A new-password-at-login flag is created instead.
Default
no cannot-change-password
Platforms
7705 SAR Gen 2
capture
capture
Syntax
capture [{start | stop}]
Context
[Tree] (debug>pcap capture)
Full Context
debug pcap capture
Description
This command starts and stops the packet capture process for the specified session-name.
Parameters
- start
-
Starts the packet capture process and also start or restarts the FTP or TFTP session. If the FTP or TFTP server is unreachable, the command prompt rejects further input until the retires are timed out after 24 seconds (after four attempts of about six seconds each). If the same file name is unchanged in the config>mirror>mirror-dest>pcap context between captures, this command overwrites the file content.
- stop
-
Stops the packet capture process and also stops the FTP or TFTP session. If the FTP or TFTP server is unreachable, the command prompt rejects further input until the retires are timed out after 24 seconds (after four attempts of about six seconds each).
Platforms
7705 SAR Gen 2
card
card
Syntax
[no] card slot-number
Context
[Tree] (config card)
Full Context
configure card
Description
This mandatory command enables access to the chassis and context. In SR OS cards cover IOM, IMM, and XCM.
The no form of this command removes the card from the configuration. All associated ports, services, and MDAs must be shutdown.
Default
no card
Parameters
- slot-number
-
Specifies the slot number of the card in the chassis. The maximum slot number is platform dependent. Refer to the hardware installation guides.
Platforms
7705 SAR Gen 2
card-type
card-type
Syntax
card-type card-type [level card-level]
no card-type
Context
[Tree] (config>card card-type)
Full Context
configure card card-type
Description
This mandatory command adds an IOM/XCM to the device configuration for the slot. The card type can be preprovisioned, meaning that the card does not need to be installed in the chassis.
A card must be provisioned before an MDA, connector, or port can be configured.
A card can only be provisioned in a slot that is vacant, meaning no other card can be provisioned (configured) for that particular slot. To reconfigure a slot position, use the no form of this command to remove the current information.
A card can only be provisioned in a slot if the card type is allowed in the slot. An error message is generated if an attempt is made to provision a card type that is not allowed.
If a card is inserted that does not match the configured card type for the slot, then a log event and facility alarm is raised. The alarm is cleared when the correct card type is installed or the configuration is modified.
A log event and facility alarm are is raised if an administratively enabled card is removed from the chassis. The alarm is cleared when the correct card type is installed or the configuration is modified. A log event is issued when a card is removed that is administratively disabled.
Because IMMs do not have the capability to install separate MDAs, the configuration of the MDA is automatic. This configuration only includes the default parameters such as default buffer policies. Commands to manage the MDA such as shutdown and so on, remain in the MDA configuration context.
Some card hardware can support two different firmware loads. One load includes the base Ethernet functionality, including 10G WAN mode, but does not include 1588 port-based timestamping. The second load includes the base Ethernet functionality and 1588 port-based timestamping, but does not include 10G WAN mode. These are identified as two card types that are the same, except for a "-ptp” suffix to indicate the second loadset; for example, imm40-10gb-sfp and imm40-10gb-sfp-ptp. A hard reset of the card occurs when switching between the two provisioned types.
An appropriate alarm is raised if a partial or complete card failure is detected. The alarm is cleared when the error condition ceases.
New generations of cards include variants controlled by hardware and software licensing. For these cards, the license level must be provisioned in addition to the card type. A card cannot become operational unless the provisioned license level matches the license level of the card installed into the slot. The set of license levels varies by card type.
The provisioned level controls aspects related to connector provisioning and the consumption of hardware egress queues and egress policers. Changes to the provisioned license level may be blocked if configuration exists that would not be permitted with the new target license level.
If the license level is not specified, the level is set to the highest license level for that card.
The no form of this command removes the card from the configuration.
Default
no card-type
Parameters
- card-type
-
Specifies the type of card to be configured and installed in that slot. Values for this attribute vary by platform and release. The release notes include a listing of all supported card-types and their CLI strings. In addition, the command can be queried to check which card-types are relevant for the active platform type. Some examples include iom4-e-b and imm-2pac-fp3.
- card-level
-
Specifies the license level of the card, up to 32 characters. Possible values vary by card type.
Platforms
7705 SAR Gen 2
carrier-carrier-vpn
carrier-carrier-vpn
Syntax
[no] carrier-carrier-vpn
Context
[Tree] (config>service>vprn carrier-carrier-vpn)
Full Context
configure service vprn carrier-carrier-vpn
Description
This command configures a VPRN service to support a Carrier Supporting Carrier model. It should be configured on a network provider’s CSC-PE device.
This command cannot be applied to a VPRN unless it has no SAP or spoke-SDP interfaces. Once this command has been entered one or more MPLS-capable CSC interfaces can be created in the VPRN.
The no form of this command removes the Carrier Supporting Carrier capability from a VPRN.
Default
no carrier-carrier-vpn
Platforms
7705 SAR Gen 2
cbs
cbs
Syntax
cbs size-in-kbytes
no cbs
Context
[Tree] (config>service>vpls>sap>ingress>queue-override>queue cbs)
[Tree] (config>service>ies>if>sap>ingress>queue-override>queue cbs)
[Tree] (config>service>ies>if>sap>egress>queue-override>queue cbs)
[Tree] (config>service>vpls>sap>egress>queue-override>queue cbs)
Full Context
configure service vpls sap ingress queue-override queue cbs
configure service ies interface sap ingress queue-override queue cbs
configure service ies interface sap egress queue-override queue cbs
configure service vpls sap egress queue-override queue cbs
Description
This command overrides specific attributes of the specified queue’s CBS parameters.
It is permissible, and possibly desirable, to oversubscribe the total CBS reserved buffers for a given access port egress buffer pool. Oversubscription may be desirable due to the potential large number of service queues and the economy of statistical multiplexing the individual queue’s CBS settings into the defined reserved total.
When oversubscribing the reserved total, it is possible for a queue depth to be lower than its CBS setting and still not receive a buffer from the buffer pool for an ingress frame. As more queues are using their CBS buffers and the total in use exceeds the defined reserved total, essentially the buffers are being removed from the shared portion of the pool without the shared in use average and total counts being decremented. This can affect the operation of the high and low priority RED slopes on the pool, causing them to miscalculate when to start randomly drop packets.
If the CBS value is larger than the MBS value, an error will occur, preventing the CBS change.
The no form of this command returns the CBS size to the default value.
Parameters
- size-in-kbytes
-
Specifies the size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10 kbytes is desired, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes).
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size-in-kbytes
no cbs
Context
[Tree] (config>service>vprn>if>sap>ingress>queue-override>queue cbs)
[Tree] (config>service>vprn>if>sap>egress>queue-override>queue cbs)
Full Context
configure service vprn interface sap ingress queue-override queue cbs
configure service vprn interface sap egress queue-override queue cbs
Description
This command can be used to override specific attributes of the specified queue’s CBS parameters.
It is permissible, and possibly desirable, to oversubscribe the total CBS reserved buffers for a given access port egress buffer pool. Oversubscription may be desirable due to the potential large number of service queues and the economy of statistical multiplexing the individual queue’s CBS setting into the defined reserved total.
When oversubscribing the reserved total, it is possible for a queue depth to be lower than its CBS setting and still not receive a buffer from the buffer pool for an ingress frame. As more queues are using their CBS buffers and the total in use exceeds the defined reserved total, essentially the buffers are being removed from the shared portion of the pool without the shared in use average and total counts being decremented. This can affect the operation of the high and low priority RED slopes on the pool, causing them to miscalculate when to start randomly drop packets.
If the CBS value is larger than the MBS value, an error occurs, preventing the CBS change.
The no form of this command returns the CBS to the default value.
Default
no cbs
Parameters
- size-in-kbytes
-
The size parameter is an integer expression of the number of kilobytes reserved for the queue. For a value of 10 kbytes, enter the number 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimum reserved size can be applied for scheduling purposes).
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs {size [bytes | kilobytes] | default}
no cbs
Context
[Tree] (config>card>fp>ingress>network>qgrp>policer-over>plcr cbs)
[Tree] (config>card>fp>ingress>access>qgrp>policer-over>plcr cbs)
Full Context
configure card fp ingress network queue-group policer-override policer cbs
configure card fp ingress access queue-group policer-override policer cbs
Description
This command configures the policer’s CIR leaky bucket’s exceed threshold. The CIR bucket’s exceed threshold represents the committed burst tolerance allowed by the policer. If the policer’s forwarding rate is equal to or less than the policer’s defined CIR, the CIR bucket depth hovers around the 0 depth with spikes up to the maximum packet size in the offered load. If the forwarding rate increases beyond the profiling rate, the amount of data allowed to be in-profile above the rate is capped by the threshold.
The policer’s cbs size defined in the QoS policy may be overridden on an sla-profile or SAP where the policy is applied.
The no form of this command returns the policer to its default CBS size.
Parameters
- size
-
Specifies that the size parameter is required when specifying cbs and is expressed as an integer representing the required size in either bytes or kilobytes. The default is kilobytes. The optional bytes and kilobytes keywords are mutually exclusive and are used to explicitly define whether size represents bytes or kilobytes.
- bytes
-
When bytes is defined, the value given for size is interpreted as the queue’s CBS value specified in bytes.
- kilobytes
-
When kilobytes is defined, the value is interpreted as the queue’s CBS value given in kilobytes.
- default
-
Specifying the keyword default sets the CBS to its default value.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size-in-kbytes
no cbs
Context
[Tree] (config>port>ethernet>access>egr>qgrp>qover>q cbs)
[Tree] (config>port>ethernet>access>ing>qgrp>qover>q cbs)
Full Context
configure port ethernet access egress queue-group queue-overrides queue cbs
configure port ethernet access ingress queue-group queue-overrides queue cbs
Description
This command defines the default committed buffer size for the template queue. Overall, the CBS command follows the same behavior and provisioning characteristics as the CBS command in the queue-group or network QoS policy. The exception is the addition of the cbs-value qualifier keywords bytes or kilobytes.
The no form of this command restores the default CBS size to the template queue.
Default
cbs default
Parameters
- size-in-kbytes
-
The size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10 kbytes is desired, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes).
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size [bytes | kilobytes]
no cbs
Context
[Tree] (config>service>epipe>sap>ingress>policer-over>plcr cbs)
[Tree] (config>service>epipe>sap>egress>policer-over>plcr cbs)
Full Context
configure service epipe sap ingress policer-override policer cbs
configure service epipe sap egress policer-override policer cbs
Description
This command, within the SAP ingress and egress policer-overrides contexts, is used to override the sap-ingress and sap-egress QoS policy configured CBS parameter for the specified policer-id.
The no form of this command returns the CBS size to the default value.
Default
no cbs
Parameters
- size
-
The size parameter is required when specifying cbs override and is expressed as an integer representing the required size in either bytes or kilobytes. The default is kilobytes. The optional byte and kilobyte keywords are mutually exclusive and are used to explicitly define whether size represents bytes or kilobytes.
- bytes
-
When bytes is defined, the value given for size is interpreted as the policer’s MBS value in bytes.
- kilobytes
-
When kilobytes is defined, the value given for size is interpreted as the policer’s MBS value in kilobytes.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs {size-in-kbytes | default}
no cbs
Context
[Tree] (config>service>epipe>sap>ingress>queue-override>queue cbs)
[Tree] (config>service>epipe>sap>egress>queue-override>queue cbs)
Full Context
configure service epipe sap ingress queue-override queue cbs
configure service epipe sap egress queue-override queue cbs
Description
This command can be used to override specific attributes of the specified queue’s CBS parameters.
It is permissible, and possibly desirable, to oversubscribe the total CBS reserved buffers for a specific access port egress buffer pool. Oversubscription may be desirable due to the potential large number of service queues and the economy of statistical multiplexing the individual queue’s CBS setting into the defined reserved total.
When oversubscribing the reserved total, it is possible for a queue depth to be lower than its CBS setting and still not receive a buffer from the buffer pool for an ingress frame. As more queues are using their CBS buffers and the total in use exceeds the defined reserved total, essentially the buffers are being removed from the shared portion of the pool without the shared in use average and total counts being decremented. This can affect the operation of the high and low priority RED slopes on the pool, causing them to miscalculate when to start randomly to drop packets.
The no form of this command returns the CBS size to the default value.
Default
no cbs
Parameters
- size-in-kbytes
-
The size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10KBytes is wanted, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes).
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size [{bytes | kilobytes}]
no cbs
Context
[Tree] (config>service>vpls>sap>ingress>policer-override>plcr cbs)
[Tree] (config>service>vpls>sap>egress>policer-override>plcr cbs)
Full Context
configure service vpls sap ingress policer-override policer cbs
configure service vpls sap egress policer-override policer cbs
Description
This command, within the SAP ingress and egress policer-overrides contexts, is used to override the sap-ingress and sap-egress QoS policy configured CBS parameter for the specified policer-id.
The no form of this command returns the CBS size to the default value.
Default
no cbs
Parameters
- size
-
This parameter is required when specifying CBS override and is expressed as an integer representing the required size in either bytes or kilobytes. The default is kilobytes. The optional byte and kilobyte keywords are mutually exclusive and are used to explicitly define whether size represents bytes or kilobytes.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size [{bytes | kilobytes}]
no cbs
Context
[Tree] (config>service>ies>if>sap>ingress>policer-over>plcr cbs)
[Tree] (config>service>ies>if>sap>egress>policer-over>plcr cbs)
Full Context
configure service ies interface sap ingress policer-override policer cbs
configure service ies interface sap egress policer-override policer cbs
Description
This command, within the SAP ingress and egress policer-overrides contexts, is used to override the sap-ingress and sap-egress QoS policy configured CBS parameter for the specified policer-id.
The no form of this command returns the CBS size to the default value.
Default
no cbs
Parameters
- size
-
This parameter is required when specifying CBS override and is expressed as an integer representing the required size in either bytes or kilobytes. The default is kilobytes. The optional byte and kilobyte keywords are mutually exclusive and are used to explicitly define whether size represents bytes or kilobytes.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size [{bytes | kilobytes}]
no cbs
Context
[Tree] (config>service>vprn>if>sap>ingress>policer-over>plcr cbs)
[Tree] (config>service>vprn>if>sap>egress>policer-over>plcr cbs)
Full Context
configure service vprn interface sap ingress policer-override policer cbs
configure service vprn interface sap egress policer-override policer cbs
Description
This command, within the SAP ingress and egress policer-overrides contexts, is used to override the sap-ingress and sap-egress QoS policy configured CBS parameter for the specified policer-id.
The no form of this command returns the CBS size to the default value.
Default
no cbs
Parameters
- size
-
This parameter is required when specifying CBS override and is expressed as an integer representing the required size in either bytes or kilobytes. The default is kilobytes. The optional byte and kilobyte keywords are mutually exclusive and are used to explicitly define whether size represents bytes or kilobytes.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size [bytes | kilobytes]
no cbs
Context
[Tree] (config>qos>sap-egress>policer cbs)
[Tree] (config>qos>sap-ingress>policer cbs)
Full Context
configure qos sap-egress policer cbs
configure qos sap-ingress policer cbs
Description
This command configures the policer’s CIR leaky bucket’s exceed threshold. The CIR bucket’s exceed threshold represents the committed burst tolerance allowed by the policer. If the policer’s forwarding rate is equal to or less than the policer's defined CIR, the CIR bucket depth hovers around the 0 depth with spikes up to the maximum packet size in the offered load. If the forwarding rate increases beyond the profiling rate, the amount of data allowed to be in-profile above the rate is capped by the threshold.
The policer’s cbs size defined in the QoS policy may be overridden on an sla-profile or SAP where the policy is applied.
The no form of this command returns the policer to its default CBS size.
By default, the CBS is 16 Mbytes when CIR equals max or is greater than or equal to the FP capacity (this overrides an explicit configured CBS value); otherwise, 10 ms volume of traffic for a configured non-zero/non-max CIR capped to 3968 kbytes, with a minimum of 256 bytes.
Parameters
- size [bytes | kilobytes]
-
Specifies an integer representing the required size in either bytes or kilobytes. The default is kilobytes. The optional byte and kilobyte keywords are mutually exclusive and are used to explicitly define whether size represents bytes or kilobytes.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs {size-in-kbytes| default}
cbs delay-time microseconds
cbs delay-percent percent
no cbs
Context
[Tree] (config>qos>sap-egress>queue cbs)
Full Context
configure qos sap-egress queue cbs
Description
This command provides a mechanism to override the default reserved buffers for the queue. It is permissible, and possibly desirable, to oversubscribe the total CBS reserved buffers for a specific access port egress buffer pool. Oversubscription may be desirable because of the potentially large number of service queues and the economy of statistical multiplexing the CBS settings of the individual into the defined reserved total.
When oversubscribing the reserved total, it is possible for a queue depth to be lower than its CBS setting and still not receive a buffer from the buffer pool for an ingress frame. As more queues use their CBS buffers and the total-in-use exceeds the defined reserved total, essentially the buffers are removed from the shared portion of the pool without the shared in-use average and total counts being decremented. This can affect the operation of the high- and low-priority RED slopes on the pool, causing them to miscalculate when to start randomly dropping packets.
If the CBS value is larger than the MBS value, the CBS is capped to the value of the MBS or the minimum CBS value. If the MBS and CBS values are configured to be equal (or nearly equal), this will result in the CBS being slightly higher than the value configured.
The delay-time command option configures the CBS as a function of the expected delay. The system automatically translates this configuration into kilobytes based on the administrative rate of the queue parent (for example, the port, scheduler, or aggregate-shaper).
The delay-percent command option configures the CBS as percentage of the SAP delay budget of the queue configured using the latency-budget command.
The no form of this command returns the CBS size to the default value.
Default
cbs default
Parameters
- size-in-kbytes
-
The size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10 kbytes is required, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes). The CBS maximum value used is constrained by the pool size in which the queue exists.
- microseconds
-
Specifies the CBS as a function of delay time.
- percent
-
Specifies the CBS as a percentage of the SAP latency budget.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs size-in-kbytes
no cbs
Context
[Tree] (config>qos>sap-ingress>queue cbs)
Full Context
configure qos sap-ingress queue cbs
Description
This command provides a mechanism to override the default reserved buffers for the queue. It is permissible, and possibly desirable, to oversubscribe the total CBS reserved buffers for a given access port egress buffer pool. Oversubscription may be desirable due to the potentially large number of service queues and the economy of statistical multiplexing the individual queue’s CBS settings into the defined reserved total.
When oversubscribing the reserved total, it is possible for a queue depth to be lower than its CBS setting and still not receive a buffer from the buffer pool for an ingress frame. As more queues are using their CBS buffers and the total in use exceeds the defined reserved total, essentially the buffers are being removed from the shared portion of the pool without the shared in use average and total counts being decremented. This can affect the operation of the high- and low-priority RED slopes on the pool, causing them to miscalculate when to start randomly dropping packets.
If the CBS value is larger than the MBS value, the CBS is capped to the value of the MBS or the minimum CBS value. If the MBS and CBS values are configured to be equal (or nearly equal), this will result in the CBS being slightly higher than the value configured.
The no form of this command returns the CBS size to the default value.
Default
cbs default
Parameters
- size-in-kbytes
-
The size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10 kbytes is desired, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes) The CBS maximum value used is constrained by the pool size in which the queue exists.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs percent
no cbs
Context
[Tree] (config>qos>network-queue>queue cbs)
Full Context
configure qos network-queue queue cbs
Description
The Committed Burst Size (cbs) command specifies the relative number of reserved buffers for a specific ingress network FP forwarding class queue or egress network port forwarding class queue. The value is entered as a percentage.
The CBS for a queue is used to determine whether it has exhausted its reserved buffers while enqueuing packets. When the queue has exceeded the number of buffers considered in reserve for this queue, it must contend with other queues for the available shared buffer space within the buffer pool. Access to this shared pool space is controlled through Random Early Detection (RED) slope application.
Two RED slopes are maintained in each buffer pool. A high-priority slope is used by in-profile packets. A low-priority slope is used by out-of-profile packets. At egress, there are two additional RED slopes maintained in each buffer pool: the highplus slope is used by inplus-profile packets, and the exceed slope is used by exceed-profile packets. All network control and management packets are considered in-profile. Assured packets are handled by their in-profile and out-of-profile markings. All best-effort packets are considered out-of-profile. Premium queues should be configured such that the CBS percent is sufficient to prevent shared buffering of packets. This is generally taken care of by the CIR scheduling of premium queues and the overall small amount of traffic on the class. Premium queues in a properly designed system will drain before all others, limiting their buffer utilization.
The RED slopes will detect congestion conditions and work to discard packets and slow down random TCP session flows through the queue. The RED slope definitions can be defined, modified, or disabled through the slope policy assigned to the FP for the network ingress buffer pool or assigned to the network port for network egress buffer pools.
The resultant CBS size can be larger than the MBS. This will result in a portion of the CBS for the queue to be unused and should be avoided.
The no form of this command returns the CBS size for the queue to the default for the forwarding class.
Default
The cbs forwarding class defaults are listed in the CBS Forwarding Class Defaults.
|
Forwarding Class |
Forwarding Class Label |
Default CBS |
|---|---|---|
|
Network-Control |
nc |
3 |
|
High-1 |
h1 |
3 |
|
Expedited |
ef |
1 |
|
High-2 |
h2 |
1 |
|
Low-1 |
l1 |
3 |
|
Assured |
af |
1 |
|
Low-2 |
l2 |
3 |
|
Best-Effort |
be |
1 |
Parameters
- percent
-
The percent of buffers reserved from the total buffer pool space, expressed as a decimal integer. If 10 Mbytes is the total buffer space in the buffer pool, a value of 10 would reserve 1 Mbyte (10%) of buffer space for the forwarding class queue. The value 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can be applied for scheduling purposes).
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs {size-in-kbytes | default}
no cbs
Context
[Tree] (config>qos>qgrps>ing>qgrp>policer cbs)
[Tree] (config>qos>qgrps>egr>qgrp>policer cbs)
Full Context
configure qos queue-group-templates ingress queue-group policer cbs
configure qos queue-group-templates egress queue-group policer cbs
Description
The cbs command is used to define the default committed buffer size for the template queue or the CBS for the template policer. Overall, the cbs command follows the same behavior and provisioning characteristics as the cbs command in the SAP ingress and egress QoS policy.
The no form of this command restores the default CBS size to the template policer.
Default
default
Parameters
- size-in-kbytes
-
For the queues, the size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10 kbytes is desired, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes). For policers, the size parameter is an integer expression of the number of kilobytes for the policer CBS.
Platforms
7705 SAR Gen 2
cbs
Syntax
cbs {size-in-kbytes | default}
no cbs
Context
[Tree] (config>qos>qgrps>ing>qgrp>queue cbs)
[Tree] (config>qos>qgrps>egr>qgrp>queue cbs)
Full Context
configure qos queue-group-templates ingress queue-group queue cbs
configure qos queue-group-templates egress queue-group queue cbs
Description
The cbs command is used to define the default committed buffer size for the template queue or the CBS for the template policer. Overall, the cbs command follows the same behavior and provisioning characteristics as the cbs command in the SAP ingress and egress QoS policy.
The no form of this command restores the default CBS size to the template policer.
Default
default
Parameters
- size-in-kbytes
-
For the queues, the size parameter is an integer expression of the number of kilobytes reserved for the queue. If a value of 10 kbytes is desired, enter the value 10. A value of 0 specifies that no reserved buffers are required by the queue (a minimal reserved size can still be applied for scheduling purposes). For policers, the size parameter is an integer expression of the number of kilobytes for the policer CBS.
Platforms
7705 SAR Gen 2
cd
cd
Syntax
cd [file-url]
Context
[Tree] (file cd)
Full Context
file cd
Description
This command displays or changes the current working directory in the local file system.
Parameters
- file-url
-
Specifies the file URL.
- ..
-
signifies the parent directory. This can be used in place of an actual directory name in a directory-url.
- directory-url
-
Specifies the destination directory.
Platforms
7705 SAR Gen 2
cert
cert
Syntax
cert cert-filename
no cert
Context
[Tree] (config>ipsec>cert-profile>entry cert)
Full Context
configure ipsec cert-profile entry cert
Description
This command specifies the file name of an imported certificate for the cert-profile entry.
The no form of this command removes the cert-file-name from the entry configuration.
Default
no cert
Platforms
7705 SAR Gen 2
cert
Syntax
cert
Context
[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel>dyn cert)
[Tree] (config>service>ies>if>sap>ipsec-gw cert)
[Tree] (config>service>ies>if>ipsec>ipsec-tunnel>dyn cert)
[Tree] (config>service>vprn>if>sap>ipsec-gw cert)
[Tree] (config>ipsec>trans-mode-prof>dyn cert)
[Tree] (config>router>if>ipsec>ipsec-tunnel>dyn cert)
Full Context
configure service vprn interface ipsec ipsec-tunnel dynamic-keying cert
configure service ies interface sap ipsec-gw cert
configure service ies interface ipsec ipsec-tunnel dynamic-keying cert
configure service vprn interface sap ipsec-gw cert
configure ipsec ipsec-transport-mode-profile dynamic-keying cert
configure router interface ipsec ipsec-tunnel dynamic-keying cert
Description
Commands in this context configure certificate parameters.
Platforms
7705 SAR Gen 2
cert
Syntax
cert cert-filename
no cert
Context
[Tree] (config>system>security>tls>cert-profile>entry cert)
Full Context
configure system security tls cert-profile entry cert
Description
This command specifies the file name of an imported certificate for the cert-profile entry.
The no form of the command removes the certificate.
Default
no cert
Parameters
- cert-filename
-
Specifies the file name of the TLS certificate, up to 95 characters in length.
Platforms
7705 SAR Gen 2
cert
Syntax
cert cert-file-name [create]
no cert
Context
[Tree] (config>system>security>pki>cert-auto-upd cert)
Full Context
configure system security pki certificate-auto-update cert
Description
This command configures the imported certificate filename for the certificate automatic update.
The no form of this command removes the cert-file-name from the configuration.
Parameters
- cert-file-name
-
Specifies the filename of the certificate, up to 95 characters in length.
Platforms
7705 SAR Gen 2
cert-file
cert-file
Syntax
cert-file filename
no cert-file
Context
[Tree] (config>system>security>pki>ca-profile cert-file)
Full Context
configure system security pki ca-profile cert-file
Description
This command specifies the filename of a file in cf3:\system-pki\cert as the CA’s certificate of the ca-profile.
Notes:
-
The system will perform following checks against configured cert-file when a no shutdown command is issued:
-
Configured cert-file must be a DER formatted X.509v3 certificate file.
-
All non-optional fields defined in section 4.1 of RFC 5280 must exist and conform to the RFC 5280 defined format.
-
Check the version field to see if its value is 0x2.
-
Check The Validity field to see that if the certificate is still in validity period.
-
X509 basic constraints extension must exists, and CA Boolean must be True.
-
If Key Usage extension exists, then at least keyCertSign and cRLSign should be asserted.
-
If the certificate is not a self-signing certificate, then system will try to look for issuer’s CA’s certificate to verify if this certificate is signed by issuer’s CA; but if there is no such CA-profile configured, then system will just proceed with a warning message.
-
If the certificate is not a self-signing certificate, then system will try to look for issuer’s CA’s CRL to verify that it has not been revoked; but if there is no such CA-profile configured or there is no such CRL, then system will just proceed with a warning message.
If any of above checks fails, then the no shutdown command will fail.
-
-
Changing or removing of cert-file is only allowed when the ca-profile is in a shutdown state.
The no form of this command removes the filename from the configuration.
Parameters
- filename
-
Specifies a local CF card file URL.
Platforms
7705 SAR Gen 2
cert-profile
cert-profile
Syntax
cert-profile profile-name [create]
no cert-profile profile-name
Context
[Tree] (config>ipsec cert-profile)
Full Context
configure ipsec cert-profile
Description
This command creates a new cert-profile or enters the configuration context of an existing cert-profile.
The no form of this command removes the profile name from the cert-profile configuration.
Parameters
- profile-name
-
Specifies the name of the certification profile up to 32 characters.
Platforms
7705 SAR Gen 2
cert-profile
Syntax
cert-profile name
no cert-profile
Context
[Tree] (config>router>if>ipsec>ipsec-tun>dyn>cert cert-profile)
[Tree] (config>service>ies>if>ipsec>ipsec-tunnel>dyn>cert cert-profile)
[Tree] (config>service>ies>if>sap>ipsec-gw>cert cert-profile)
[Tree] (config>service>vprn>if>sap>ipsec-gw>cert cert-profile)
[Tree] (config>service>vprn>if>sap>ipsec-tun>dyn>cert cert-profile)
[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel>dyn>cert cert-profile)
[Tree] (config>ipsec>trans-mode-prof>dyn>cert cert-profile)
Full Context
configure router interface ipsec ipsec-tunnel dynamic-keying cert cert-profile
configure service ies interface ipsec ipsec-tunnel dynamic-keying cert cert-profile
configure service ies interface sap ipsec-gw cert cert-profile
configure service vprn interface sap ipsec-gw cert cert-profile
configure service vprn interface sap ipsec-tunnel dynamic-keying cert cert-profile
configure service vprn interface ipsec ipsec-tunnel dynamic-keying cert cert-profile
configure ipsec ipsec-transport-mode-profile dynamic-keying cert cert-profile
Description
This command specifies the name of certificate profile to be used for authentication.
The no form of this command removes the name from the configuration.
Parameters
- name
-
Specifies the profile name, up to 32 characters
Platforms
7705 SAR Gen 2
cert-profile
Syntax
cert-profile profile-name [create]
no cert-profile profile-name
Context
[Tree] (config>system>security>tls cert-profile)
Full Context
configure system security tls cert-profile
Description
This command configures TLS certificate profile information. The certificate profile contains the certificates that are sent to the TLS peer (server or client) to authenticate itself. It is mandatory for the TLS server to send this information. The TLS client may optionally send this information upon request from the TLS server.
The no form of the command deletes the specified TLS certificate profile.
Parameters
- profile-name
-
Specifies the name of the TLS certificate profile, up to 32 characters in length.
- create
-
Keyword used to create the TLS certificate profile.
Platforms
7705 SAR Gen 2
cert-profile
Syntax
cert-profile name
no cert-profile
Context
[Tree] (config>system>security>tls>client-tls-profile cert-profile)
Full Context
configure system security tls client-tls-profile cert-profile
Description
This command assigns a TLS certificate profile to be used by the TLS client profile. This certificate is sent to the server for authentication of the client and public key.
The no form of the command removes the TLS certificate profile assignment.
Parameters
- name
-
Specifies the name of the TLS certificate profile, up to 32 characters in length.
Platforms
7705 SAR Gen 2
cert-profile
Syntax
cert-profile name
no cert-profile
Context
[Tree] (config>system>security>tls>server-tls-profile cert-profile)
Full Context
configure system security tls server-tls-profile cert-profile
Description
This command assigns a TLS certificate profile to be used by the TLS server profile. This certificate is sent to the client for authentication of the server and public key.
The no form of the command removes the TLS certificate profile assignment.
Parameters
- name
-
Specifies the name of the TLS certificate profile, up to 32 characters in length.
Platforms
7705 SAR Gen 2
cert-request
cert-request
Syntax
cert-request ca ca-profile-name current-key key-filename current-cert cert-filename [hash-alg hash-algorithm] newkey key-filename subject-dn subject-dn [domain-name domain-names] [ip-addr ip-address | ipv6-address] save-as save-path-of-result-cert
Context
[Tree] (admin>certificate>cmpv2 cert-request)
Full Context
admin certificate cmpv2 cert-request
Description
This command requests an additional certificate after the system has obtained the initial certificate from the CA.
The request is authenticated by a signature signed by the current-key, along with the current-cert. The hash algorithm used for signature is depends on the key type:
-
DSA key: SHA1
-
RSA key: MD5/SHA1/SHA224 | SHA256 | SHA384 | SHA512, by default is SHA1
In some cases, the CA may not return a certificate immediately, due to reasons such as request processing need manual intervention. In such cases, the admin certificate cmpv2 poll command can be used to poll the status of the request.
Parameters
- ca ca-profile-name
-
Specifies a ca-profile name which includes CMP server information up to 32 characters.
- current-key key-filename
-
Specifies corresponding certificate issued by the CA up to 95 characters.
- current-cert cert-filename
-
Specifies the file name of an imported certificate that is attached to the certificate request up to 95 characters.
- newkey key-filename
-
Specifies the file name of the imported key up to 95 characters.
- hash-alg hash-algorithm
-
Specifies the hash algorithm for RSA key.
- subject-dn dn
-
Specifies the subject of the requesting certificate up to 256 characters.
- save-as save-path-of-result-cert
-
Specifies the save full path name of saving the result certificate, up to 200 characters.
- domain-name domain-names
-
Specifies FQDNs for SubjectAltName of the requesting certificate, separated by commas, up to 512 characters.
- ip-addr ip-address | ipv6-address
-
Specifies an IPv4 or IPv6 address for SubjectAltName of the requesting certificate.
Platforms
7705 SAR Gen 2
cert-sync
cert-sync
Syntax
[no] cert-sync
Context
[Tree] (config>redundancy cert-sync)
Full Context
configure redundancy cert-sync
Description
This command automatically synchronizes the certificate/CRL/key when importing or generating (for the key). If a new CF card is inserted into slot3 into the backup CPM, the system will sync the whole system-pki directory from the active CPM.
Default
enabled
Platforms
7705 SAR Gen 2
certificate
certificate
Syntax
certificate
Context
[Tree] (admin certificate)
Full Context
admin certificate
Description
Commands in this context configure X.509 certificate related operational parameters. For information about CMPv6 admin certificate commands, see the 7705 SAR Gen 2 Multiservice ISA and ESA Guide
Platforms
7705 SAR Gen 2
certificate
Syntax
certificate
Context
[Tree] (debug certificate)
Full Context
debug certificate
Description
Commands in this context debug certificates.
Platforms
7705 SAR Gen 2
certificate
Syntax
certificate filename
Context
[Tree] (debug>ipsec certificate)
Full Context
debug ipsec certificate
Description
This command enables debug for certificate chain computation in cert-profile.
Parameters
- filename
-
Displays the filename of imported certificate, up to 95 characters.
Platforms
7705 SAR Gen 2
certificate-auto-update
certificate-auto-update
Syntax
certificate-auto-update
Context
[Tree] (config>system>security>pki certificate-auto-update)
Full Context
configure system security pki certificate-auto-update
Description
This command configures automatic updates for the specified certificate. This must be an imported certificate.
Platforms
7705 SAR Gen 2
certificate-display-format
certificate-display-format
Syntax
certificate-display-format {ascii | utf8}
Context
[Tree] (config>system>security>pki certificate-display-format)
Full Context
configure system security pki certificate-display-format
Description
This command specifies the display format used for the Certificates and Certificate Revocation Lists.
Default
certificate-display-format ascii
Parameters
- ascii
-
Specifies the ASCII format to use for the Certificates and Certificate Revocation Lists.
- utf8
-
Specifies the UTF8 format to use for the Certificates and Certificate Revocation Lists.
Platforms
7705 SAR Gen 2
certificate-expiration-warning
certificate-expiration-warning
Syntax
certificate-expiration-warning hours [repeat repeat-hours]
no certificate-expiration-warning
Context
[Tree] (config>system>security>pki certificate-expiration-warning)
Full Context
configure system security pki certificate-expiration-warning
Description
With this command configured, the system issues two types of warnings related to certificate expiration:
-
BeforeExp — A warning message issued before certificate expire
-
AfterExp — A warning message issued when certificate expire
This command specifies when system will issue BeforeExp message before a certificate expires. For example, with certificate-expiration-warning 5, the system will issue a BeforeExp message 5 hours before a certificate expires. An optional repeat <repeat-hour> parameter will enable the system to repeat the BeforeExp message every hour until the certificate expires.
If the user only wants AfterExp, then certificate-expiration-warning 0 can be used to achieve this.
BeforeExp and AfterExp warnings can be cleared in following cases:
-
The certificate is reloaded by the admin certificate reload command. In this case, if the reloaded file is not expired, then AfterExp is cleared. And, if the reloaded file is outside of configured warning window, then the BeforeExp is also cleared.
-
When the ca-profile/ipsec-gw/ipsec-tunnel/cert-profile is shutdown, then BeforeExp and AfterExp of corresponding certificates are cleared.
-
When no certificate-expiration-warning command is configured, then all existing BeforeExp and AfterExp are cleared.
-
Users may change the configuration of the certificate-expiration-warning so that certain certificates are no longer in the warning window. BeforeExp of corresponding certificates are cleared.
-
If the system time changes so that the new time causes the certificates to no longer be in the warning window, then BeforeExp is cleared. If the new time causes an expired certificate to come non-expired, then AfterExp is cleared.
Default
no certificate-expiration-warning
Parameters
- hours
-
Specifies the amount of time before a certificate expires when system issues BeforeExp.
- repeat-hours
-
Specifies the time the system will repeat BeforeExp every repeat-hour.
Platforms
7705 SAR Gen 2
certificate-update-profile
certificate-update-profile
Syntax
certificate-update-profile profile-name [create]
no certificate-profile profile-name
Context
[Tree] (config>system>security>pki certificate-update-profile)
Full Context
configure system security pki certificate-update-profile
Description
Commands in this context configure a certificate update profile that specifies the behavior of the automatic update certificate.
The no form of this command removes the profile.
Parameters
- profile-name
-
Specifies the name of the profile, up to 32 characters.
- create
- Mandatory keyword to create a certificate update profile.
Platforms
7705 SAR Gen 2
cflash-cap-alarm
cflash-cap-alarm
Syntax
cflash-cap-alarm cflash-id rising-threshold threshold [falling-threshold threshold] interval seconds [rmon-event-type] [startup-alarm alarm-type]
no cflash-cap-alarm cflash-id
Context
[Tree] (config>system>thresholds cflash-cap-alarm)
Full Context
configure system thresholds cflash-cap-alarm
Description
This command enables capacity monitoring of the compact flash specified in this command. The severity level is alarm. Both a rising and falling threshold can be specified.
The no form of this command removes the configured compact flash threshold alarm.
Parameters
- cflash-id
-
Specifies the name of the cflash device to be monitored.
- rising-threshold threshold
-
Specifies a threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm is equal to rising or either.
After a rising threshold crossing event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches less than or equal to the falling-threshold value.
The threshold value represents units of 512 bytes.
- falling-threshold threshold
-
Specifies a threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm is equal to falling or either.
After a falling threshold crossing event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold value.
The threshold value represents units of 512 bytes.
- seconds
-
Specifies the polling period, in seconds, over which the data is sampled and compared with the rising and falling thresholds.
- rmon-event-type
-
Specifies the type of notification action to be taken when this event occurs.
- alarm-type
-
Specifies the alarm that may be sent when this alarm is first created
If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.
If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.
Platforms
7705 SAR Gen 2
cflash-cap-alarm-pct
cflash-cap-alarm-pct
Syntax
cflash-cap-alarm-pct cflash-id rising-threshold percentage [falling-threshold percentage] interval seconds [rmon-event-type event-type] [startup-alarm alarm-type]
no cflash-cap-alarm-pct cflash-id
Context
[Tree] (config>system>thresholds cflash-cap-alarm-pct)
Full Context
configure system thresholds cflash-cap-alarm-pct
Description
This command enables capacity monitoring of the compact flash specified in this command. The usage is monitored as a percentage of the capacity of the compact flash. The severity level is alarm. Both a rising and falling threshold can be specified.
The no form of this command removes the configured compact flash threshold alarm.
Parameters
- cflash-id
-
Specifies the name of the cflash device to be monitored.
- rising-threshold percentage
-
Specifies a threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm is equal to rising or either.
After a rising threshold crossing event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches less than or equal to the falling-threshold value.
The threshold value is the percentage of used space versus capacity for the specified compact flash.
- falling-threshold percentage
-
Specifies a threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm is equal to falling or either.
After a falling threshold crossing event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold value.
The threshold value is the percentage of used space versus capacity for the specified compact flash.
- seconds
-
Specifies the polling period, in seconds, over which the data is sampled and compared with the rising and falling thresholds.
- event-type
-
Specifies the type of notification action to be taken when this event occurs.
- alarm-type
-
Specifies the alarm that may be sent when this alarm is first created.
If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.
If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.
Platforms
7705 SAR Gen 2
cflash-cap-warn
cflash-cap-warn
Syntax
cflash-cap-warn cflash-id rising-threshold threshold [falling-threshold threshold] interval seconds [rmon-event-type] [startup-alarm alarm-type]
no cflash-cap-warn cflash-id
Context
[Tree] (config>system>thresholds cflash-cap-warn)
Full Context
configure system thresholds cflash-cap-warn
Description
This command enables capacity monitoring of the compact flash specified in this command.
The severity level is warning. Both a rising and falling threshold can be specified. The no form of this command removes the configured compact flash threshold warning.
Parameters
- cflash-id
-
Specifies that the cflash-id specifies the name of the cflash device to be monitored.
- rising-threshold threshold
-
Specifies a threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm is equal to rising or either.
After a rising threshold crossing event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches less than or equal to the falling-threshold value.
The threshold value represents units of 512 bytes.
- falling-threshold threshold
-
Specifies a threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm is equal to falling or either.
After a falling threshold crossing event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold value.
The threshold value represents units of 512 bytes.
- seconds
-
Specifies the polling period over which the data is sampled and compared with the rising and falling thresholds.
- rmon-event-type
-
Specifies the type of notification action to be taken when this event occurs.
- alarm-type
-
Specifies the alarm that may be sent when this alarm is first created. If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.
If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.
Platforms
7705 SAR Gen 2
cflash-cap-warn-pct
cflash-cap-warn-pct
Syntax
cflash-cap-warn-pct cflash-id rising-threshold percentage [falling-threshold percentage] interval seconds [rmon-event-type event-type] [startup-alarm alarm-type]
no cflash-cap-warn-pct cflash-id
Context
[Tree] (config>system>thresholds cflash-cap-warn-pct)
Full Context
configure system thresholds cflash-cap-warn-pct
Description
This command enables capacity monitoring of the compact flash specified in this command. The usage is monitored as a percentage of the capacity of the compact flash.
The severity level is warning. Both a rising and falling threshold can be specified. The no form of this command removes the configured compact flash threshold warning.
Parameters
- cflash-id
-
Specifies that the cflash-id specifies the name of the cflash device to be monitored.
- rising-threshold percentage
-
Specifies a threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm is equal to rising or either.
After a rising threshold crossing event is generated, another such event will not be generated until the sampled value falls below this threshold and reaches less than or equal to the falling-threshold value.
The threshold value is the percentage of used space versus capacity for the specified compact flash.
- falling-threshold percentage
-
Specifies a threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold crossing event will be generated. A single threshold crossing event will also be generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm is equal to falling or either.
After a falling threshold crossing event is generated, another such event will not be generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold value.
The threshold value is the percentage of used space versus capacity for the specified compact flash.
- seconds
-
Specifies the polling period over which the data is sampled and compared with the rising and falling thresholds.
- event-type
-
Specifies the type of notification action to be taken when this event occurs.
- alarm-type
-
Specifies the alarm that may be sent when this alarm is first created. If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.
If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.
Platforms
7705 SAR Gen 2
chain-to-system-filter
chain-to-system-filter
Syntax
[no] chain-to-system-filter
Context
[Tree] (config>filter>ipv6-filter chain-to-system-filter)
[Tree] (config>filter>ip-filter chain-to-system-filter)
Full Context
configure filter ipv6-filter chain-to-system-filter
configure filter ip-filter chain-to-system-filter
Description
This command chains this filter to a currently active system filter. When the filter is chained to the system filter, the system filter rules are executed first, and the filter rules are only evaluated if no match on the system filter was found.
The no form of the command detaches this filter from the system filter.
Operational note:
If no system filter is currently active, the command has no effect.
Default
no chain-to-system-filter
Platforms
7705 SAR Gen 2
check-id-kp-cmcra-only
check-id-kp-cmcra-only
Syntax
[no] check-id-kp-cmcra-only
Context
[Tree] (config>system>security>pki>est-profile check-id-kp-cmcra-only)
Full Context
configure system security pki est-profile check-id-kp-cmcra-only
Description
This command enables checking id-kp-cmcRA in the EST certificate. When enabled, instead of the subject or subject alternative name, only the id-kp-cmcRA existence in extended key usage extension of EST server certificate is checked. The id-kp-cmcRA identifies a Registration Authority.
The no form of this command reverts to the default value.
Default
no check-id-kp-cmcra-only
Platforms
7705 SAR Gen 2
check-zero
check-zero
Syntax
check-zero {enable | disable}
no check-zero
Context
[Tree] (config>service>vprn>rip check-zero)
[Tree] (config>service>vprn>ripng check-zero)
[Tree] (config>service>vprn>rip>group>neighbor check-zero)
[Tree] (config>service>vprn>ripng>group>neighbor check-zero)
[Tree] (config>service>vprn>rip>group check-zero)
[Tree] (config>service>vprn>ripng>group check-zero)
Full Context
configure service vprn rip check-zero
configure service vprn ripng check-zero
configure service vprn rip group neighbor check-zero
configure service vprn ripng group neighbor check-zero
configure service vprn rip group check-zero
configure service vprn ripng group check-zero
Description
This command enables checking for zero values in fields specified to be zero by the RIPv1 and RIPv2 specifications.
The no form of this command disables this check and allows the receipt of RIP messages even if the mandatory zero fields are non-zero.
Default
no check-zero
Parameters
- enable
-
Enables checking of the mandatory zero fields in the RIPv1 and RIPv2 specifications and rejecting noncompliant RIP messages.
- disable
-
Disables the checking and allows the receipt of RIP messages even if the mandatory zero fields are non-zero.
Platforms
7705 SAR Gen 2
check-zero
Syntax
check-zero {enable | disable}
no check-zero
Context
[Tree] (config>router>rip check-zero)
[Tree] (config>router>rip>group>neighbor check-zero)
[Tree] (config>router>ripng>group>neighbor check-zero)
[Tree] (config>router>ripng>group check-zero)
[Tree] (config>router>ripng check-zero)
[Tree] (config>router>rip>group check-zero)
Full Context
configure router rip check-zero
configure router rip group neighbor check-zero
configure router ripng group neighbor check-zero
configure router ripng group check-zero
configure router ripng check-zero
configure router rip group check-zero
Description
This command enables checking for zero values in fields specified to be zero by the RIPv1 and RIPv2 specifications.
The check-zero enable command enables checking of the mandatory zero fields in the RIPv1 and RIPv2 specifications and rejecting non-compliant RIP messages.
The check-zero disable command disables this check and allows the receipt of RIP messages even if the mandatory zero fields are non-zero.
This configuration parameter can be set at three levels: global level (applies to all groups and neighbor interfaces), group level (applies to all neighbor interfaces in the group) or neighbor level (only applies to the specified neighbor interface). The most specific value is used. In particular if no value is set (no check-zero), the setting from the less specific level is inherited by the lower level.
The no form of the command removes the check-zero command from the configuration.
Parameters
- enable
-
Specifies to reject RIP messages which do not have zero in the RIPv1 and RIPv2 mandatory fields.
- disable
-
Specifies allows receipt of RIP messages which do not have the mandatory zero fields reset.
Platforms
7705 SAR Gen 2
checksum
checksum
Syntax
checksum {md5 | sha256} file-url
Context
[Tree] (file checksum)
Full Context
file checksum
Description
This command computes and displays a checksum for a file.
Parameters
- md5
-
Specifies the use of the MD5 algorithm to produce the file checksum.
- sha256
-
Specifies the use of the SHA-256 algorithm to produce the file checksum.
- file-url
-
Specifies the location of the file.
Platforms
7705 SAR Gen 2
chli-event
chli-event
Syntax
chli-event {forward | backward | aggregate} threshold raise-threshold [clear clear-threshold]
no chli-event {forward | backward | aggregate}
Context
[Tree] (config>oam-pm>session>ip>twamp-light>loss-events chli-event)
Full Context
configure oam-pm session ip twamp-light loss-events chli-event
Description
This command sets the consecutive high loss interval (CHLI) threshold to be monitored and the associated thresholds using the counter of the specified direction. The aggregate is a function of summing forward and backward. This value is only used as a threshold mechanism and is not part of the stored statistics. If the optional clear clear-threshold parameter is not specified, the traffic crossing alarm is stateless. Stateless means the state is not carried forward to other measurement intervals. Each measurement interval is analyzed independently and regardless of any previous window. Each unique event can only be raised once within measurement interval. If the optional clear clear-threshold parameter is specified, the traffic crossing alarm uses stateful behavior. Stateful means each unique previous event state is carried forward to following measurement intervals. If a threshold crossing event is raised another is raised until a measurement interval completes and the clear threshold has not been exceeded. A clear event is raised under that condition.
The no form of this command removes the event threshold for frame loss ratio. The direction must be included with the no command.
Default
no chli-event forward
no chli-event backward
no chli-event aggregate
Parameters
- forward
-
Specifies the threshold is applied to the forward direction count.
- backward
-
Specifies the threshold is applied to the backward direction count.
- aggregate
-
Specifies the threshold is applied to the aggregate count (sum of forward and backward).
- raise-threshold
-
Specifies the numerical value compared to the CHLI counter that is the rising threshold that determines when the event is to be generated, when the percentage of loss value is reached.
- clear-threshold
-
Specifies an optional numerical value compared to the CHLI counter used for stateful behavior that allows the operator to configure a value lower than the rising percentage to indicate when the clear event should be generated.
Platforms
7705 SAR Gen 2
cipher
cipher
Syntax
cipher index name cipher-name
no cipher index
Context
[Tree] (config>system>security>ssh>server-cipher-list cipher)
[Tree] (config>system>security>ssh>client-cipher-list cipher)
Full Context
configure system security ssh server-cipher-list cipher
configure system security ssh client-cipher-list cipher
Description
This command configures a cipher. Client-ciphers are used when the SR OS is acting as an SSH client. Server-ciphers are used when the SR OS is acting as an SSH server.
The no form of this command removes the index and cipher name from the configuration.
Default
no cipher index
Parameters
- index
-
Specifies the index of the cipher in the list.
- cipher-name
-
Specifies the algorithm used when performing encryption or decryption.
Platforms
7705 SAR Gen 2
cipher
Syntax
cipher index name cipher-suite-code
no cipher index
Context
[Tree] (config>system>security>tls>server-cipher-list cipher)
[Tree] (config>system>security>tls>client-cipher-list cipher)
Full Context
configure system security tls server-cipher-list cipher
configure system security tls client-cipher-list cipher
Description
This command configures the cipher suite to be negotiated by the server and client.
Parameters
- index
-
Specifies the index number. The index number provides the location of the cipher in the negotiation list, with the lower index numbers being higher in the negotiation list and the higher index numbers being at the bottom of the list.
- cipher-suite-code
-
Specifies the cipher suite code.
Platforms
7705 SAR Gen 2
cipher-list
cipher-list
Syntax
cipher-list name
no cipher-list
Context
[Tree] (config>system>security>tls>client-tls-profile cipher-list)
Full Context
configure system security tls client-tls-profile cipher-list
Description
This command assigns the cipher list to be used by the TLS client profile for negotiation in the client Hello message.
Parameters
- name
-
Specifies the name of the cipher list.
Platforms
7705 SAR Gen 2
cipher-list
Syntax
cipher-list name
no cipher-list
Context
[Tree] (config>system>security>tls>server-tls-profile cipher-list)
Full Context
configure system security tls server-tls-profile cipher-list
Description
This command assigns a cipher list to be used by the TLS server profile. This cipher list is used to find matching ciphers with the cipher list that is received from the client.
The no form of the command removes the cipher list.
Parameters
- name
-
Specifies the name of the cipher list, up to 32 characters in length.
Platforms
7705 SAR Gen 2
cipher-suite
cipher-suite
Syntax
cipher-suite cipher-suite
no cipher-suite
Context
[Tree] (config>macsec>connectivity-association cipher-suite)
Full Context
configure macsec connectivity-association cipher-suite
Description
This command configures encryption of data path PDUs. When all parties in the Connectivity Association (CA) have the SAK, they use the above algorithm in conjunction with the SAK to encrypt the data path PDUs.
The XPN 64 bit (extended packet number) can be used for higher rate ports such as 10 GigE to minimize the window rollover and renegotiation of the SAK.
The no form of this command disables encryption of data path PDUs.
Default
cipher-suite gcm-aes-128
Parameters
- cypher-suite
-
Specifies the algorithm.
Platforms
7705 SAR Gen 2
circuit-id
circuit-id
Syntax
circuit-id string ascii-string
circuit-id hex hex-string
no circuit-id
Context
[Tree] (config>subscr-mgmt>loc-user-db>ipoe>host>host-ident circuit-id)
Full Context
configure subscriber-mgmt local-user-db ipoe host host-identification circuit-id
Description
This command specifies the circuit ID to match for a host lookup. When the LUDB is accessed using a DHCPv4 server, the circuit ID is matched against DHCP Option 82.
This command is only used when circuit-id is configured as one of the match-list parameters.
The no form of this command removes the circuit ID from the configuration.
Parameters
- ascii-string
-
Specifies the circuit ID from the Option 82, up to 127 characters.
- hex-string
-
Specifies the circuit ID in hexadecimal format from the Option 82.
Platforms
7705 SAR Gen 2
circuit-id
Syntax
circuit-id
circuit-id {ascii-tuple | if-index | sap-id | vlan-ascii-tuple}
circuit-id hex [hex-string]
no circuit-id
Context
[Tree] (config>service>vprn>if>dhcp>option circuit-id)
[Tree] (config>service>vpls>sap>dhcp>option circuit-id)
[Tree] (config>service>ies>if>dhcp>option circuit-id)
Full Context
configure service vprn interface dhcp option circuit-id
configure service vpls sap dhcp option circuit-id
configure service ies interface dhcp option circuit-id
Description
When enabled, the router sends an ASCII-encoded tuple in the circuit-id sub-option of the DHCP packet. This ASCII-tuple consists of the access-node-identifier, service-id, and SAP-ID, separated by "|”. If no keyword is configured, then the circuit-id sub-option will not be part of the information option (Option 82). When the command is configured without any parameters, it equals to circuit-id ascii-tuple.
To send a tuple in the circuit ID, the action replace command must be configured in the same context.
If disabled, the circuit-id sub-option of the DHCP packet is left empty.
The no form of this command specifies to leave the circuit-id option of the packet empty.
Default
circuit-id ascii-tuple
Parameters
- ascii-tuple
-
Specifies that the ASCII-encoded concatenated tuple consisting of the access-node-identifier, service-id, and interface-name is used.
- ifindex
-
Specifies that the interface index is used. The If Index of a router interface can be displayed using the command show>router>if>detail.
- sap-id
-
Specifies that the SAP identifier is used.
- vlan-ascii-tuple
-
Specifies that the format will include VLAN-id and dot1p bits in addition to what is included in ascii-tuple already. The format is supported on dot1q and qinq ports only. Thus, when the Option 82 bits are stripped, dot1p bits are copied to the Ethernet header of an outgoing packet.
- hex-string
-
Specifies the hex value of this option.
Platforms
7705 SAR Gen 2
circuit-id
Syntax
circuit-id {ascii-tuple | ifindex | if-name | port-id | vlan-ascii-tuple | none}
no circuit-id
Context
[Tree] (config>router>if>dhcp>option circuit-id)
Full Context
configure router interface dhcp option circuit-id
Description
When enabled, the router sends the interface index (If Index) in the circuit-id suboption of the DHCP packet. The If Index of a router interface can be displayed using the command show router interface detail. This option specifies data that must be unique to the router that is relaying the circuit.
If disabled, the circuit-id suboption of the DHCP packet will be left empty.
The no form of this command returns the system to the default.
Default
circuit-id ascii-tuple
Parameters
- ascii-tuple
-
Specifies that the ASCII-encoded concatenated tuple will be used which consists of the access-node-identifier, service-id, and interface-name, separated by a pipe ( | ).
- ifindex
-
Specifies that the interface index will be used. The If Index of a router interface can be displayed using the command show router interface detail.
- if-name
-
Specifies the interface name.
- port-id
-
Specifies the port ID.
- vlan-ascii-tuple
-
Specifies that the format will include VLAN-id and dot1p bits in addition to what is included in ascii-tuple already. The format is supported on dot1q and qinq ports only. Therefore, when the Option 82 bits are stripped, dot1p bits will be copied to the Ethernet header of an outgoing packet.
- none
-
Specifies that no circuit should be used.
Platforms
7705 SAR Gen 2
ckn
ckn
Syntax
ckn hex-string
no ckn
Context
[Tree] (config>macsec>conn-assoc>static-cak>pre-shared-key ckn)
Full Context
configure macsec connectivity-association static-cak pre-shared-key ckn
Description
Specifies the connectivity association key name (CKN) for a pre-shared key.
CKN is appended to the MKA for identification of the appropriate CAK by the peer.
The no form of this command reverts to the default value.
Parameters
- hex-string
-
Specifies the value of the CKN.
Platforms
7705 SAR Gen 2
class-type
class-type
Syntax
class-type ct-number
no class-type
Context
[Tree] (config>router>mpls>lsp>primary class-type)
[Tree] (config>router>mpls>lsp-template class-type)
[Tree] (config>router>mpls>lsp class-type)
[Tree] (config>router>mpls>lsp>secondary class-type)
Full Context
configure router mpls lsp primary class-type
configure router mpls lsp-template class-type
configure router mpls lsp class-type
configure router mpls lsp secondary class-type
Description
This command configures the Diff-Serv Class Type (CT) for an LSP, the LSP primary path, or the LSP secondary path. The path level configuration overrides the LSP level configuration. However, only one CT per LSP path will be allowed as per RFC 4124.
The signaled CT of a dynamic bypass is always be CT0 regardless of the CT of the primary LSP path. The setup and hold priorities must be set to default values, that is, 7 and 0 respectively. This assumes that the operator configured a couple of TE classes, one which combines CT0 and a priority of 7 and the other which combines CT0 and a priority of 0. If not, the bypass LSP will not be signaled and will go into the down state.
The operator cannot configure the CT, setup priority, and hold priority of a manual bypass. They are always signaled with CT0 and the default setup and holding priorities.
The signaled CT and setup priority of a detour LSP must match those of the primary LSP path it is associated with.
If the operator changes the CT of an LSP or of an LSP path, or changes the setup and holding priorities of an LSP path, the path will be torn down and retried.
An LSP which does not have the CT explicitly configured will behave like a CT0 LSP when Diff-Serv is enabled.
If the operator configured a combination of a CT and a setup priority and/or a combination of a CT and a holding priority for an LSP path that are not supported by the user-defined TE classes, the LSP path will be kept in a down state and an error code will be displayed in the show command output for the LSP path.
The no form of this command reverts to the default value.
Default
class-type 0
Parameters
- ct-number
-
Specifies the Diff-Serv Class Type number.
Platforms
7705 SAR Gen 2
class-type-bw
class-type-bw
Syntax
class-type-bw ct0 %-link-bandwidth ct1%-link-bandwidth ct2%-link-bandwidth ct3%-link-bandwidth ct4%-link-bandwidth ct5%-link-bandwidth ct6%-link-bandwidth ct7%-link-bandwidth
no class-type-bw
Context
[Tree] (config>router>rsvp>interface class-type-bw)
[Tree] (config>router>rsvp>diffserv-te class-type-bw)
Full Context
configure router rsvp interface class-type-bw
configure router rsvp diffserv-te class-type-bw
Description
This command configures the percentage of RSVP interface bandwidth each CT shares, for example, the Bandwidth Constraint (BC).
The absolute value of the CT share of the interface bandwidth is derived as the percentage of the bandwidth advertised by IGP in the Maximum Reservable Link Bandwidth TE parameter, for example, the link bandwidth multiplied by the RSVP interface subscription percentage parameter.
This configuration also exists at RSVP interface level and the interface specific configured value overrides the global configured value. The BC value can be changed at any time.
The RSVP interface subscription percentage parameter is configured in the config>router>rsvp>interface context.
The operator can specify the Bandwidth Constraint (BC) for a CT which is not used in any of the TE class definition but that does not get used by any LSP originating or transiting this node.
When Diff-Serv is disabled on the node, this model degenerates into a single default CT internally with eight preemption priorities and a non-configurable BC equal to the Maximum Reservable Link Bandwidth. This would behave exactly like CT0 with eight preemption priorities and BC= Maximum Reservable Link Bandwidth if Diff-Serv was enabled.
The no form of this command reverts to the default value.
Parameters
- ct0 (ct1/ct2/ —ct7) %link-bandwidth
-
The Diff-Serv Class Type number. One or more system forwarding classes can be mapped to a CT.
Platforms
7705 SAR Gen 2
classic-cli
classic-cli
Syntax
classic-cli
Context
[Tree] (config>system>management-interface>cli classic-cli)
Full Context
configure system management-interface cli classic-cli
Description
Commands in this context configure the classic CLI management interface.
Platforms
7705 SAR Gen 2
classic-cli
Syntax
classic-cli
Context
[Tree] (config>system>security>management-interface classic-cli)
Full Context
configure system security management-interface classic-cli
Description
Commands in this context configure hash-control for the classic CLI interface.
Platforms
7705 SAR Gen 2
classic-lsn-max-subscriber-limit
classic-lsn-max-subscriber-limit
Syntax
classic-lsn-max-subscriber-limit max
no classic-lsn-max-subscriber-limit
Context
[Tree] (config>router>nat>inside classic-lsn-max-subscriber-limit)
[Tree] (config>service>vprn>nat>inside classic-lsn-max-subscriber-limit)
Full Context
configure router nat inside classic-lsn-max-subscriber-limit
configure service vprn nat inside classic-lsn-max-subscriber-limit
Description
This command sets the granularity of traffic distribution in the upstream direction across the MS-ISA within the scope of an inside routing context. Traffic distribution mechanism is based on the source IPv4 addresses/prefixes. More granular distribution is based on the IPv4 address, while distribution based on the IPv4 prefix (determined by prefix length) will be less granular. The granularity will further decrease with shorter prefix length.
For example, a prefix length of 32 will distribute individual /32 IPv4 addresses over multiple MS-ISAs in an ISA group. This will ensure better traffic load balancing at the expense of forwarding table utilization on the outside (public side) where each /32 is installed in the forwarding table. On the contrary, shorter prefixes will ensure better utilization of the forwarding table on the outside, at the expense of coarser spread of IP addresses over multiple MS-ISAs.
This command affects all flavors of LSN44 within the inside routing contexts, although its primary use is intended for deterministic NAT and dnat-only.
The length of the prefix that is used for distribution purposes is (32-n), where 2^n= classic-lsn-max-subscriber-limit. For example, if traffic distribution is based on the IPv4 address (prefix length = 32), then n must be 0. From here, it follows that classic-lsn-max-subscriber-limit must be set to 1:
Prefix length = 32 -> 32-n = 32 -> n=0 -> 2^0= 1 = classic-lsn-max-subscriber-limit classic-lsn-max-subscriber-limit = 1
The implicit method given by this command uses power of 2 calculations to provide prefix length for traffic distribution purposes. This roundabout approach to determine the prefix-length has roots in deterministic NAT where this command was originally introduced.
Even though deterministic NAT and dnat-only have very little in common, the method (and CLI syntax) for calculating the prefix length using the classic-lsn-max-subscriber-limit parameter for traffic distribution purposes is shared between the two. In dnat-only, this parameter is important from an operational perspective since it affects traffic load balancing over MS-ISA and the size of the routing table.
This command must be configured before any prefix is configured and can be modified only if there are no prefixes configured under the deterministic NAT.
Parameters
- max
-
The power of 2 (2^n) value which in deterministic NAT must match the largest subscriber-limit value in any deterministic pool referenced from this inside routing instance.
In dnat-only, this value can be set to any value from the allowed range.
In both cases, this value will determine the prefix-length (17-32) that will directly influence load distribution between the MS-ISAs and the size of the routing table.
Platforms
7705 SAR Gen 2
clear
clear
Syntax
clear
Context
[Tree] (admin clear)
Full Context
admin clear
Description
Commands in this context clear statistics.
Platforms
7705 SAR Gen 2
clear
Syntax
clear [now]
Context
[Tree] (admin>system>license clear)
Full Context
admin system license clear
Description
This command removes the entitlements that were installed using a license file.
All the entitlements must be unallocated; otherwise, the command fails.
Parameters
- now
-
Keyword used to specify the immediate removal of the license file entitlements. If the now keyword is not present, the user is prompted to confirm the removal.
Platforms
7705 SAR Gen 2
clear-df-bit
clear-df-bit
Syntax
[no] clear-df-bit
Context
[Tree] (config>service>ies>if>sap>ip-tunnel clear-df-bit)
[Tree] (config>service>vprn>if>sap>ipsec-tunnel clear-df-bit)
[Tree] (config>router>if>ipsec>ipsec-tunnel clear-df-bit)
[Tree] (config>service>ies>if>ipsec>ipsec-tunnel clear-df-bit)
Full Context
configure service ies interface sap ip-tunnel clear-df-bit
configure service vprn interface sap ipsec-tunnel clear-df-bit
configure router interface ipsec ipsec-tunnel clear-df-bit
configure service ies interface ipsec ipsec-tunnel clear-df-bit
Description
This command instructs the MS-ISA to reset the DF bit to 0 in all payload IP packets associated with the GRE or IPsec tunnel, before any potential fragmentation resulting from the ip-mtu command (this requires a modification of the header checksum).
The no form of this command disables the DF bit reset.
Default
no clear-df-bit
Platforms
7705 SAR Gen 2
clear-df-bit
Syntax
[no] clear-df-bit
Context
[Tree] (config>ipsec>tnl-temp clear-df-bit)
Full Context
configure ipsec tunnel-template clear-df-bit
Description
This command enables clearing of the Do-not-Fragment bit.
Default
no clear-df-bit
Platforms
7705 SAR Gen 2
clear-ocsp-cache
clear-ocsp-cache
Syntax
clear-ocsp-cache [entry-id]
Context
[Tree] (admin>certificate clear-ocsp-cache)
Full Context
admin certificate clear-ocsp-cache
Description
This command clears the current OCSP response cache. If optional issuer and serial-number are not specified, then all current cached results are cleared.
Parameters
- entry-id
-
Specifies the local cache entry identifier of the certificate to clear.
Platforms
7705 SAR Gen 2
clear-request
clear-request
Syntax
clear-request ca ca-profile-name
Context
[Tree] (admin>certificate>cmpv2 clear-request)
Full Context
admin certificate cmpv2 clear-request
Description
This command clears current pending CMPv2 requests toward the specified CA. If there are no pending requests, it will clear the saved result of prior request.
Parameters
- ca ca-profile-name
-
Specifies a ca-profile name up to 32 characters.
Platforms
7705 SAR Gen 2
clear-tag-mode
clear-tag-mode
Syntax
clear-tag-mode clear-tag-mode
no clear-tag-mode
Context
[Tree] (config>macsec>connectivity-association clear-tag-mode)
Full Context
configure macsec connectivity-association clear-tag-mode
Description
This command puts 802.1Q tags in cleartext before the SecTAG. There are two modes: single-tag and dual-tag.
Encrypted Dot1q and QinQ Packet Format explains the encrypted dot1q and QinQ packet format when clear-tag-mode single-tag or dual-tag is configured.
The no form of this command puts all dot1q tags encrypted after the SecTAG.
|
Unencrypted format |
Clear-tag-mode |
Pre-encryption (Tx) |
Pre-decryption (Rx) |
|---|---|---|---|
|
Single tag (dot1q) |
single-tag |
DA, SA, TPID, VID, Etype |
DA, SA, TPID, VID, SecTag |
|
Single tag (dot1q) |
dual-tag |
DA, SA, TPID, VID, Etype |
DA, SA, TPID, VID, SecTag |
|
Double tag (q-in-q) |
single-tag |
DA, SA, TPID1, VID1, IPID2, VID2, Etype |
DA, SA, TPID1, VID1, SecTag |
|
Double tag (QinQ) |
dual-tag |
DA, SA, TPID1, VID1, IPID2, VID2, Etype |
DA, SA, TPID1, VID1, IPID2, VID2, SecTag |
Default
no clear-tag-mode
Parameters
- clear-tag-mode
-
Specifies the clear tag mode.
Platforms
7705 SAR Gen 2
cli
cli
Syntax
cli
Context
[Tree] (config>system>management-interface cli)
Full Context
configure system management-interface cli
Description
Commands in this context configure the CLI management interfaces.
Platforms
7705 SAR Gen 2
cli
Syntax
cli {warning | info}
Context
[Tree] (config>system>management-interface>cli>md-cli>environment>message-severity-level cli)
Full Context
configure system management-interface cli md-cli environment message-severity-level cli
Description
This command specifies the threshold for CLI messages.
Default
cli info
Parameters
- warning
-
Specifies that WARNING messages are displayed but INFO messages are suppressed.
- info
-
Specifies that INFO messages and WARNING messages are displayed.
Platforms
7705 SAR Gen 2
cli-engine
cli-engine
Syntax
cli-engine {classic-cli | md-cli} [{classic-cli | md-cli}]
no cli-engine
Context
[Tree] (config>system>management-interface>cli cli-engine)
Full Context
configure system management-interface cli cli-engine
Description
This command configures the system-wide CLI engine. The operator can configure one or both engines. For the configuration to take effect, exit the running CLI session and start a new session after committing the new value.
Parameters
- classic-cli
-
Specifies the classic CLI.
- md-cli
-
Specifies the MD-CLI.
Platforms
7705 SAR Gen 2
cli-script
cli-script
Syntax
cli-script
Context
[Tree] (config>system>security cli-script)
Full Context
configure system security cli-script
Description
Commands in this context configure the security parameters in the system.
Platforms
7705 SAR Gen 2
cli-session-group
cli-session-group
Syntax
cli-session-group session-group-name [create]
no cli-session-group session-group-name
Context
[Tree] (config>system>security cli-session-group)
Full Context
configure system security cli-session-group
Description
This command is used to configure a session group that can be used to limit the number of CLI sessions available to members of the group.
Parameters
- session-group-name
-
Specifies a particular session group.
Platforms
7705 SAR Gen 2
cli-user
cli-user
Syntax
cli-user user-name
no cli-user
Context
[Tree] (config>system>security>cli-script>authorization>event-handler cli-user)
[Tree] (config>system>security>cli-script>authorization>cron cli-user)
Full Context
configure system security cli-script authorization event-handler cli-user
configure system security cli-script authorization cron cli-user
Description
This command configures the user context under which various types of CLI scripts should execute in order to authorize the script commands. TACACS+ and RADIUS users and authorization are not permitted for cli-script authorization.
The no form of this command configures scripts to execute with no restrictions and without performing authorization.
Default
no cli-user
Parameters
- user-name
-
The name of a user in the local node database. TACACS+ or RADIUS users cannot be used. The user configuration should reference a valid local profile for authorization.
Platforms
7705 SAR Gen 2
client
client
Syntax
client client-index [create]
no client client-index
Context
[Tree] (config>ipsec>client-db client)
Full Context
configure ipsec client-db client
Description
This command creates a new IPsec client entry in the client-db or enters the configuration context of an existing client entry.
There may be multiple client entries defined in the same client-db. If there are multiple entries that match the new tunnel request, then the system will select the entry that has smallest client-index.
The no form of this command reverts to the default.
Parameters
- client-index
-
Specifies the ID of the client entry.
- create
-
Keyword used to create the security policy instance. The create keyword requirement can be enabled or disabled in the environment>create context.
Platforms
7705 SAR Gen 2
client
Syntax
client all
client ip-address
no client
Context
[Tree] (debug>system>grpc client)
Full Context
debug system grpc client
Description
This command enables debug output for all clients for a particular client.
The no form of this command deactivates debugging for all clients.
Parameters
- all
-
Specifies that debugging will occur for all clients.
- ip-address
-
Specifies the IPv4 or IPv6 address of the client.
Platforms
7705 SAR Gen 2
client
Syntax
client
Context
[Tree] (config>system>security>ssh>key-re-exchange client)
Full Context
configure system security ssh key-re-exchange client
Description
Commands in this context enable the key re-exchange for SR OS as an SSH client.
Platforms
7705 SAR Gen 2
client-cert-subject-key-id
client-cert-subject-key-id
Syntax
[no] client-cert-subject-key-id
Context
[Tree] (config>ipsec>rad-auth-plcy>include client-cert-subject-key-id)
Full Context
configure ipsec radius-authentication-policy include-radius-attribute client-cert-subject-key-id
Description
This command enables the inclusion of the Subject Key Identifier of the peer's certificate in the RADIUS Access-Request packet as VSA: Alc-Subject-Key-Identifier.
Default
no client-cert-subject-key-id
Platforms
7705 SAR Gen 2
client-cipher-list
client-cipher-list
Syntax
client-cipher-list
Context
[Tree] (config>system>security>ssh client-cipher-list)
Full Context
configure system security ssh client-cipher-list
Description
Commands in this context configure a list of allowed ciphers by the SSH client.
Platforms
7705 SAR Gen 2
client-cipher-list
Syntax
client-cipher-list name [create]
no client-cipher-list name
Context
[Tree] (config>system>security>tls client-cipher-list)
Full Context
configure system security tls client-cipher-list
Description
This command creates a cipher list that the client sends to the server in the client Hello message. It is a list of ciphers that are supported and preferred by the SR OS to be used in the TLS session. The server matches this list against the server cipher list. The most preferred cipher found in both lists is chosen.
Parameters
- name
-
Specifies the name of the client cipher list, up to 32 characters in length.
- create
-
Keyword used to create the client cipher list.
Platforms
7705 SAR Gen 2
client-db
client-db
Syntax
client-db db-name [create]
no client-db db-name
Context
[Tree] (config>ipsec client-db)
Full Context
configure ipsec client-db
Description
This command creates a new IPsec client-db or enters the configuration context of an existing client-db.
An IPsec client-db can be used for IKEv2 dynamic LAN-to-LAN tunnel authentication and authorization. When a new tunnel request is received, the system will match the request to the client entries configured in client-db and use credentials returned by the matched client entry for authentication. If authentication succeeds, the system could also use the IPsec configuration parameters (such as private-service-id) returned by the matched entry to set up the tunnel.
The configured client-db is referenced under the ipsec-gw configuration context using the client-db command.
The no form of this command removes the db-name from the configuration.
Parameters
- db-name
-
Specifies the name of this IPsec client up to 32 characters.
- create
-
Keyword used to create the security policy instance. The create keyword requirement can be enabled or disabled in the environment>create context.
Platforms
7705 SAR Gen 2
client-db
Syntax
client-db name
client-db name fallback
client-db name no-fallback
no client-db
Context
[Tree] (config>service>ies>if>sap>ipsec-gw client-db)
[Tree] (config>service>vprn>if>sap>ipsec-gw client-db)
Full Context
configure service ies interface sap ipsec-gw client-db
configure service vprn interface sap ipsec-gw client-db
Description
This command enables the use of an IPsec client database. The system uses the specified client database to authenticate IKEv2 dynamic LAN-to-LAN tunnel.
Default
no client-db
Parameters
- name
-
Specifies the name of the client database.
- fallback
-
Specifies whether or not this IPsec gateway falls back to the default authentication policy when the IPsec tunnel authentication request fails to match any clients in the IPsec database.
- no-fallback
-
Specifies that if the client database lookup fails to return a matched result, the system will fail the tunnel setup.
Platforms
7705 SAR Gen 2
client-db
Syntax
[no] no client-db db-name
Context
[Tree] (debug>ipsec client-db)
Full Context
debug ipsec client-db
Description
This command enables debugging for the specified IPsec client-db.
Parameters
- db-name
-
Specifies the IPsec client database name, up to 32 characters.
Platforms
7705 SAR Gen 2
client-group-list
client-group-list
Syntax
client-group-list name [create]
no client-group-list name
Context
[Tree] (config>system>security>tls client-group-list)
Full Context
configure system security tls client-group-list
Description
This command configures a list of group suite codes that the client sends in a client Hello message.
The no form of this command removes the client group list.
Parameters
- name
-
Specifies the name of the client group list, up to 32 characters.
- create
-
Keyword used to create the client group list.
Platforms
7705 SAR Gen 2
client-host-key-list
client-host-key-list
Syntax
client-host-key-list
Context
[Tree] (config>system>security>ssh client-host-key-list)
Full Context
configure system security ssh client-host-key-list
Description
Commands in this context configure the list of host key algorithms negotiated by the SR OS acting as the SSH client.
Platforms
7705 SAR Gen 2
client-identification
client-identification
Syntax
client-identification
Context
[Tree] (config>ipsec>client-db>client client-identification)
Full Context
configure ipsec client-db client client-identification
Description
Commands in this context configure client ID information of this IPsec client.
If there are multiple match input are configured in the match-list of the client-db, then all corresponding match criteria must be configured for the client-entry.
Platforms
7705 SAR Gen 2
client-kex-list
client-kex-list
Syntax
client-kex-list
Context
[Tree] (config>system>security>ssh client-kex-list)
Full Context
configure system security ssh client-kex-list
Description
Commands in this context configure SSH KEX algorithms for SR OS as a client.
An empty list is the default list that the SSH KEX advertises. The default list contains the following:
ecdh-sha2-nistp512
ecdh-sha2-nistp384
ecdh-sha2-nistp256
diffie-hellman-group16-sha512
diffie-hellman-group14-sha256
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1
Platforms
7705 SAR Gen 2
client-mac-address
client-mac-address
Syntax
[no] client-mac-address
Context
[Tree] (config>service>vpls>sap>dhcp>option>vendor client-mac-address)
[Tree] (config>service>vprn>if>dhcp>option>vendor client-mac-address)
[Tree] (config>service>ies>if>dhcp>option>vendor client-mac-address)
Full Context
configure service vpls sap dhcp option vendor-specific-option client-mac-address
configure service vprn interface dhcp option vendor-specific-option client-mac-address
configure service ies interface dhcp option vendor-specific-option client-mac-address
Description
This command enables the sending of the MAC address in the Nokia vendor-specific sub-option of the DHCP relay packet.
The no form of this command disables the sending of the MAC address in the Nokia vendor-specific sub-option of the DHCP relay packet.
Platforms
7705 SAR Gen 2
client-mac-list
client-mac-list
Syntax
client-mac-list
Context
[Tree] (config>system>security>ssh client-mac-list)
Full Context
configure system security ssh client-mac-list
Description
Commands in this context configure SSH MAC algorithms for SR OS as a client.
Platforms
7705 SAR Gen 2
client-name
client-name
Syntax
client-name name
no client-name
Context
[Tree] (config>ipsec>client-db>client client-name)
Full Context
configure ipsec client-db client client-name
Description
This command specifies the name of the client entry. The client name can be used in CLI navigation or in show commands.
Default
no client-name
Parameters
- name
-
Specifies the name of the client.
Platforms
7705 SAR Gen 2
client-signature-list
client-signature-list
Syntax
client-signature-list name [create]
no client-signature-list name
Context
[Tree] (config>system>security>tls client-signature-list)
Full Context
configure system security tls client-signature-list
Description
This command configures a list of TLS 1.3-supported signature suite codes that the client sends in a client Hello message.
The no form of this command removes the client signature list.
Parameters
- name
-
Specifies the name of the client signature list, up to 32 characters.
- create
-
Keyword used to create the client signature list.
Platforms
7705 SAR Gen 2
client-tls-profile
client-tls-profile
Syntax
client-tls-profile name
no client-tls-profile
Context
[Tree] (config>system>security>pki>est-profile client-tls-profile)
Full Context
configure system security pki est-profile client-tls-profile
Description
This command configures the TLS client profile to be assigned to applications for encryption. The profile creates the TLS connection to the EST server.
The no form of this command removes the name from the configuration.
Default
no client-tls-profile
Parameters
- name
-
Specifies the name of the client TLS profile, up to 32 characters
Platforms
7705 SAR Gen 2
client-tls-profile
Syntax
client-tls-profile name [create]
no client-tls-profile name
Context
[Tree] (config>system>security>tls client-tls-profile)
Full Context
configure system security tls client-tls-profile
Description
This command configures the TLS client profile to be assigned to applications for encryption.
Parameters
- name
-
Specifies the name of the client TLS profile, up to 32 characters in length.
- create
-
Keyword used to create the client TLS profile.
Platforms
7705 SAR Gen 2
client-tls-profile
Syntax
client-tls-profile name
no client-tls-profile
Context
[Tree] (config>system>management-interface>remote-management client-tls-profile)
Full Context
configure system management-interface remote-management client-tls-profile
Description
This command configures the TLS client profile used for encryption by all remote managers. This command and allow-unsecure-connection are mutually exclusive.
If this command is also configured for a specific manager in the config>system> management-interface>remote-management>manager context, that configuration takes precedence.
The no form of this command causes the profile configuration not to be used.
Parameters
- name
-
Specifies the name of the client TLS profile, up to 32 characters.
Platforms
7705 SAR Gen 2
client-tls-profile
Syntax
client-tls-profile name
no client-tls-profile
Context
[Tree] (config>system>management-interface>remote-management>manager client-tls-profile)
Full Context
configure system management-interface remote-management manager client-tls-profile
Description
This command configures the TLS client profile used for encryption by this remote manager. This command and allow-unsecure-connection are mutually exclusive.
This command takes precedence over the same command configured in the global context (config>system>management-interface>remote-management).
The no form of this command causes the profile configuration to be inherited from the global context (config>system>management-interface>remote-management).
Parameters
- name
-
Specifies the name of the client TLS profile, up to 32 characters.
Platforms
7705 SAR Gen 2
clli-code
clli-code
Syntax
clli-code clli-code
no clli-code
Context
[Tree] (config>system clli-code)
Full Context
configure system clli-code
Description
This command creates a Common Language Location Identifier (CLLI) code string for the router. A CLLI code is an 11-character standardized geographic identifier that uniquely identifies geographic locations and certain functional categories of equipment unique to the telecommunications industry.
No CLLI validity checks other than truncating or padding the string to eleven characters are performed.
Only one CLLI code can be configured, if multiple CLLI codes are configured the last one entered overwrites the previous entry.
The no form of the command removes the CLLI code.
Default
no clli-code
Parameters
- clli-code
-
Specifies the 11 character string CLLI code. Any printable, seven bit ASCII characters can be used within the string. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. If more than 11 characters are entered, the string is truncated. If less than 11 characters are entered the string is padded with spaces.
Platforms
7705 SAR Gen 2
clock-offset
clock-offset
Syntax
clock-offset seconds
no clock-offset
Context
[Tree] (config>oam-pm>session>meas-interval clock-offset)
Full Context
configure oam-pm session meas-interval clock-offset
Description
This command allows measurement intervals with a boundary-type of clock aligned to be offset from the default time of day clock. The configured offset must be smaller than the size of the measurement interval. As an example, an offset of 120 (seconds) shifts the start times of the measurement intervals by two minutes from their default alignments with respect to the time of day clock.
The no form of this command sets the offset to 0.
Default
clock-offset 0
Parameters
- seconds
-
Specifies the number of seconds to offset a clock-alignment measurement interval from its default.
Platforms
7705 SAR Gen 2
close-session
close-session
Syntax
[no] close-session
Context
[Tree] (configure>system>security>profile>netconf>base-op-authorization close-session)
Full Context
configure system security profile netconf base-op-authorization close-session
Description
This command enables the NETCONF <close-session> RPC.
The no form of this command disables the RPC.
Default
no close-session
The operation is enabled by default in the built-in system-generated administrative profile.
Platforms
7705 SAR Gen 2
cluster
cluster
Syntax
cluster cluster-id
no cluster
Context
[Tree] (config>service>vprn>bgp cluster)
[Tree] (config>service>vprn>bgp>group>neighbor cluster)
[Tree] (config>service>vprn>bgp>group cluster)
Full Context
configure service vprn bgp cluster
configure service vprn bgp group neighbor cluster
configure service vprn bgp group cluster
Description
This command configures the cluster ID for a route reflector server.
Route reflectors are used to reduce the number of IBGP sessions required within an AS. Normally, all BGP speakers within an AS must have a BGP peering with every other BGP speaker in an AS. A route reflector and its clients form a cluster. Peers that are not part of the cluster are considered to be non-clients.
When a route reflector receives a route, first it must select the best path from all the paths received. If the route was received from a non-client peer, then the route reflector sends the route to all clients in the cluster. If the route came from a client peer, the route reflector sends the route to all non-client peers and to all client peers except the originator.
For redundancy, a cluster can have multiple route reflectors.
Confederations can also be used to remove the full IBGP mesh requirement within an AS.
The no form of this command deletes the cluster ID and effectively disables the Route Reflection for the given group.
Default
no cluster — No cluster ID is defined.
Parameters
- cluster-id
-
The route reflector cluster ID is expressed in dot decimal notation.
Platforms
7705 SAR Gen 2
cluster
Syntax
cluster cluster-id orr-location location-id [ allow-local-fallback]]
Context
[Tree] (config>router>bgp cluster)
Full Context
configure router bgp cluster
Description
This command configures the cluster ID for a route reflector server ID and implicitly configures the associated BGP sessions as route reflector clients of the BGP instance. If an ORR location ID is specified with the cluster ID, the clients in that cluster receive routes optimal for that specific location; refer to draft-ietf-idr-bgp-optimal-route-reflection for more information.
Route reflectors are used to reduce the number of IBGP sessions required within an AS. Normally, all BGP speakers within an AS must have a BGP peering with every other BGP speaker in an AS. A route reflector and its clients form a cluster. Peers that are not part of the cluster are considered to be non-clients.
When a route reflector receives best path from a non-client peer, it sends the route to all clients. When the route reflector receives a best path from a client peer it sends the route to all non-client and all client peers except the originator.
With optimal route reflection, the best path advertised to a client takes location ID into account, which means that if the tie-break for best path (or Add-Paths) comes down to next-hop IGP cost, the IGP costs will be calculated relative to the specified location. In the SR OS implementation, the IGP costs from arbitrary ORR locations are calculated using OSPF/OSPFv3, IS-IS, or BGP-LS information in the TE DB.
Default
no cluster
Parameters
- ip-address
-
Specifies the route reflector cluster ID is expressed in dot decimal notation.
- orr-location location-id
-
Specifies the optimal route reflection location index for this set of route reflector clients.
- allow-local-fallback
-
Controls the behavior when there are no BGP routes to advertise to the RR clients that are reachable from the perspective of their ORR location. If this option is configured, the RR is allowed (in this circumstance only), to advertise the best reachable BGP path from its own topology location. If this option is not configured and this situation applies, then no route is advertised to the clients.
Platforms
7705 SAR Gen 2
cluster
Syntax
cluster cluster-id orr-location location-id [ allow-local-fallback]]
cluster cluster-id
no cluster
Context
[Tree] (config>router>bgp>group cluster)
[Tree] (config>router>bgp>group>neighbor cluster)
Full Context
configure router bgp group cluster
configure router bgp group neighbor cluster
Description
This command configures the cluster ID for a route reflector server ID and implicitly configures the associated BGP sessions as route reflector clients of the BGP instance. If an ORR location ID is specified with the cluster ID, the clients in that cluster receive routes optimal for that specific location; see draft-ietf-idr-bgp-optimal-route-reflection for more information.
Route reflectors are used to reduce the number of IBGP sessions required within an AS. Normally, all BGP speakers within an AS must have a BGP peering with every other BGP speaker in an AS. A route reflector and its clients form a cluster. Peers that are not part of the cluster are considered to be non-clients.
When a route reflector receives best path from a non-client peer, it sends the route to all clients. When the route reflector receives a best path from a client peer it sends the route to all non-client and all client peers except the originator.
With optimal route reflection, the best path advertised to a client takes location ID into account, which means that if the tie-break for best path (or Add-Paths) comes down to next-hop IGP cost, the IGP costs will be calculated relative to the specified location. In the SR OS implementation, the IGP costs from arbitrary ORR locations are calculated using OSPF/OSPFv3, IS-IS, or BGP-LS information in the TE DB.
The no form of this command deletes the cluster ID and effectively disables route reflection for the group.
Default
no cluster
Parameters
- ip-address
-
Specifies the route reflector cluster ID is expressed in dot decimal notation.
- orr-location location-id
-
Specifies the optimal route reflection location index for this set of route reflector clients.
- allow-local-fallback
-
Controls the behavior when there are no BGP routes to advertise to the RR clients that are reachable from the perspective of their ORR location. If this option is configured, the RR is allowed (in this circumstance only), to advertise the best reachable BGP path from its own topology location. If this option is not configured and this situation applies, then no route is advertised to the clients.
Platforms
7705 SAR Gen 2
cluster-id
cluster-id
Syntax
cluster-id ip-address/mask [ip-address/mask]
cluster-id none
no cluster-id
Context
[Tree] (config>router>policy-options>policy-statement>entry>from cluster-id)
Full Context
configure router policy-options policy-statement entry from cluster-id
Description
This command enables BGP routes to be matched based on the IP addresses encoded in the CLUSTER_LIST attribute.
The first ip-address/mask pair is matched against the most recently added cluster ID. Each subsequent ip-address/mask pair is tested against the next most recent cluster ID.
For example, to match all routes reflected by the RR with cluster ID 1.1.1.1 and then any other RR before reaching the router where the policy is applied, use the command cluster-id 0.0.0.0/0 1.1.1.1/32.
The command matches routes with two or more cluster IDs; the third and older cluster IDs are not evaluated and are automatically considered matching.
The cluster-id none form of this command only matches BGP routes without any CLUSTER_LIST attribute.
A non-BGP route does not match a policy entry if it contains the cluster-id command.
Default
no cluster-id
Parameters
- ip-address
-
Specifies the 32-bit cluster ID in dotted decimal notation.
- mask
-
Specifies a bit mask to apply to the ip-address parameter.
- none
-
Specifies that only BGP routes without a CLUSTER_LIST attribute should be matched.
Platforms
7705 SAR Gen 2
cmpv2
cmpv2
Syntax
cmpv2
Context
[Tree] (admin>certificate cmpv2)
Full Context
admin certificate cmpv2
Description
Commands in this context configure CMPv2 operations.
Platforms
7705 SAR Gen 2
cmpv2
Syntax
cmpv2
Context
[Tree] (config>system>security>pki>ca-profile cmpv2)
Full Context
configure system security pki ca-profile cmpv2
Description
Commands in this context configure CMPv2 parameters.
Platforms
7705 SAR Gen 2
cmpv2
Syntax
[no] cmpv2
Context
[Tree] (debug>certificate cmpv2)
Full Context
debug certificate cmpv2
Description
This command enables debugging of CMPv2 operations.
Platforms
7705 SAR Gen 2
coa-script-policy
coa-script-policy
Syntax
coa-script-policy policy-name
no coa-script-policy
Context
[Tree] (config>service>vprn>radius-server>server coa-script-policy)
[Tree] (config>router>radius-server>server coa-script-policy)
Full Context
configure service vprn radius-server server coa-script-policy
configure router radius-server server coa-script-policy
Description
This command specifies the RADIUS script policy to modify the Change-of-Authorization messages sent from this RADIUS server.
The no form of this command removes the policy name from the configuration.
Parameters
- policy-name
-
Specifies the name of radius-script-policy up to 80 characters.
Platforms
7705 SAR Gen 2
code-type
code-type
Syntax
code-type [sonet | sdh]
[no] code-type
Context
[Tree] (config>port>ethernet>ssm code-type)
Full Context
configure port ethernet ssm code-type
Description
This command configures the encoding of synchronization status messages. For example, whether to use an SDH or SONET set of values. Configuring the network-type is only applicable to SyncE ports. It is not configurable on SONET/SDH ports. For the network-type, sdh refers to ITU-T G.781 Option I, while sonet refers to G.781 Option II (equivalent to Telcordia GR-253-CORE).
Default
code-type sdh
Parameters
- sdh
-
Specifies the values used on a G.781 Option 1 compliant network.
- sonet
-
Specifies the values used on a G.781 Option 2 compliant network.
Platforms
7705 SAR Gen 2
coherent
coherent
Syntax
coherent
Context
[Tree] (config>port>dwdm coherent)
Full Context
configure port dwdm coherent
Description
This command configures the coherent optical module parameters.
Platforms
7705 SAR Gen 2
cold-start-wait
cold-start-wait
Syntax
cold-start-wait seconds
no cold-start-wait
Context
[Tree] (config>log>app-route-notifications cold-start-wait)
Full Context
configure log app-route-notifications cold-start-wait
Description
The time delay that must pass before notifying specific CPM applications that a route is available after a cold reboot.
Default
no cold-start-wait
Parameters
- seconds
-
Time delay in seconds.
Platforms
7705 SAR Gen 2
collect-stats
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>service>vpls>mesh-sdp collect-stats)
[Tree] (config>service>vpls>spoke-sdp collect-stats)
[Tree] (config>service>ies>if>sap collect-stats)
[Tree] (config>service>vpls>sap collect-stats)
Full Context
configure service vpls mesh-sdp collect-stats
configure service vpls spoke-sdp collect-stats
configure service ies interface sap collect-stats
configure service vpls sap collect-stats
Description
This command enables accounting and statistical data collection for either the SAP or SDP, network port, or IP interface. When applying accounting policies the data, by default, is collected in the appropriate records and written to the designated billing file.
When the no collect-stats command is issued the statistics are still accumulated by the IOM cards. However, the CPU does not obtain the results and write them to the billing file. If a subsequent collect-stats command is issued then the counters written to the billing file include all the traffic while the no collect-stats command was in effect.
Default
collect-stats
Platforms
7705 SAR Gen 2
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>card>fp>ingress>access>queue-group collect-stats)
[Tree] (config>card>fp>ingress>network>queue-group collect-stats)
Full Context
configure card fp ingress access queue-group collect-stats
configure card fp ingress network queue-group collect-stats
Description
This command enables the collection of accounting and statistical data for the queue group on the forwarding plane. When applying accounting policies, the data, by default, is collected in the appropriate records and written to the designated billing file.
When the no collect-stats command is issued, the statistics are still accumulated, however, the CPU does not obtain the results and write them to the billing file. If the collect-stats command is issued again (enabled), then the counters written to the billing file will include the traffic collected while the no collect-stats command was in effect.
Default
no collect-stats
Platforms
7705 SAR Gen 2
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>port>ethernet collect-stats)
[Tree] (config>port>ethernet>access>egr>qgrp collect-stats)
[Tree] (config>port>ethernet>network>egr>qgrp collect-stats)
[Tree] (config>port>ethernet>access>ing>qgrp collect-stats)
[Tree] (config>port>ethernet>network collect-stats)
Full Context
configure port ethernet collect-stats
configure port ethernet access egress queue-group collect-stats
configure port ethernet network egress queue-group collect-stats
configure port ethernet access ingress queue-group collect-stats
configure port ethernet network collect-stats
Description
This command enables the collection of accounting and statistical data for the network interface. When applying accounting policies, the data, by default, is collected in the appropriate records and written to the designated billing file.
When the no collect-stats command is issued, the statistics are still accumulated by the XCM/IOM cards, however, the CPU does not obtain the results and write them to the billing file. If the collect-stats command is issued again (enabled), then the counters written to the billing file will include the traffic collected while the no collect-stats command was in effect.
Default
no collect-stats
Platforms
7705 SAR Gen 2
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>service>epipe>sap collect-stats)
[Tree] (config>service>epipe>spoke-sdp collect-stats)
Full Context
configure service epipe sap collect-stats
configure service epipe spoke-sdp collect-stats
Description
This command enables accounting and statistical data collection for either the SAP, network port, or IP interface. When applying accounting policies the data, by default, is collected in the appropriate records and written to the designated billing file.
When the no collect-stats command is issued the statistics are still accumulated by the cards. However, the CPU will not obtain the results and write them to the billing file. If a subsequent collect-stats command is issued, then the counters written to the billing file include all the traffic while the no collect-stats command was in effect.
Default
no collect-stats
Platforms
7705 SAR Gen 2
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>service>ies>if>spoke-sdp collect-stats)
Full Context
configure service ies interface spoke-sdp collect-stats
Description
This command enables statistics collection.
Platforms
7705 SAR Gen 2
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>service>vprn>if>spoke-sdp collect-stats)
[Tree] (config>service>vprn>if>sap collect-stats)
Full Context
configure service vprn interface spoke-sdp collect-stats
configure service vprn interface sap collect-stats
Description
This command enables accounting and statistical data collection for either an interface SAP or interface SAP spoke SDP, or network port. When applying accounting policies the data, by default, is collected in the appropriate records and written to the designated billing file.
When the no collect-stats command is issued the statistics are still accumulated by the IOM cards. However, the CPU will not obtain the results and write them to the billing file. If a subsequent collect-stats command is issued then the counters written to the billing file include all the traffic while the no collect-stats command was in effect.
Default
no collect-stats
Platforms
7705 SAR Gen 2
collect-stats
Syntax
[no] collect-stats
Context
[Tree] (config>service>sdp collect-stats)
[Tree] (config>service>pw-template collect-stats)
Full Context
configure service sdp collect-stats
configure service pw-template collect-stats
Description
This command enables accounting and statistical data collection for either the SDP. When applying accounting policies the data, by default, is collected in the appropriate records and written to the designated billing file.
When the no collect-stats command is issued the statistics are still accumulated by the IOM or XCM cards. However, the CPU will not obtain the results and write them to the billing file. If a subsequent collect-stats command is issued then the counters written to the billing file include all the traffic while the no collect-stats command was in effect.
Default
no collect-stats
Platforms
7705 SAR Gen 2
collection-interval
collection-interval
Syntax
collection-interval minutes
no collection-interval
Context
[Tree] (config>log>acct-policy collection-interval)
Full Context
configure log accounting-policy collection-interval
Description
This command configures the accounting collection interval.
Parameters
- minutes
-
Specifies the interval between collections, in minutes.
Platforms
7705 SAR Gen 2
color
color
Syntax
color color
no color
Context
[Tree] (conf>router>segment-routing>sr-policies>policy color)
Full Context
configure router segment-routing sr-policies static-policy color
Description
This command associates a color value with a statically defined segment routing policy. This is a mandatory parameter and configuration command to enable the segment routing policy; if the color parameter value is not configured, the execution of the no shutdown command on the static segment routing policy fails.
The no form of this command removes the color association.
Default
no color
Parameters
- color
-
Specifies the color ID.
Platforms
7705 SAR Gen 2
color
Syntax
color color-id
no color
Context
[Tree] (config>router>policy-options>policy-statement>entry>from color)
Full Context
configure router policy-options policy-statement entry from color
Description
This command configures an SR Policy color ID as a route policy match criterion.
This match criterion is only used in import policies.
The no form of this command removes the configuration.
Parameters
- color-id
-
Specifies the SR policy color ID.
Platforms
7705 SAR Gen 2
color
Syntax
color color-id
Context
[Tree] (config>oam-pm>session>ip>tunnel>mpls>sr-policy color)
Full Context
configure oam-pm session ip tunnel mpls sr-policy color
Description
This command configures the color for associating the SR policy with an objective.
Default
color 0
Parameters
- color-id
-
Specifies the color ID.
Platforms
7705 SAR Gen 2
combined-max-sessions
combined-max-sessions
Syntax
combined-max-sessions number-of-sessions
no combined-max-sessions
Context
[Tree] (config>system>security>profile combined-max-sessions)
[Tree] (config>system>security>cli-session-group combined-max-sessions)
Full Context
configure system security profile combined-max-sessions
configure system security cli-session-group combined-max-sessions
Description
This command is used to limit the number of combined SSH/TELNET based sessions available to all users that are part of a specific profile, or to all users of all profiles that are part of the same cli-session-group.
The no form of this command disables the command and the profile or group limit is not applied to the number of combined sessions.
Default
no combined-max-sessions
Parameters
- number-of-sessions
-
Specifies the maximum number of allowed combined SSH/TELNET based sessions.
Platforms
7705 SAR Gen 2
command-accounting-during-load
command-accounting-during-load
Syntax
[no] command-accounting-during-load
Context
[Tree] (config>system>security>management-interface>md-cli command-accounting-during-load)
Full Context
configure system security management-interface md-cli command-accounting-during-load
Description
This command controls command accounting performed on the contents of a file loaded using the MD-CLI load or rollback command.
When enabled, all commands in the loaded file are logged, which may decrease the system response time with large files.
When disabled, command accounting is not performed during a load or rollback operation, which may increase the system response time by reducing the number of command accounting messages, especially when remote AAA servers are used.
The load or rollback command itself is always logged.
The no form of this command disables command accounting during a load or rollback operation.
Default
command-accounting-during-load
Platforms
7705 SAR Gen 2
command-completion
command-completion
Syntax
command-completion
Context
[Tree] (config>system>management-interface>cli>md-cli>environment command-completion)
Full Context
configure system management-interface cli md-cli environment command-completion
Description
This command configures keystrokes to trigger command completion.
Platforms
7705 SAR Gen 2
comment
comment
Syntax
[no] comment
Context
[Tree] (config>system>management-interface>cli>md-cli>environment>commit-options comment)
Full Context
configure system management-interface cli md-cli environment commit-options comment
Description
This command configures the requirement for a commit comment when committing configuration.
The no form of this command does not require a commit comment when committing configuration
Default
no comment
Platforms
7705 SAR Gen 2
commit
commit
Syntax
commit
Context
[Tree] (config>router>bfd commit)
Full Context
configure router bfd commit
Description
This command saves the changes made to a BFD template during an active session and makes the changes active.
Platforms
7705 SAR Gen 2
commit
Syntax
commit
Context
[Tree] (config>router>route-next-hop-policy commit)
Full Context
configure router route-next-hop-policy commit
Description
This command saves the changes made to route next-hop templates during an active session.
Default
commit
Platforms
7705 SAR Gen 2
commit
Syntax
commit [confirmed timeout] [comment comment]
commit no-checkpoint [confirmed timeout]
Context
[Tree] (candidate commit)
Full Context
candidate commit
Description
This command applies the changes in the candidate configuration to the active running configuration. The candidate changes will take operational effect.
If a commit operation is successful then all of the candidate changes will take operational effect and the candidate is cleared. If there is an error in the processing of the commit, or a 'commit confirmed’ is not confirmed and an auto-revert occurs, then the router will return to a configuration state with none of the candidate changes applied. The operator can then continue editing the candidate and try a commit later.
By default, the SR OS will automatically create a new rollback checkpoint after a commit operation. The rollback checkpoint will contain the new configuration changes made by the commit. An optional no-checkpoint keyword can be used to avoid the auto-creation of a rollback checkpoint after a commit.
A commit operation is blocked if a rollback revert is currently being processed.
Parameters
- confirmed
-
specifies that the commit operation (if successful) should be automatically reverted (undone) at the end of the timeout period unless the operator issues the confirm command before the timeout period expires. A rollback checkpoint is created after the commit operation (if successful) and will remain available whether the commit is auto-reverted or not. The contents of the candidate will remain visible (candidate view) and changes to the candidate are blocked until the timeout is completed or the candidate confirm command is executed. If the timeout expires and an auto-revert occurs, then the original candidate config will be available in edit-cfg mode.
Standard line-by-line non-transactional configuration commands (including via SNMP) are not blocked during the countdown period and any changes made to the configuration during the countdown period will be rolled back if the timeout expires. The confirmed option is useful when changes are being made that could impact management reachability to the router.
A rollback revert is blocked during the countdown period until the commit has been confirmed.
- timeout
-
Specifies the auto-revert timeout period, in minutes.
- no-checkpoint
-
Specifies to avoid the automatic creation of a rollback checkpoint for a successful commit.
- comment comment
-
Adds a comment up to 255 characters to the automatic rollback checkpoint.
Platforms
7705 SAR Gen 2
commit
Syntax
commit
Context
[Tree] (config>router>policy-options commit)
Full Context
configure router policy-options commit
Description
This command is required to save changes made to a route policy.
Platforms
7705 SAR Gen 2
commit
Syntax
[no] commit
Context
[Tree] (configure>system>security>profile>netconf>base-op-authorization commit)
Full Context
configure system security profile netconf base-op-authorization commit
Description
This command enables the NETCONF <commit> RPC.
The no form of this command disables the RPC.
Default
no commit
The operation is enabled by default in the built-in system-generated administrative profile.
Platforms
7705 SAR Gen 2
commit-options
commit-options
Syntax
commit-options
Context
[Tree] (config>system>management-interface>cli>md-cli>environment commit-options)
Full Context
configure system management-interface cli md-cli environment commit-options
Description
Commands in this context configure commit options.
Platforms
7705 SAR Gen 2
common-name-list
common-name-list
Syntax
common-name-list name [create]
Context
[Tree] (config>system>security>pki common-name-list)
Full Context
configure system security pki common-name-list
Description
This command configures a list of common names (CNs) that will be used to authenticate X.509.3 certificates. If the CN field of the X.509.3 certificate matches any of the CNs in the list, then the certificate can be used.
Parameters
- name
-
Specifies the name of the CN list, up to 32 characters maximum.
Platforms
7705 SAR Gen 2
community
community
Syntax
community community-name [hash | hash2 | custom] [access-permissions] [ version SNMP-version] [src-access-list list-name]
no community community-name [hash | hash2 | custom]
Context
[Tree] (config>service>vprn>snmp community)
Full Context
configure service vprn snmp community
Description
This command sets the SNMP community name(s) to be used with the associated VPRN instance. These VPRN community names are used to associate SNMP v1/v2c requests with a particular vprn context and to return a reply that contains VPRN-specific data or limit SNMP access to data in a specific VPRN instance.
VPRN snmp communities configured with an access permission of 'r' are automatically associated with the default access group "snmp-vprn-ro” and the "vprn-view” view (read only). VPRN snmp communities configured with an access permission of 'rw' are automatically associated with the default access group "snmp-vprn” and the "vprn-view” view (read/write).
The community in an SNMP v1/v2 request determines the SNMP context (i.e., the vprn# for accessing SNMP tables) and not the VPRN of the incoming interface on which the request was received. When an SNMP request arrives on VPRN 5 interface "ringo” with a destination IP address equal to the "ringo” interface, but the community in the SNMP request is the community configured against VPRN 101, then the SNMP request will be processed using the VPRN 101 context. (the response will contain information about VPRN 101). It is recommended to avoid using a simple series of vprn snmp-community values that are similar to each other (for example, avoid my-vprncomm-1, my-vprn-comm-2, etc).
The no form of this command removes the SNMP community name from the given VPRN context.
Parameters
- community-name
-
Specifies the SNMP v1/v2c community name. This is a secret/confidential key used to access SNMP and specify a context (base vs vprn1 vs vprn2).
- hash
-
Specifies the key is entered in an encrypted form. If the hash or hash2 parameter is not used, the key is assumed to be in an unencrypted, cleartext form. For security, all keys are stored in encrypted form in the configuration file with the hash or hash2 parameter specified.
- hash2
-
Specifies the key is entered in a more complex encrypted form that involves more variables than the key value alone, meaning that the hash2 encrypted variable cannot be copied and pasted. If the hash or hash2 parameter is not used, the key is assumed to be in an unencrypted, cleartext form. For security, all keys are stored in encrypted form in the configuration file with the hash or hash2 parameter specified.
- custom
-
Specifies the custom encryption to management interface.
- version SNMP-version
-
Specifies the SNMP version.
- access-permissions
-
Specifies the access rights to MIB objects.
- list-name
-
Configures the community to reference a specific src-access-list (created under configure system security snmp), which will be used to validate the source IP address of all received SNMP requests that use this community. Multiple community (vprn or base router) and usm-community instances can reference the same src-access-list.
Platforms
7705 SAR Gen 2
community
Syntax
community comm-id [comm-id]
no community [comm-id [comm-id]]
Context
[Tree] (config>service>vprn>static-route-entry community)
Full Context
configure service vprn static-route-entry community
Description
This command associates a list of up to 12 BGP communities (any mix of standard, extended, and large communities) with the static route. These communities can be matched in route policies and are automatically added to BGP routes that are created from the static route.
The communities specified at this level of the static route causes communities configured under the next-hop, black-hole, and indirect contexts of the static route to be ignored.
The no form of this command removes the association.
Default
no community
Parameters
- comm-id
-
Specifies a BGP community value, up to 72 characters.
Platforms
7705 SAR Gen 2
community
Syntax
community comm-id
no community [comm-id]
Context
[Tree] (config>service>vprn>static-route-entry>next-hop community)
[Tree] (config>service>vprn>static-route-entry>indirect community)
[Tree] (config>service>vprn>static-route-entry>black-hole community)
Full Context
configure service vprn static-route-entry next-hop community
configure service vprn static-route-entry indirect community
configure service vprn static-route-entry black-hole community
Description
This command associates one BGP community (standard, extended or large) with a next-hop of the static route. This community can be matched in route policies and automatically added to BGP routes that are created from the static route.
Any community specified in one of these contexts is overridden by any communities specified at the prefix level of the static route entry.
The no form of this command removes the association.
Default
no community
Parameters
- comm-id
-
Specifies a BGP community value, up to 72 characters.
Platforms
7705 SAR Gen 2
community
Syntax
community comm-id
no community [comm-id]
Context
[Tree] (config>service>vprn>static-route-entry>ipsec-tunnel community)
Full Context
configure service vprn static-route-entry ipsec-tunnel community
Description
This configuration option associates a BGP community with the static route. The community can be matched in route policies and is automatically added to BGP routes exported from the static route.
The no form of this command removes the community association.
Default
no community
Parameters
- comm-id
-
Specifies community IDs, up to 72 characters.
Platforms
7705 SAR Gen 2
community
Syntax
community community-name
no community
Context
[Tree] (config>router>ldp>session-params>peer community)
[Tree] (config>router>ldp>targeted-session>peer-template community)
Full Context
configure router ldp session-parameters peer community
configure router ldp targeted-session peer-template community
Description
This command configures a community name associated with a targeted session to a specified peer. The community is a local configuration for a targeted session. FECs received over a session of a given community are taken to belong to that community, and are redistributed over sessions of the same community.
The SR OS router uses the following rules for community:
-
If both the session parameters for a specified peer and targeted peer template that is applied to session have the default configuration then no community applies.
-
If the session parameters for a peer have the default configuration, but targeted session peer template has an explicit configuration for community, then the targeted peer template configuration will be used.
-
If the session parameters have an explicit configuration for community, and the targeted session peer template has the default configuration, then the session parameter configuration applies.
-
If both session parameters and targeted peer template have an explicit configuration for community, then the session parameter configuration is used.
The no form of this command removes the community from the session to the peer. FEC subsequently received over the session are treated as having no community.
Default
no community
Parameters
- community-name
-
Specifies the string defining the LDP community assigned to the session. Allowed values are any string up to 32 characters long composed of printable, 7-bit ASCII characters excluding double quotes. If the string contains spaces, use double quotes to delimit the start and end of the string.
Platforms
7705 SAR Gen 2
community
Syntax
community comm-id
no community [comm-id]
Context
[Tree] (config>router>static-route-entry>black-hole community)
[Tree] (config>router>static-route-entry>indirect community)
[Tree] (config>router>static-route-entry>next-hop community)
Full Context
configure router static-route-entry black-hole community
configure router static-route-entry indirect community
configure router static-route-entry next-hop community
Description
This command associates one BGP community (standard, extended or large) with a next-hop of the static route. This community can be matched in route policies and automatically added to BGP routes that are created from the static route.
Any community specified in one of these contexts is overridden by any communities specified at the prefix level of the static route entry.
The no form of this command removes the association.
Default
no community
Parameters
- comm-id
-
Specifies a BGP community value, up to 72 characters.
Platforms
7705 SAR Gen 2
community
Syntax
community comm-id [comm-id]
no community [comm-id [comm-id]]
Context
[Tree] (config>router>static-route-entry community)
Full Context
configure router static-route-entry community
Description
This command associates a list of up to 12 BGP communities (any mix of standard, extended, and large communities) with the static route. These communities can be matched in route policies and are automatically added to BGP routes that are created from the static route.
The communities specified at this level of the static route causes communities configured under the next-hop, black-hole and indirect contexts of the static route to be ignored.
The no form of this command removes the association.
Default
no community
Parameters
- comm-id
-
Specifies a BGP community value, up to 72 characters.
Platforms
7705 SAR Gen 2
community
Syntax
community community-string [hash | hash2 | custom] access-permissions [version SNMP-version] [src-access-list list-name]
no community community-string [hash | hash2 | custom]
Context
[Tree] (config>system>security>snmp community)
Full Context
configure system security snmp community
Description
This command creates SNMP community strings for SNMPv1 and SNMPv2c access. This command is used in combination with the predefined access groups and views. To create custom access groups and views and associate them with SNMPv1 or SNMPv2c access use the usm-community command.
When configured, community implies a security model for SNMPv1 and SNMPv2c only.
For SNMPv3 security, the access group command must be configured.
The no form of the command removes the specified community string.
Parameters
- community-string
-
Configures the SNMPv1 and/or SNMPv2c community string.
- hash
-
Specifies the key is entered in an encrypted form. If the hash or hash2 parameter is not used, the key is assumed to be in an unencrypted, cleartext form. For security, all keys are stored in encrypted form in the configuration file with the hash or hash2 parameter specified.
- hash2
-
Specifies the key is entered in a more complex encrypted form that involves more variables than the key value alone, meaning that the hash2 encrypted variable cannot be copied and pasted. If the hash or hash2 parameter is not used, the key is assumed to be in an unencrypted, cleartext form. For security, all keys are stored in encrypted form in the configuration file with the hash or hash2 parameter specified.
- custom
-
Specifies the custom encryption to management interface.
- access-permissions
-
Configures the access permissions for objects in the MIB.
r — Grants only read access to objects in the MIB, except security objects, using the internal "snmp-ro" access group and the "no-security" snmp view.
rw — Grants read and write access to all objects in the MIB, using the internal "snmp-rw" access group and the "no-security" snmp view.
rwa — Grants read and write access to all objects in the MIB, including security, using the internal snmp-rwa access group and the iso snmp view.
mgmt — Assigns a unique SNMP community string for SNMP access via the management router instance. This community uses the internal snmp-mgmt access group and the mgmt snmp view.
vpls-mgmt — Assigns a unique SNMP community string for SNMP access via the vpls-management router instance. This community uses the internal snmp-vpls-mgmt access group and mgmt-view snmp view.
- version {v1 | v2c | both}
-
Configures the scope of the community string to be for SNMPv1, SNMPv2c, or both SNMPv1 and SNMPv2c access.
- list-name
-
Configures the community to reference a specific src-access-list, which will be used to validate the source IP address of all received SNMP requests that use this community. Multiple community, usm-community, or VPRN SNMP community instances can reference the same src-access-list.
Platforms
7705 SAR Gen 2
community
Syntax
[no] community name
Context
[Tree] (config>router>policy-options community)
Full Context
configure router policy-options community
Description
This command creates a route policy community list or expression to use in route policy entries. A community list is an unordered set of community values (members). In general a route matches a community list if it has any of the member values. A community expression is a set of community values that are arranged in a logical expression using operators such as AND, OR, and NOT. A route matches a community expression if it satisfies the logic of the expression.
For additional information, see the expression and members commands in the config> router>policy-options>community context.
The no form of this command deletes the community list or the provided community ID.
Default
no community
Parameters
- name
-
Specifies the community list name. Allowed values are any string up to 64 characters, composed of printable, 7-bit ASCII characters. If the string contains special characters (for example, #, $, spaces), the entire string must be enclosed within double quotes.
Platforms
7705 SAR Gen 2
community
Syntax
community add name [name]
community remove name [name]
community replace name [name]
no community
Context
[Tree] (config>router>policy-options>policy-statement>default-action community)
[Tree] (config>router>policy-options>policy-statement>entry>action community)
Full Context
configure router policy-options policy-statement default-action community
configure router policy-options policy-statement entry action community
Description
This command adds or removes a BGP community list to or from routes matching the route policy statement entry.
If no community list is specified, the community path attribute is not changed.
The community list changes the community path attribute according to the add and remove keywords.
The no form of this command disables the action to edit the community path attribute for the route policy entry.
Default
no community
Parameters
- name
-
Specifies up to 28 names.
- add
-
The specified community list is added to any existing list of communities.
- remove
-
The specified community list is removed from the existing list of communities.
- replace
-
The specified community list replaces any existing community attribute. name — The community list name. Allowed values are any string up to 64 characters, composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. Policy parameters must be enclosed by at-signs (@) and may be midstring; for example, "@variable@," "start@variable@end"," @variable@end", or "start@variable@".
Platforms
7705 SAR Gen 2
community
Syntax
community comm-name
community expression expression
no community
Context
[Tree] (config>router>policy-options>policy-statement>entry>from community)
Full Context
configure router policy-options policy-statement entry from community
Description
This command configures a community list as a match criterion for the route policy entry.
If no community list is specified, any community is considered a match.
The no form of this command removes the community list match criterion.
Default
no community
Parameters
- comm-name
-
Specifies the community list name. Allowed values are any string up to 32 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.
- expression
-
Specifies that the parameters are applied to routes matching the entry.
Platforms
7705 SAR Gen 2
community-count
community-count
Syntax
community-count count [equal | or-higher | or-lower] [standard | extended | large]
no community-count
Context
[Tree] (config>router>policy-options>policy-statement>entry>from community-count)
Full Context
configure router policy-options policy-statement entry from community-count
Description
This command matches BGP routes based on community length (that is, the number of community members in the COMMUNITY, EXTENDED_COMMUNITY, or LARGE_COMMUNITY the attributes).
If no comparison qualifiers are present (equal, or-higher, or-lower), then equal is the implied default.
Without the optional standard, extended, or large keyword, the community length applies to the total number of communities, of all types. If some keywords are present, then only the types specified are counted against the limit.
A non-BGP route does not match a policy entry if it contains the community-count command.
Default
no community-count
Parameters
- count
-
Specifies the number of community members.
- equal
-
Specifies that matched routes should have the same number of AS path elements as the value specified.
- or-higher
-
Specifies that matched routes should have the same or a greater number of community members as the value specified.
- or-lower
-
Specifies that matched routes should have the same or a lower number of community members as the value specified.
- standard
-
Specifies that only communities in the COMMUNITY attribute should be counted.
- extended
-
Specifies that only communities in the EXTENDED_COMMUNITY attribute should be counted.
- large
-
Specifies that only communities in the LARGE_COMMUNITY attribute should be counted.
Platforms
7705 SAR Gen 2
compare
compare
Syntax
compare source1 to source2
Context
[Tree] (admin compare)
Full Context
admin compare
Description
This command displays the differences between rollback checkpoints and the active operational configuration, with source1 as the base/first file to which source2 is compared.
A compare operation does not check authorization of each line of output. Permission to execute the compare operation from the admin branch of CLI (authorization for the admin rollback compare or admin compare command itself) should only be given to users who are allowed to view the entire configuration, similar to permissions for admin display-config.
Default
The defaults for source1 and source2 are context aware and differ based on the branch in which the command is executed. In general, the default for source1 matches the context from which the command is issued.
-
In the admin node: No defaults. source1 and source2 must be specified.
-
In the admin>rollback node:
source1 default = active-cfg, source2 default = latest-rb
compare: equivalent to "compare active-cfg to latest-rb”
compare to source2: equivalent to "compare active-cfg to source2”
-
In a config>xx node:
compare to source2: equivalent to "compare active-cfg to source2”
Parameters
- source1, source2
-
Specifies comparison information.
Platforms
7705 SAR Gen 2
compare
Syntax
compare [to checkpoint2]
compare checkpoint1 to checkpoint2
Context
[Tree] (admin>rollback compare)
Full Context
admin rollback compare
Description
This command can be used in any branch under configure, but not with configure itself. The command syntax, parameter names, and default values are context aware and will differ based on the branch in which the command is executed.
This command displays the differences between rollback checkpoints and the active operational configuration, with checkpoint1 as the base/first file to which checkpoint2 is compared. This command displays the comparison for the configuration context where it is entered and all branches below that context level.
A compare operation does not check authorization of each line of output. Permission to execute the compare operation from the admin branch of CLI (authorization for the admin rollback compare or admin compare command itself) should only be given to users who are allowed to view the entire configuration, similar to permissions for admin display-config.
Default
The defaults for checkpoint1 and checkpoint2 are context-aware and differ based on the branch in which the command is executed. In general, the default for checkpoint1 matches the context from which the command is issued.
-
In the admin node: No defaults. checkpoint1 and checkpoint2 must be specified.
-
In the admin>rollback node:
checkpoint1 default = active-cfg, checkpoint2 default = latest-rb
compare: equivalent to "compare active-cfg to latest-rb”
compare to checkpoint2: equivalent to "compare active-cfg to checkpoint2”
-
In a config>xx node:
compare to checkpoint2: equivalent to "compare active-cfg to checkpoint2”
Parameters
- checkpoint1, checkpoint2
-
Specifies comparison information.
Platforms
7705 SAR Gen 2
compare-chain-include
compare-chain-include
Syntax
compare-chain-include ca-profile-name
no compare-chain-include
Context
[Tree] (config>ipsec>cert-profile>entry compare-chain-include)
Full Context
configure ipsec cert-profile entry compare-chain-include
Description
This command configures the Certificate Authority (CA) profile that needs to be included in the compare-chain for the entry. This configuration is required in instances where there are multiple overlapping compare-chains, for example, the configured root CA is cross-signed by another CA.
Default
no compare-chain-include
Parameters
- ca-profile-name
-
Specifies the name of the CA profile.
Platforms
7705 SAR Gen 2
compare-origin-validation-state
compare-origin-validation-state
Syntax
[no] compare-origin-validation-state
Context
[Tree] (config>service>vprn>bgp>best-path-selection compare-origin-validation-state)
Full Context
configure service vprn bgp best-path-selection compare-origin-validation-state
Description
This command enables the comparison of origin validation states during the BGP decision process. When this command is configured, a new step is inserted in the BGP decision process after the removal of invalid routes and before the comparison of Local Preference. This step compares the origin validation state so a BGP route with a "Valid” state is preferred over a BGP route with a "Not-Found” state. A BGP route with a "Not-Found” state is preferred over a BGP route with an "Invalid” state assuming that these routes are considered "usable”.
This comparison only applies to BGP routes learned from VPRN BGP peers. It does not apply to any comparison involving BGP-VPN routes that have been imported into the VPRN.
The no form of this command causes the new step to be skipped during the BGP decision process.
Default
no compare-origin-validation-state
Platforms
7705 SAR Gen 2
compare-origin-validation-state
Syntax
[no] compare-origin-validation-state
Context
[Tree] (config>router>bgp>best-path-selection compare-origin-validation-state)
Full Context
configure router bgp best-path-selection compare-origin-validation-state
Description
When this command is configured, a new step is inserted in the BGP decision process after removal of invalid routes and before the comparison of Local Preference. The new step compares the RPKI origin validation state so that a BGP route with a 'Valid’ state is preferred over a BGP route with a 'Not-Found’ state, and a BGP route with a 'Not-Found’ state is preferred over a BGP route with an 'Invalid’ state assuming that these routes are considered 'usable’.
The new step is skipped when no compare-origin-validation-state is configured.
Default
no compare-origin-validation-state
Platforms
7705 SAR Gen 2
compatibility
compatibility
Syntax
compatibility mode
Context
[Tree] (config>port>dwdm>coherent compatibility)
Full Context
configure port dwdm coherent compatibility
Description
This command configures the optical mode and rate of operation.
Parameters
- mode
-
Specifies the optical mode.
Platforms
7705 SAR Gen 2
compatible-rfc1583
compatible-rfc1583
Syntax
[no] compatible-rfc1583
Context
[Tree] (config>service>vprn>ospf compatible-rfc1583)
Full Context
configure service vprn ospf compatible-rfc1583
Description
This command enables OSPF summary and external route calculations in compliance with RFC 1583 and earlier RFCs.
RFC 1583 and earlier RFCs use a different method to calculate summary and external route costs. To avoid routing loops, all routers in an OSPF domain should perform the same calculation method.
Although it would be favorable to require all routers to run a more current compliance level, this command allows the router to use obsolete methods of calculation.
This command is not supported in OSPF3.
The no form of this command enables the post-RFC 1583 method of summary and external route calculation.
Default
compatible-rfc1583 — RFC 1583 compliance is enabled.
Platforms
7705 SAR Gen 2
compatible-rfc1583
Syntax
[no] compatible-rfc1583
Context
[Tree] (config>router>ospf compatible-rfc1583)
Full Context
configure router ospf compatible-rfc1583
Description
This command enables OSPF summary and external route calculations in compliance with RFC 1583 and earlier RFCs.
RFC 1583 and earlier RFCs use a different method to calculate summary and external route costs. To avoid routing loops, all routers in an OSPF domain should perform the same calculation method.
Although it would be favorable to require all routers to run a more current compliance level, this command allows the router to use obsolete methods of calculation.
The no form of this command enables the post-RFC 1583 method of summary and external route calculation.
Default
compatible-rfc1583
Platforms
7705 SAR Gen 2
complexity-rules
complexity-rules
Syntax
complexity-rules
Context
[Tree] (config>system>security>password complexity-rules)
Full Context
configure system security password complexity-rules
Description
This command defines a list of rules for configurable password options.
This command applies to local users.
Platforms
7705 SAR Gen 2
conditional-expression
conditional-expression
Syntax
conditional-expression
Context
[Tree] (config>router>policy-options>policy-statement>entry conditional-expression)
Full Context
configure router policy-options policy-statement entry conditional-expression
Description
This command creates the context to configure a route existence expression.
Platforms
7705 SAR Gen 2
confederation
confederation
Syntax
confederation confed-as-num [members as-number [as-number]]
no confederation confed-as-num members as-number [as-number]
no confederation
Context
[Tree] (config>service>vprn confederation)
Full Context
configure service vprn confederation
Description
This command configures the VPRN BGP instance to participate in a BGP confederation. BGP confederations can be used to reduce the number of IBGP sessions required within an AS.
When a VPRN BGP instance is part of a confederation, it can form confederation-EBGP sessions with CE router peers in a different sub-autonomous systems of the same confederation as well as regular EBGP sessions with CE router peers outside the confederation. A VPRN BGP instance that is part of a confederation cannot import or export its routes to the base router instance (as VPN-IP routes).
The no form of this command deletes the specified member AS from the confederation. When members are not specified in the no statement, the entire list is removed and confederations is disabled. When the last member of the list is removed, confederations is disabled.
Default
no confederation
Parameters
- confed-as-num
-
The confederation AS number defined as a decimal value.
- members as-number
-
The AS number(s) that are members of the confederation, each expressed as a decimal integer. Configure up to 15 members per confed-as-num.
Platforms
7705 SAR Gen 2
confederation
Syntax
confederation confed-as-num [members as-number [as-number]]
no confederation confed-as-num members as-number [as-number]
no confederation
Context
[Tree] (config>router confederation)
Full Context
configure router confederation
Description
This command creates confederation autonomous systems within an AS.
This technique is used to reduce the number of IBGP sessions required within an AS. Route reflection is another technique that is commonly deployed to reduce the number of IBGP sessions.
The no form of this command deletes the specified member AS from the confederation.
When no members are specified in the no statement, the entire list is removed and confederation is disabled.
When the last member of the list is removed, confederation is disabled.
Default
no confederation - no confederations are defined.
Parameters
- confed-as-num
-
Specifies the confederation AS number expressed as a decimal integer.
- as-number
-
Specifies the AS number of members that are part of the confederation, expressed as a decimal integer. Up to 15 members per confed-as-num can be configured.
Platforms
7705 SAR Gen 2
config-backup
config-backup
Syntax
config-backup count
no config-backup
Context
[Tree] (config>system config-backup)
Full Context
configure system config-backup
Description
This command configures the maximum number of backup versions maintained for configuration files and BOF.
For example, assume the config-backup count is set to 5 and the configuration file is called xyz.cfg. When the configuration is saved, the file xyz.cfg is saved with a 1 extension. Each configuration save increments the numeric extension until the maximum count is reached.
xyz.cfg xyz.cfg.1 xyz.cfg.2 xyz.cfg.3 xyz.cfg.4 xyz.cfg.5
Each classic CLI persistent index file is updated at the same time as the associated configuration file. When the index file is updated, then the save is performed to xyz.cfg and the index file is created as xyz.ndx. Synchronization between the active and standby CPM is performed for all configurations and their associated persistent index files.
The no form of the command returns the configuration to the default value.
Default
config-backup 50
Parameters
- count
-
Specifies the maximum number of backup revisions.
Platforms
7705 SAR Gen 2
configuration-mode
configuration-mode
Syntax
configuration-mode {classic | mixed | model-driven}
Context
[Tree] (config>system>management-interface configuration-mode)
Full Context
configure system management-interface configuration-mode
Description
This command controls which management interfaces are used for editing and changing the configuration of the router.
Any management interface can be used in any configuration mode (to gather state information or perform operations, for example), but only specific management interfaces (CLI, NETCONF, and so on) are allowed to edit the configuration of the router in different modes. For example, only classic CLI and SNMP can be used to edit the configuration when in classic mode.
Default
configuration-mode model-driven
Parameters
- classic
-
Enables editing of router configuration via classic CLI and SNMP management interfaces, but not using model-driven interfaces.
- model-driven
-
Enables editing of router configuration via model-driven management interfaces (NETCONF with 'Nokia' YANG models, MD-CLI or gRPC), but not using classic interfaces.
- mixed
-
Enables editing of router configuration using a mix of classic CLI and/or model-driven management interfaces (with some restrictions and limitations).
Platforms
7705 SAR Gen 2
configure
configure
Syntax
configure
Context
[Tree] (configure)
Full Context
configure
Description
Commands in this context edit the system configuration.
Platforms
7705 SAR Gen 2
confirm
confirm
Syntax
confirm
Context
[Tree] (candidate confirm)
Full Context
candidate confirm
Description
This command is used to stop an automatic reversion to the previous configuration after the candidate commit confirmed command was used. If the confirm command is not executed before the commit confirmed timeout period expires then the previous commit changes will be undone and the previous candidate configuration will be available for editing and a subsequent commit.
During the countdown the contents of the candidate will remain visible (candidate view) and changes to the candidate are blocked until the timeout is completed or the candidate confirm command is executed. Executing the confirm command clears the contents of the candidate and allows editing of the candidate.
Platforms
7705 SAR Gen 2
confirm
Syntax
[no] confirm
Context
[Tree] (config>system>management-interface>cli>md-cli>environment>commit-options confirm)
Full Context
configure system management-interface cli md-cli environment commit-options confirm
Description
This command configures the requirement for a confirmed commit when committing configuration.
The no form of this command does not require a confirmed commit when committing configuration
Default
no confirm
Platforms
7705 SAR Gen 2
connect-retry
connect-retry
Syntax
connect-retry seconds
no connect-retry
Context
[Tree] (config>service>vprn>bgp>group connect-retry)
[Tree] (config>service>vprn>bgp>group>neighbor connect-retry)
[Tree] (config>service>vprn>bgp connect-retry)
Full Context
configure service vprn bgp group connect-retry
configure service vprn bgp group neighbor connect-retry
configure service vprn bgp connect-retry
Description
This command configures the BGP connect retry timer value in seconds.
When this timer expires, BGP tries to reconnect to the configured peer. This configuration parameter can be set at three levels: global level (applies to all peers), peer-group level (applies to all peers in group) or neighbor level (only applies to specified peer). The most specific value is used.
The no form of this command used at the global level reverts to the default value.
The no form of this command used at the group level reverts to the value defined at the global level.
The no form of this command used at the neighbor level reverts to the value defined at the group level.
Default
120 seconds
Parameters
- seconds
-
Specifies the BGP connect retry timer value in seconds, expressed as a decimal integer.
Platforms
7705 SAR Gen 2
connect-retry
Syntax
connect-retry seconds
no connect-retry
Context
[Tree] (config>router>origin-validation>rpki-session connect-retry)
Full Context
configure router origin-validation rpki-session connect-retry
Description
This command configures the time in seconds to wait between one TCP connection attempt that fails and the next attempt. The default (with no connect-retry) is 120 seconds.
Default
no connect-retry
Parameters
- seconds
-
Specifies time in seconds.
Platforms
7705 SAR Gen 2
connect-retry
Syntax
connect-retry seconds
no connect-retry
Context
[Tree] (config>router>bgp>group>neighbor connect-retry)
[Tree] (config>router>bgp connect-retry)
[Tree] (config>router>bgp>group connect-retry)
Full Context
configure router bgp group neighbor connect-retry
configure router bgp connect-retry
configure router bgp group connect-retry
Description
This command configures the BGP connect retry timer value in seconds.
When this timer expires, BGP tries to reconnect to the configured peer. This configuration parameter can be set at three levels: global level (applies to all peers), peer-group level (applies to all peers in group) or neighbor level (only applies to specified peer). The most specific value is used.
The no form of this command used at the global level reverts to the default value.
The no form of this command used at the group level reverts to the value defined at the global level.
The no form of this command used at the neighbor level reverts to the value defined at the group level.
Default
connect-retry 120
Parameters
- seconds
-
The BGP Connect Retry timer value in seconds expressed as a decimal integer.
Platforms
7705 SAR Gen 2
connection
connection
Syntax
[no] connection ip-address
Context
[Tree] (debug>router>pcep>pcc connection)
Full Context
debug router pcep pcc connection
Description
This command debugs PCC connection events.
The no form of this command disables debugging.
Parameters
- ip-address
-
Specifies the IP address.
Platforms
7705 SAR Gen 2
connection-profile-vlan
connection-profile-vlan
Syntax
connection-profile-vlan conn-prof-id [create]
no connection-profile-vlan conn-prof-id
Context
[Tree] (config connection-profile-vlan)
Full Context
configure connection-profile-vlan
Description
Commands in this context configure the VLAN ranges that will be associated with a service SAP.
Each connection-profile-vlan must be explicitly configured.
Parameters
- conn-prof-id
-
Specifies the connection-profile identifier. This value will be configured in the service along with the SAP when the user associates a VLAN bundle to a single SAP. For example, a SAP defined in a dot1q port 1/1/1 that matches all the VLANs defined in the connection-profile-vlan 1 will be created as 'sap 1/1/1:cp-1 create'.
Platforms
7705 SAR Gen 2
connection-timeout
connection-timeout
Syntax
connection-timeout seconds
no connection-timeout
Context
[Tree] (config>system>management-interface>remote-management connection-timeout)
Full Context
configure system management-interface remote-management connection-timeout
Description
This command configures the amount of time that all remote managers cannot be reached before they are considered to be down.
If this command is also configured for a specific manager in the config>system> management-interface>remote-management>manager context, that configuration takes precedence.
The no form of this command reverts to the default.
Default
connection-timeout 60
Parameters
- seconds
-
Specifies the connection timeout in seconds.
Platforms
7705 SAR Gen 2
connection-timeout
Syntax
connection-timeout seconds
no connection-timeout
Context
[Tree] (config>system>management-interface>remote-management>manager connection-timeout)
Full Context
configure system management-interface remote-management manager connection-timeout
Description
This command configures the amount of time that this remote manager cannot be reached before it is considered to be down.
This command takes precedence over the same command configured in the global context (config>system>management-interface>remote-management).
The no form of this command reverts to the default.
Default
connection-timeout 60
Parameters
- seconds
-
Specifies the connection timeout in seconds.
Platforms
7705 SAR Gen 2
connectivity-association
connectivity-association
Syntax
connectivity-association ca-name [create]
no connectivity-association ca-name
Context
[Tree] (config>macsec connectivity-association)
Full Context
configure macsec connectivity-association
Description
This command configures a connectivity association. MACsec connectivity associations are applied to a port dot1x configuration to enable MACsec on that port.
The no form of this command removes the connectivity association.
Parameters
- ca-name
-
The name of the connectivity association, a string up to 32 characters long.
- create
-
Mandatory while creating an entry.
Platforms
7705 SAR Gen 2
connectivity-verify
connectivity-verify
Syntax
connectivity-verify
Context
[Tree] (config>redundancy>mc>peer>mcr>l3ring>node connectivity-verify)
Full Context
configure redundancy multi-chassis peer mc-ring l3-ring ring-node connectivity-verify
Description
Commands in this context configure a node connectivity check.
Platforms
7705 SAR Gen 2
connector
connector
Syntax
connector
Context
[Tree] (config>port connector)
Full Context
configure port connector
Description
Commands in this context configure connector parameters.
Platforms
7705 SAR Gen 2
consider-system-ip-in-gep
consider-system-ip-in-gep
Syntax
[no] consider-system-ip-in-gep
Context
[Tree] (config>router>ldp consider-system-ip-in-gep)
Full Context
configure router ldp consider-system-ip-in-gep
Description
When this command is enabled, the system interprets the presence or absence of the system IP and its associated action in the applied Global Export Policies in the same way as for other interfaces' IP addresses. In that case:
-
if the system IP is not present, its FEC will not be exported or it will be withdrawn if it has been exported
-
if the system IP is present with "accept", its FEC will be exported
-
if the system IP is present with "deny", its FEC will not be exported or it will be withdrawn if it had been exported
Enabling or disabling this command leads to the applied Global Export Policies being reevaluated.
The no form of this command causes the system to not interpret the presence or absence of the system IP in applied Global Export Policies, and the FEC for the system IP is exported (default behavior).
Default
no consider-system-ip-in-gep
Platforms
7705 SAR Gen 2
console
console
Syntax
console
Context
[Tree] (config>system>management-interface>cli>md-cli>environment console)
Full Context
configure system management-interface cli md-cli environment console
Description
Commands in this context configure console parameters.
Platforms
7705 SAR Gen 2
console
Syntax
console
Context
[Tree] (config>system>security>user-template console)
[Tree] (config>system>security>user console)
Full Context
configure system security user-template console
configure system security user console
Description
This command creates the context to configure user profile membership for the console (either Telnet or CPM serial port user).
Platforms
7705 SAR Gen 2
console-speed
console-speed
Syntax
console-speed baud-rate
no console-speed
Context
[Tree] (bof console-speed)
Full Context
bof console-speed
Description
This command configures the console port baud rate.
When this command is issued while editing the BOF file used for the most recent boot, both the BOF file and the active configuration are changed immediately.
The no form of this command reverts to the default value.
Default
console-speed 115200
Parameters
- baud-rate
-
Specifies the console port baud rate, expressed as a decimal integer.
Platforms
7705 SAR Gen 2
contact
contact
Syntax
contact contact-information
no contact contact-information
Context
[Tree] (config>service>cust contact)
Full Context
configure service customer contact
Description
This command configures contact information for a customer.
Include any customer-related contact information such as a technician’s name or account contract name.
The no form of this command removes the contact information from the customer ID.
Default
no contact
Parameters
- contact-information
-
Specifies customer contact information entered as an ASCII character string up to 80 characters in length. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. Any printable, seven bit ASCII characters may be used within the string.
Platforms
7705 SAR Gen 2
contact
Syntax
contact contact-name
no contact
Context
[Tree] (config>system contact)
Full Context
configure system contact
Description
This command creates a text string that identifies the contact name for the device.
Only one contact can be configured, if multiple contacts are configured the last one entered will overwrite the previous entry.
The no form of the command reverts to default.
Default
no contact
Parameters
- contact-name
-
Specifies the contact name character string. The string can be up to 80 characters long. Any printable, seven-bit ASCII characters can be used within the string. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.
Platforms
7705 SAR Gen 2
context
context
Syntax
[no] context
Context
[Tree] (config>system>management-interface>cli>md-cli>environment>prompt context)
Full Context
configure system management-interface cli md-cli environment prompt context
Description
This command displays the current command context in the prompt.
The no form of this command suppresses the current command context in the prompt.
Default
context
Platforms
7705 SAR Gen 2
continuous
continuous
Syntax
[no] continuous
Context
[Tree] (config>saa>test continuous)
Full Context
configure saa test continuous
Description
This command specifies whether the SAA test is continuous. Once a test is configured as continuous, it cannot be started or stopped with the oam saa test-name {start | stop} command.
This option is not applicable to all SAA test types. Support is included for the following types:
-
cpe-ping
-
dns
-
eth-cfm-loopback
-
eth-cfm-two-way-delay
-
eth-cfm-two-way-slm
-
icmp-ping (not applicable to rapid type)
-
lsp-ping
-
mac-ping
-
sdp-ping
-
vccv-ping
-
vprn-ping
The no form of this command disables the continuous execution of the test.
Platforms
7705 SAR Gen 2
control-channel-status
control-channel-status
Syntax
[no] control-channel-status
Context
[Tree] (config>service>epipe>spoke-sdp control-channel-status)
[Tree] (config>service>vpls>spoke-sdp control-channel-status)
Full Context
configure service epipe spoke-sdp control-channel-status
configure service vpls spoke-sdp control-channel-status
Description
This command enables the configuration of static pseudowire status signaling on a spoke SDP for which signaling for its SDP is set to OFF.
A control-channel-status no shutdown is allowed only if all of the following are true:
-
SDP signaling is off.
-
The control-word is enabled (the control-word is disabled by default)
-
The service type is Epipe, Apipe, VPLS, Cpipe, or IES/VPRN
-
Mate SDP signaling is off (in vc-switched services)
-
The pw-path-id is configured for this spoke SDP.
The no form of this command removes control channel status signaling from a spoke SDP. It can only be removed if control channel status is shut down.
Default
no control-channel-status
Platforms
7705 SAR Gen 2
control-channel-status
Syntax
control-channel-status
Context
[Tree] (config>service>ies>if>spoke-sdp control-channel-status)
Full Context
configure service ies interface spoke-sdp control-channel-status
Description
This command enables the configuration of static pseudowire status signaling on a spoke-SDP for which signaling for its SDP is set to OFF.
A control-channel-status no shutdown is allowed only if all of the following are true:
-
SDP signaling is off.
-
The control-word is enabled (the control-word is disabled by default)
-
The service type is Epipe, Apipe, VPLS, Cpipe, or IES/VPRN
-
Mate SDP signaling is off (in vc-switched services)
-
The pw-path-id is configured for this spoke-SDP.
The no form of this command removes control channel status signaling from a spoke-SDP. It can only be removed if control channel status is shut down.
Default
no control-channel-status
Platforms
7705 SAR Gen 2
control-channel-status
Syntax
control-channel-status
Context
[Tree] (config>service>vprn>if>spoke-sdp control-channel-status)
Full Context
configure service vprn interface spoke-sdp control-channel-status
Description
This command enables the configuration of static pseudowire status signaling on a spoke SDP for which signaling for its SDP is set to OFF.
A control-channel-status no shutdown is allowed only if all of the following are true:
-
SDP signaling is off.
-
The control-word is enabled (the control-word is disabled by default)
-
The service type is Epipe, Apipe, VPLS, Cpipe, or IES/VPRN
-
Mate SDP signaling is off (in vc-switched services)
-
The pw-path-id is configured for this spoke SDP.
The no form of this command removes control channel status signaling from a spoke SDP. It can only be removed if control channel status is shut down.
Default
no control-channel-status
Platforms
7705 SAR Gen 2
control-word
control-word
Syntax
[no] control-word
Context
[Tree] (config>service>epipe>bgp-evpn>mpls control-word)
[Tree] (config>service>vpls>bgp-evpn>mpls control-word)
Full Context
configure service epipe bgp-evpn mpls control-word
configure service vpls bgp-evpn mpls control-word
Description
This command enables the transmission and reception of the control-word. As defined in RFC 7432, the use of the control-word helps avoid frame disordering.
It is enabled or disabled for all EVPN-MPLS destinations at the same time.
Default
no control-word
Platforms
7705 SAR Gen 2
control-word
Syntax
[no] control-word
Context
[Tree] (config>service>epipe>spoke-sdp control-word)
Full Context
configure service epipe spoke-sdp control-word
Description
The control word command provides the option to add a control word as part of the packet encapsulation for pseudowire types for which the control word is optional. These are Ethernet pseudowires (Epipe). ATM N:1 cell mode pseudowires (apipe vc-types atm-vcc and atm-vpc) and VT pseudowire (apipe vc-type atm-cell).
The configuration for the two directions of the pseudowire must match because the control word negotiation procedures described in Section 6.2 of RFC 4447 are not supported. The C-bit in the pseudowire FEC sent in the label mapping message is set to 1 when the control word is enabled. Otherwise, it is set to 0.
The service will only come up if the same C-bit value is signaled in both directions. If a spoke-sdp is configured to use the control word but the node receives a label mapping message with a C-bit clear, the node releases the label with the an "Illegal C-bit” status code as per Section 6.1 of RFC 4447. As soon as the user also enabled the control the remote peer, the remote peer will withdraw its original label and will send a label mapping with the C-bit set to 1 and the VLL service will be up in both nodes. The control word must be enabled to allow MPLS-TP OAM to be used on a static spoke-sdp in a Apipe, Epipe and Cpipe service.
Platforms
7705 SAR Gen 2
control-word
Syntax
[no] control-word
Context
[Tree] (config>service>vpls>spoke-sdp control-word)
Full Context
configure service vpls spoke-sdp control-word
Description
The control word command provides the option to add a control word as part of the packet encapsulation for pseudowire types for which the control word is optional. These are Ethernet pseudowires (Epipe). ATM N:1 cell mode pseudowires (apipe vc-types atm-vcc and atm-vpc) and VT pseudowire (apipe vc-type atm-cell).
The configuration for the two directions of the pseudowire must match because the control word negotiation procedures described in Section 6.2 of RFC 4447 are not supported. The C-bit in the pseudowire FEC sent in the label mapping message is set to 1 when the control word is enabled. Otherwise, it is set to 0.
The service will only come up if the same C-bit value is signaled in both directions. If a spoke-sdp is configured to use the control word but the node receives a label mapping message with a C-bit clear, the node releases the label with the an "Illegal C-bit” status code as per Section 6.1 of RFC 4447. As soon as the user also enabled the control the remote peer, the remote peer will withdraw its original label and will send a label mapping with the C-bit set to 1 and the VLL service will be up in both nodes. The control word must be enabled to allow MPLS-TP OAM to be used on a static spoke-sdp in a Apipe, Epipe and Cpipe service.
Platforms
7705 SAR Gen 2
control-word
Syntax
[no] control word
Context
[Tree] (config>service>vpls>spoke-sdp control-word)
[Tree] (config>service>vpls>mesh-sdp control-word)
Full Context
configure service vpls spoke-sdp control-word
configure service vpls mesh-sdp control-word
Description
This command enables the use of the control word on pseudowire packets in VPLS and enables the use of the control word individually on each mesh SDP or spoke-SDP. By default, the control word is disabled. When the control word is enabled, all VPLS packets, including the BPDU frames, are encapsulated with the control word when sent over the pseudowire. The T-LDP control plane behavior is the same as in the implementation of control word for VLL services. The configuration for the two directions of the Ethernet pseudowire should match. The no form of this command reverts the mesh SDP or spoke-SDP to the default behavior of not using the control word. The control word must be enabled to use MPLS-TP OAM on a static spoke-sdp terminating in a VPLS.
Default
no control word
Platforms
7705 SAR Gen 2
controlword
controlword
Syntax
[no] controlword
Context
[Tree] (config>service>pw-template controlword)
Full Context
configure service pw-template controlword
Description
This command enables the use of the control word on pseudowire packets in VPLS and VPWS and enables the use of the control word individually on each mesh-sdp or spoke-sdp. By default, the control word is disabled. When the control word is enabled, all VPLS/VPWS packets, including the BPDU frames, are encapsulated with the control word when sent over the pseudowire. The T-LDP control plane behavior is the same as in the implementation of control word for VLL services. The configuration for the two directions of the Ethernet pseudowire should match.
The no form of the command reverts the mesh SDP or spoke-sdp to the default behavior of not using the control word.
Default
no controlword
Platforms
7705 SAR Gen 2
convergence
convergence
Syntax
convergence
Context
[Tree] (config>service>vprn>bgp convergence)
Full Context
configure service vprn bgp convergence
Description
Commands in this context configure route convergence delay.
Platforms
7705 SAR Gen 2
convergence
Syntax
convergence
Context
[Tree] (config>router>bgp convergence)
Full Context
configure router bgp convergence
Description
Commands in this context configure route convergence delay.
Platforms
7705 SAR Gen 2
convert-file
convert-file
Syntax
convert-file filename to output-file-name format {secure | legacy} [force]
Context
[Tree] (admin>certificate convert-file)
Full Context
admin certificate convert-file
Description
This command converts imported certificates and keys in the cf3:/system-pki directory between secure and legacy format.
Parameters
- filename
-
Specifies an existing filename, up to 95 characters.
- output-file-name
-
Specifies the output file name, up to 95 characters. If the output filename already exists, and the force keyword is not selected, the system prompts to proceed or abort.
- format
-
Specifies the target format.
- force
-
Forces the conversion even if there is an existing file with the same output filename.
Platforms
7705 SAR Gen 2
coordinates
coordinates
Syntax
coordinates coordinates
no coordinates
Context
[Tree] (config>system coordinates)
Full Context
configure system coordinates
Description
This command creates a text string that identifies the system coordinates for the device location. For example, the command coordinates "37.390 -122.0550" is read as latitude 37.390 north and longitude 122.0550 west.
Only one set of coordinates can be configured. If multiple coordinates are configured, the last one entered overwrites the previous entry.
The no form of the command reverts to the default value.
Parameters
- coordinates
-
Specifies the coordinates describing the device location character string. The string may be up to 80 characters long. Any printable, seven-bit ASCII characters can be used within the string. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. If the coordinates are subsequently used by an algorithm that locates the exact position of this node then the string must match the requirements of the algorithm.
Platforms
7705 SAR Gen 2
copy
copy
Syntax
copy
Context
[Tree] (config>filter copy)
Full Context
configure filter copy
Description
This command copies existing filter list entries for a specific filter ID to another filter ID. The copy command is a configuration level maintenance tool used to create new filters using existing filters. It also allows bulk modifications to an existing policy with the use of the overwrite keyword. If overwrite is not specified, an error will occur if the destination policy ID exists.
Platforms
7705 SAR Gen 2
copy
Syntax
copy source-file-url dest-file-url [force] [no-redirect] [ client-tls-profile profile] [proxy proxy-url]
Context
[Tree] (file copy)
Full Context
file copy
Description
This command copies a file or all files in a directory from a source URL to a destination URL. At least one of the specified URLs should be a local URL. The optional wildcard (*) can be used to copy multiple files that share a common (partial) prefix and/or (partial) suffix.
When a file is copied to a destination with the same file name, the original file is overwritten by the new file specified in the operation. The following prompt appears if the destination file already exists:
"Overwrite destination file (y/n)?”
For example:
To copy a file named srcfile in a directory called test on cf2 in slot B to a file called destfile in a directory called production on cf1 in slot A, the syntax is:
sr1>file cf2:\ # copy cf2-B/test/srcfile cf1-A/production/destfileTo FTP a file named 121201.cfg in directory mydir stored on cf1 in slot A to a network FTP server with IP address 192.0.2.79 in a directory called backup with a destination file name of 121201.cfg, the FTP syntax is:
copy cf1-A/mydir/121201.cfg 192.0.2.79/backup/121201.cfgParameters
- source-file-url
-
Specifies the location of the source file or directory to be copied.
- dest-file-url
-
Specifies the destination of the copied file or directory.
- force
-
Specifies to force an immediate copy of the specified file(s). Executes the command without displaying a user prompt message. This command also automatically accepts HTTP redirects unless overridden by the no-redirect parameter.
- profile
-
Specifies the TLS client profile configured under config>system>security>tls>client-tls-profile to use.
- proxy-url
-
Specifies the URL of an HTTP proxy. For example, http://proxy.mydomain.com:8000. This URL must be an HTTP URL and not an HTTPS URL.
- no-redirect
-
Specifies to automatically refuse any HTTP redirects without prompting the user.
Platforms
7705 SAR Gen 2
copy
Syntax
copy [line]
Context
[Tree] (candidate copy)
Full Context
candidate copy
Description
This command copies the selected CLI node (which includes all sub-branches) into a temporary buffer that can be used for a subsequent insert. The contents of the temporary buffer are deleted when the operator exits the candidate edit mode.
Parameters
- line
-
Specifies which line to copy.
Platforms
7705 SAR Gen 2
copy
Syntax
copy {user source-user | profile source-profile} to destination [overwrite]
Context
[Tree] (config>system>security copy)
Full Context
configure system security copy
Description
This command copies a profile or user from a source profile to a destination profile.
Parameters
- source-profile
-
Specifies an existing profile to copy.
- dest-profile
-
Specifies the copied profile is copied to the destination profile.
- overwrite
-
Specifies that the destination profile configuration is overwritten with the copied source profile configuration. A profile is not overwritten if the overwrite command is not specified.
Platforms
7705 SAR Gen 2
copy-config
copy-config
Syntax
[no] copy-config
Context
[Tree] (configure>system>security>profile>netconf>base-op-authorization copy-config)
Full Context
configure system security profile netconf base-op-authorization copy-config
Description
This command enables the NETCONF <copy-config> RPC.
The no form of this command disables the RPC.
Default
no copy-config
The operation is enabled by default in the built-in system-generated administrative profile.
Platforms
7705 SAR Gen 2
copy-traffic-class-upon-decapsulation
copy-traffic-class-upon-decapsulation
Syntax
[no] copy-traffic-class-upon-decapsulation
Context
[Tree] (config>ipsec>tnl-temp copy-traffic-class-upon-decapsulation)
[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel copy-traffic-class-upon-decapsulation)
[Tree] (config>router>if>ipsec>ipsec-tunnel copy-traffic-class-upon-decapsulation)
[Tree] (config>service>vprn>if>sap>ipsec-tunnel copy-traffic-class-upon-decapsulation)
[Tree] (config>service>ies>interface>ipsec>ipsec-tunnel copy-traffic-class-upon-decapsulation)
Full Context
configure ipsec tunnel-template copy-traffic-class-upon-decapsulation
configure service vprn interface ipsec ipsec-tunnel copy-traffic-class-upon-decapsulation
configure router interface ipsec ipsec-tunnel copy-traffic-class-upon-decapsulation
configure service vprn interface sap ipsec-tunnel copy-traffic-class-upon-decapsulation
configure service ies interface ipsec ipsec-tunnel copy-traffic-class-upon-decapsulation
Description
This command copies the traffic class from the outer tunnel IP packet header to the payload IP packet header upon tunnel decapsulation (public to private direction).
The no form of this command disables the traffic copying.
Default
copy-traffic-class-upon-decapsulation
Platforms
7705 SAR Gen 2
core-connectivity
core-connectivity
Syntax
[no] core-connectivity
Context
[Tree] (debug>service>id>stp core-connectivity)
Full Context
debug service id stp core-connectivity
Description
This command enables STP debugging for core connectivity.
The no form of the command disables debugging.
Platforms
7705 SAR Gen 2
count
count
Syntax
count number
no count
Context
[Tree] (config>system>cron>sched count)
Full Context
configure system cron schedule count
Description
This command configures the total number of times a CRON "interval” schedule is run. For example, if the interval is set to 600 and the count is set to 4, the schedule runs 4 times at 600 second intervals.
Default
no count
Parameters
- number
-
Specifies the number of times the schedule is run.
Platforms
7705 SAR Gen 2
cpe-check
cpe-check
Syntax
cpe-check cpe-ip-address
no cpe-check [cpe-ip-address]
Context
[Tree] (config>service>vprn>static-route-entry>indirect cpe-check)
[Tree] (config>service>vprn>static-route-entry>next-hop cpe-check)
Full Context
configure service vprn static-route-entry indirect cpe-check
configure service vprn static-route-entry next-hop cpe-check
Description
This command enables CPE-check and specifies the IP address of the target CPE device.
This option initiates a background ICMP ping test to the configured target IP address. The IP address can either be an IPv4 address for IPv4 static routes or an IPv6 address for IPv6 static routes. The target-ip-address cannot be in the same subnet as the static route subnet itself to avoid possible circular references. This option is mutually exclusive with BFD support on a given static route.
A node that is sourcing CPE-check packets waits an additional full interval before taking action, which gives the CPE time to respond. For example, with a drop-count of 3 and an interval of 1s, three CPE-check packets are sent out and the node waits for the duration of another interval before acting on the loss. Failure declaration may take extra time depending on the load, interval, and other factors. In line with multitasking, multi-priority operating principles of the node, and the relative priority of cpe-ping, the node paces these minor events.
The no form of this command disables the cpe-check option.
Default
no cpe-check
Parameters
- cpe-ip-address
-
Specifies the IP address of the CPE device.
Platforms
7705 SAR Gen 2
cpe-check
Syntax
cpe-check cpe-ip-address
no cpe-check [cpe-ip-address]
Context
[Tree] (config>router>static-route-entry>next-hop cpe-check)
[Tree] (config>router>static-route-entry>indirect cpe-check)
Full Context
configure router static-route-entry next-hop cpe-check
configure router static-route-entry indirect cpe-check
Description
This command enables CPE-check and specifies the IP address of the target CPE device.
This option initiates a background ICMP ping test to the configured target IP address. The IP address can either be an IPv4 address for IPv4 static routes or an IPv6 address for IPv6 static routes. The target-ip-address cannot be in the same subnet as the static route subnet itself to avoid possible circular references. This option is mutually exclusive with BFD support on a given static route.
A node that is sourcing CPE-check packets waits an additional full interval before taking action, which gives the CPE time to respond. For example, with a drop-count of 3 and an interval of 1s, three CPE-check packets are sent out and the node waits for the duration of another interval before acting on the loss. Failure declaration may take extra time depending on the load, interval, and other factors. In line with multitasking, multi-priority operating principles of the node, and the relative priority of cpe-ping, the node paces these minor events.
The no form of this command disables the cpe-check option.
Default
no cpe-check
Parameters
- cpe-ip-address
-
Specifies the IP address of the CPE device.
Platforms
7705 SAR Gen 2
cpr-window-size
cpr-window-size
Syntax
cpr-window-size window-size
Context
[Tree] (config>port>dwdm>coherent cpr-window-size)
Full Context
configure port dwdm coherent cpr-window-size
Description
This command configures the window size used for carrier phase recovery.
Default
32
Parameters
- window-size
-
Indicates the number of symbols used for carrier phase recovery algorithm of the receiver. When this parameter is changed, the link bounces because the receiver needs to be reconfigured.
Platforms
7705 SAR Gen 2
crc-monitor
crc-monitor
Syntax
crc-monitor
Context
[Tree] (config>port>ethernet crc-monitor)
Full Context
configure port ethernet crc-monitor
Description
This command configures Ethernet CRC Monitoring parameters.
Platforms
7705 SAR Gen 2
create
create
Syntax
[no] create
Context
[Tree] (environment create)
Full Context
environment create
Description
By default, the create command is required to create a new OS entity.
The no form of the command disables requiring the create keyword.
Default
create
Platforms
7705 SAR Gen 2
create-mpls-tunnel
create-mpls-tunnel
Syntax
[no] create-mpls-tunnel
Context
[Tree] (config>router>policy-options>policy-statement>entry>action create-mpls-tunnel)
Full Context
configure router policy-options policy-statement entry action create-mpls-tunnel
Description
This command enables the creation of an MPLS tunnel to the BGP next-hop. It is supported for the following address families:
-
vpn-ipv4
-
vpn-ipv6
-
evpn
-
label-ipv4
-
label-ipv6
-
ipv4
-
ipv6
The no form of the command disables the creation of an MPLS tunnel.
Default
no create-mpls-tunnel
Platforms
7705 SAR Gen 2
create-subscription
create-subscription
Syntax
[no] create-subscription
Context
[Tree] (configure>system>security>profile>netconf>base-op-authorization create-subscription)
Full Context
configure system security profile netconf base-op-authorization create-subscription
Description
This command enables the NETCONF <create-subscription> RPC in the default user profile.
The base-op-authorization create-subscription configuration is not pre-emptive, which means that it is checked only at the time of the initial subscription. Configuration changes to the base-op-authorization do not cancel any in-progress subscriptions and operators who successfully subscribed continue to receive messages.
The no form of this command disables the RPC.
Default
no create-subscription
The operation is enabled by default in the built-in system-generated administrative profile.
Platforms
7705 SAR Gen 2
create-udp-tunnel
create-udp-tunnel
Syntax
create-udp-tunnel
no create-udp-tunnel
Context
[Tree] (config>router>policy-options>policy-statement>entry>action create-udp-tunnel)
[Tree] (config>router>policy-options>policy-statement>default-action create-udp-tunnel)
Full Context
configure router policy-options policy-statement entry action create-udp-tunnel
configure router policy-options policy-statement default-action create-udp-tunnel
Description
This command instructs the router to create an MPLS-over-UDP tunnel upon receiving BGP routes that match the import policy.
Default
no create-udp-tunnel
Platforms
7705 SAR Gen 2
credential
credential
Syntax
credential
Context
[Tree] (config>ipsec>client-db>client credential)
Full Context
configure ipsec client-db client credential
Description
Commands in this context configure the parameters used to authenticate peers.
Platforms
7705 SAR Gen 2
credits
credits
Syntax
credits [lowercase credits] [uppercase credits] [numeric credits] [special-character credits]
no credits
Context
[Tree] (config>system>security>password>complexity-rules credits)
Full Context
configure system security password complexity-rules credits
Description
The maximum credits given for usage of the different character classes in the local passwords.
The no form of this command resets to default.
Default
no credits
Parameters
- credits
-
Specifies the number of credits that can be used for each characters class.
Platforms
7705 SAR Gen 2
crl-expiration-warning
crl-expiration-warning
Syntax
crl-expiration-warning hours [repeat repeat-hours]
no crl-expiration-warning
Context
[Tree] (config>system>security>pki crl-expiration-warning)
Full Context
configure system security pki crl-expiration-warning
Description
This command specifies when the systems issues a BeforeExp message before a CRL expires. For example, with certificate-expiration-warning 5, the system issues a BeforeExp message 5 hours before a CRL expires. An optional repeat repeat-hour parameter enables the system to repeat the BeforeExp message every hour until the CRL expires.
If the user only wants AfterExp, then certificate-expiration-warning 0 can be used to achieve this.
BeforeExp and AfterExp warnings can be cleared in following cases:
-
The CRL is reloaded by the admin certificate reload command. In this case, if the reloaded file is not expired, then AfterExp is cleared. And, if the reloaded file is outside of configured warning window, then the BeforeExp is also cleared.
-
When the ca-profile is shutdown, then BeforeExp and AfterExp of corresponding certificates are cleared.
-
When no crl-expiration-warning command is configured, then all existing BeforeExp and AfterExp are cleared.
-
Users may change the configuration of the crl-expiration-warning so that certain CRL are no longer in the warning window. BeforeExp of corresponding CRL are cleared.
-
If the system time changes so that the new time causes the CRL to no longer be in the warning window, then BeforeExp is cleared. If the new time causes an expired CRL to come non-expired, then AfterExp is cleared.
Default
no crl-expiration-warning
Parameters
- hours
-
Specifies the amount of time before a CRL expires when system issues BeforeExp
- repeat-hour
-
Specifies that the system repeats BeforeExp every repeat-hour
Platforms
7705 SAR Gen 2
crl-file
crl-file
Syntax
crl-file filename
no crl-file
Context
[Tree] (config>system>security>pki>ca-profile crl-file)
Full Context
configure system security pki ca-profile crl-file
Description
This command specifies the name of a file in cf3:\system-pki\crl as the Certification Revoke List file of the ca-profile.
Notes:
-
The system performs following checks against configured crl-file when a no shutdown command is issued:
-
A valid cert-file of the ca-profile must be already configured.
-
Configured crl-file must be a DER formatted CRLv2 file.
-
All non-optional fields defined in section 5.1 of RFC 5280 must exist and conform to the RFC 5280 defined format.
-
Check the version field to see if its value is 0x1.
-
Delta CRL Indicator must not exist (delta CRL is not supported).
-
CRL’s signature must be verified by using the cert-file of ca-profile.
If any of above checks fail, the no shutdown command fails.
-
-
Changing or removing the crl-file is only allowed when the ca-profile is in a shutdown state.
The no form of this command removes the filename from the configuration.
Parameters
- filename
-
Specifies the name of CRL file stored in cf3:\system-pki\crl.
Platforms
7705 SAR Gen 2
crl-update
crl-update
Syntax
crl-update ca ca-profile-name
Context
[Tree] (admin>certificate crl-update)
Full Context
admin certificate crl-update
Description
This command manually triggers the Certificate Revocation List file (CRL) update for the specified ca-profile.
Using this command requires shutting down the auto-crl-update.
Parameters
- ca-profile-name
-
Specifies the name of the Certificate Authority profile.
Platforms
7705 SAR Gen 2
crl-urls
crl-urls
Syntax
crl-urls
Context
[Tree] (config>system>security>pki>ca-prof>auto-crl-update crl-urls)
Full Context
configure system security pki ca-profile auto-crl-update crl-urls
Description
Commands in this context configure crl-urls parameters. The system allows up to eight URL entries to be configured and tries each URL in order and stop when a qualified CRL is successfully downloaded. A qualified CRL is a valid CRL signed by the CA and is more recent than the existing CRL.
If none of the configured URLs returns a qualified CRL, then:
-
If the schedule-type is next-update-based, system will wait for configure retry-interval before it start from beginning of the list again.
-
If the schedule-type is periodic, then system will wait till next periodic update time.
If the user wants to manually stop the download, shutting down of auto-crl-retrieval could be used to achieve this.
Platforms
7705 SAR Gen 2
cron
cron
Syntax
cron
Context
[Tree] (config>system cron)
Full Context
configure system cron
Description
This command creates the context to create scripts, script parameters and schedules which support the Service Assurance Agent (SAA) functions.
CRON features are saved to the configuration file on both primary and backup control modules. If a control module switchover occurs, CRON events are restored when the new configuration is loaded. If a control module switchover occurs during the execution of a cron script, the failover behavior will be determined by the contents of the script.
Platforms
7705 SAR Gen 2
cron
Syntax
cron
Context
[Tree] (config>system>security>cli-script>authorization cron)
Full Context
configure system security cli-script authorization cron
Description
Commands in this context configure authorization for the Cron job-scheduler.
Platforms
7705 SAR Gen 2
csnp-authentication
csnp-authentication
Syntax
[no] csnp-authentication
Context
[Tree] (config>service>vprn>isis csnp-authentication)
[Tree] (config>service>vprn>isis>level csnp-authentication)
Full Context
configure service vprn isis csnp-authentication
configure service vprn isis level csnp-authentication
Description
This command enables authentication of individual ISIS packets of complete sequence number PDUs (CSNP) type for the VPRN instance.
Platforms
7705 SAR Gen 2
csnp-authentication
Syntax
[no] csnp-authentication
Context
[Tree] (config>router>isis>level csnp-authentication)
[Tree] (config>router>isis csnp-authentication)
Full Context
configure router isis level csnp-authentication
configure router isis csnp-authentication
Description
This command enables authentication of individual IS-IS packets of complete sequence number PDUs (CSNP) type.
The no form of this command suppresses authentication of CSNP packets.
Default
csnp-authentication
Platforms
7705 SAR Gen 2
csnp-interval
csnp-interval
Syntax
csnp-interval seconds
no csnp-interval
Context
[Tree] (config>service>vprn>isis>if csnp-interval)
Full Context
configure service vprn isis interface csnp-interval
Description
This command configures the time interval, in seconds, to send complete sequence number (CSN) PDUs from the interface. IS-IS must send CSN PDUs periodically.
The no form of this command reverts to the default value.
Default
csnp-interval 10 — CSN PDUs are sent every 10 seconds for LAN interfaces.
csnp-interval 5 — CSN PDUs are sent every 5 seconds for point-to-point interfaces.
Parameters
- seconds
-
The time interval, in seconds between successive CSN PDUs sent from this interface expressed as a decimal integer.
Platforms
7705 SAR Gen 2
csnp-interval
Syntax
csnp-interval seconds
no csnp-interval
Context
[Tree] (config>router>isis>interface csnp-interval)
Full Context
configure router isis interface csnp-interval
Description
This command configures the time interval, in seconds, to send complete sequence number (CSN) PDUs from the interface. IS-IS must send CSN PDUs periodically.
The no form of this command reverts to the default value.
Default
csnp-interval 10 — CSN PDUs are sent every 10 seconds for LAN interfaces.
csnp-interval 5 — CSN PDUs are sent every 5 seconds for point-to-point interfaces.
Parameters
- seconds
-
Specifies the time interval, in seconds, between successive CSN PDUs sent from this interface expressed as a decimal integer.
Platforms
7705 SAR Gen 2
csnp-on-p2p
csnp-on-p2p
Syntax
[no] csnp-on-p2p
Context
[Tree] (config>router>isis csnp-on-p2p)
[Tree] (config>service>vprn>isis csnp-on-p2p)
Full Context
configure router isis csnp-on-p2p
configure service vprn isis csnp-on-p2p
Description
This command enables the periodic transmission of CSNP PDUs to point-to-point adjacent systems.
The no form of this command disables the periodic transmission of CSNP PDUs to point-to-point adjacent systems.
Default
csnp-on-p2p
Platforms
7705 SAR Gen 2
cspf
cspf
Syntax
[no] cspf
Context
[Tree] (debug>router>isis cspf)
Full Context
debug router isis cspf
Description
This command enables debugging for IS-IS cspf.
The no form of the command disables debugging.
Platforms
7705 SAR Gen 2
cspf
Syntax
cspf [ip-address]
no cspf
Context
[Tree] (debug>router>ospf cspf)
Full Context
debug router ospf cspf
Description
This command enables debugging for an OSPF constraint-based shortest path first (CSPF).
Parameters
- ip-address
-
Specifies the IP address for the range used for CSPF.
Platforms
7705 SAR Gen 2
cspf-on-loose-hop
cspf-on-loose-hop
Syntax
[no] cspf-on-loose-hop
Context
[Tree] (config>router>mpls cspf-on-loose-hop)
Full Context
configure router mpls cspf-on-loose-hop
Description
This command enables the option to do CSPF calculations until the next loose hop or the final destination of LSP on LSR. On receiving a PATH message on LSR and processing of all local hops in the received ERO, if the next hop is loose, then the LSR node will first do a CSPF calculation until the next loose hop. On successful completion of CSPF calculation, ERO in PATH message is modified to include newly calculated intermediate hops and propagate it forward to the next hop. This allows setting up inter-area LSPs based on ERO expansion method.
The LSP may fail to set up if this option is enabled on an LSR that is not an area border router and receives a PATH message without proper next loose hop in ERO. The 'cspf-on-loose-hop’ configuration is allowed to change dynamically and applied to new LSP setup after change.
Default
no cspf-on-loose-hop
Platforms
7705 SAR Gen 2
cspf-te
cspf-te
Syntax
cspf-te [detail]
no cspf-te
Context
[Tree] (debug>router>pcep>pcc cspf-te)
[Tree] (debug>router>pcep>pcc>conn cspf-te)
Full Context
debug router pcep pcc cspf-te
debug router pcep pcc connection cspf-te
Description
This command debugs Constrained Shortest Path First-Traffic Engineering (CSPF-TE) events.
The no form of this command disables debugging.
Parameters
- detail
-
Keyword used to specify detailed information about all events.
Platforms
7705 SAR Gen 2
cumulative-factor
cumulative-factor
Syntax
[no] cumulative-factor cumulative-factor
Context
[Tree] (config>service>vpls>mac-move>secondary-ports cumulative-factor)
[Tree] (config>service>vpls>mac-move>primary-ports cumulative-factor)
[Tree] (config>service>template>vpls-template>mac-move>secondary-ports cumulative-factor)
[Tree] (config>service>template>vpls-template>mac-move>primary-ports cumulative-factor)
Full Context
configure service vpls mac-move secondary-ports cumulative-factor
configure service vpls mac-move primary-ports cumulative-factor
configure service template vpls-template mac-move secondary-ports cumulative-factor
configure service template vpls-template mac-move primary-ports cumulative-factor
Description
This command defines a factor defining how many mac-relearn measurement periods can be used to measure mac-relearn rate. The rate must be exceeded during the defined number of consecutive periods before the corresponding port is blocked by the mac-move feature. The cumulative-factor of primary ports must be higher than cumulative-factor of secondary ports.
Default
cumulative-factor 2 — secondary ports
cumulative-factor 3 — primary ports
Parameters
- factor
-
Specifies the factor defining the number of mac-relearn measurement periods can be used to measure mac-relearn rate
Platforms
7705 SAR Gen 2
current-hop-limit
current-hop-limit
Syntax
current-hop-limit limit
no current-hop-limit
Context
[Tree] (config>service>vprn>router-advert>if current-hop-limit)
Full Context
configure service vprn router-advertisement interface current-hop-limit
Description
This command configures the hop limit to be advertised.
The no form of this command returns the command to the default setting.
Default
current-hop-limit 64
Parameters
- limit
-
Specifies the default value to be placed in the current hop limit field in router advertisement policies sent.
Platforms
7705 SAR Gen 2
current-hop-limit
Syntax
current-hop-limit number
no current-hop-limit
Context
[Tree] (config>router>router-advert>if current-hop-limit)
Full Context
configure router router-advertisement interface current-hop-limit
Description
This command configures the current-hop-limit in the router advertisement messages. It informs the nodes on the subnet about the hop-limit when originating IPv6 packets.
Default
current-hop-limit 64
Parameters
- number
-
Specifies the hop limit.
Platforms
7705 SAR Gen 2
custom-option
custom-option
Syntax
custom-option option-number address [ip-address]
custom-option option-number address ipv6-address [ipv6-address]
custom-option option-number domain [domain-string]
custom-option option-number hex hex-string
custom-option option-number string ascii-string
no custom-option option-number
Context
[Tree] (config>router>dhcp>server>pool>subnet>options custom-option)
[Tree] (config>subscr-mgmt>loc-user-db>ipoe>host>options custom-option)
[Tree] (config>service>vprn>dhcp>server>pool>options custom-option)
[Tree] (config>router>dhcp>server>pool>options custom-option)
Full Context
configure router dhcp local-dhcp-server pool subnet options custom-option
configure subscriber-mgmt local-user-db ipoe host options custom-option
configure service vprn dhcp local-dhcp-server pool options custom-option
configure router dhcp local-dhcp-server pool options custom-option
Description
This command configures specific DHCP options. The options defined here can overrule options in the local user database.
The no form of the removes the custom option parameters from the configuration.
Parameters
- option-number
-
Specifies up to four option numbers that the DHCP server uses to send the identification strings to the DHCP client.
- ip-address
-
Specifies the IP address of a host.
- ipv6-address
-
Specifies the IPv6 address of a host. Applicable to DHCP6 only.
- domain-string
-
Specifies the domain name, up to 127 characters.
- hex-string
-
Specifies the hex value of this option.
- ascii-string
-
Specifies the value of this option, up to 127 characters.
Platforms
7705 SAR Gen 2
custom-option
Syntax
custom-option option-number address [ipv6-address]
custom-option option-number domain [domain-string]
custom-option option-number hex hex-string
custom-option option-number string ascii-string
no custom-option option-number
Context
[Tree] (config>router>dhcp6>server>pool>options custom-option)
[Tree] (config>service>vprn>dhcp6>server>pool>options custom-option)
[Tree] (config>router>dhcp6>server>pool>prefix>options custom-option)
[Tree] (config>service>vprn>dhcp6>server>pool>prefix>options custom-option)
Full Context
configure router dhcp6 local-dhcp-server pool options custom-option
configure service vprn dhcp6 local-dhcp-server pool options custom-option
configure router dhcp6 local-dhcp-server pool prefix options custom-option
configure service vprn dhcp6 local-dhcp-server pool prefix options custom-option
Description
This command configures specific DHCP6 options. The options defined here can overrule options in the local user database.
The no form of the removes the custom option parameters from the configuration.
Parameters
- option-number
-
Specifies up to four option numbers that the DHCP6 server uses to send the identification strings to the DHCP6 client.
- ipv6-address
-
Specifies the IPv6 address of a host.
- domain-string
-
Specifies the domain name, up to 127 characters.
- hex-string
-
Specifies the hex value of this option.
- ascii-string
-
Specifies the value of this option, up to 127 characters.
Platforms
7705 SAR Gen 2
custom-record
custom-record
Syntax
[no] custom-record
Context
[Tree] (config>log>acct-policy custom-record)
Full Context
configure log accounting-policy custom-record
Description
Commands in this context configure the layout and setting for a custom accounting record associated with this accounting policy.
The no form of this command reverts the configured values to the defaults.
Platforms
7705 SAR Gen 2
customer
customer
Syntax
customer customer-id [create] [ name name]
no customer customer-id
Context
[Tree] (config>service customer)
Full Context
configure service customer
Description
This command creates a customer ID and customer context used to associate information with a particular customer. Services can later be associated with this customer at the service level.
Each customer-id must be unique. The create keyword must follow each new customer customer-id entry.
Enter an existing customer customer-id (without the create keyword) to edit the customer’s parameters.
An optional customer name can be specified and is tied to the customer-name in the customer context (setting either customer-name or name will cause the other to change as well).
The no form of this command removes a customer-id and all associated information. Before removing a customer-id, all references to that customer in all services must be deleted or changed to a different customer ID.
Default
customer 1 always exists on the system and cannot be deleted.
Parameters
- customer-id
-
Specifies the ID number to be associated with the customer, expressed as an integer.
- create
-
This keyword is required when first creating the configuration context. Once the context is created, it is possible to navigate into the context without the create keyword.
- name name
-
This parameter configures an optional customer name, up to 64 characters in length, which adds a name identifier to a given customer to then use that customer name in configuration references as well as display and use customer names in show commands throughout the system. This helps the service provider/administrator to identify and manage services within the SR OS platforms.
All services are required to assign a customer ID to initially create a customer. However, either the customer ID or the customer name can be used to identify and reference a given customer once it is initially created.
If a name is not specified at creation time, then SR OS assigns a string version of the customer-id as the name.
Platforms
7705 SAR Gen 2
customer-id-range
customer-id-range
Syntax
customer-id-range start customer-id end customer-id
no customer-id-range
Context
[Tree] (config>service>md-auto-id customer-id-range)
Full Context
configure service md-auto-id customer-id-range
Description
This command specifies the range of IDs used by SR OS to automatically assign an ID to customers that are created in model-driven interfaces without an ID explicitly specified by the user or client.
A customer created with an explicitly-specified ID cannot use an ID in this range. In the classic CLI and SNMP, the ID range cannot be changed while objects exist inside the previous or new range. In MD interfaces, the range can be changed, which causes any previously existing objects in the previous ID range to be deleted and re-created using a new ID in the new range.
The no form of this command removes the range values.
See the config>service md-auto-id command for further details.
Default
no customer-id-range
Parameters
- start customer-id
-
Specifies the lower value of the ID range. The value must be less than or equal to the end value.
- end customer-id
-
Specifies the upper value of the ID range. The value must be greater than or equal to the start value.
Platforms
7705 SAR Gen 2