p Commands – Part IV

prefix-attributes-tlv

Syntax

[no] prefix-attributes-tlv

Context

[Tree] (config>service>vprn>isis prefix-attributes-tlv)

Full Context

configure service vprn isis prefix-attributes-tlv

Description

This command enables IS-IS Prefix Attributes TLV support to exchange extended IPv4 and IPv6 reachability information. Extended reachability information is required for traffic engineering features using path computation element (PCE) or optimal route reflection.

The no form of this command removes the prefix-attributes-tlv configuration.

Default

no prefix-attributes-tlv

Platforms

All

prefix-attributes-tlv

Syntax

[no] prefix-attributes-tlv

Context

[Tree] (config>router>isis prefix-attributes-tlv)

Full Context

configure router isis prefix-attributes-tlv

Description

This command enables IS-IS Prefix Attributes TLV support to exchange extended IPv4 and IPv6 reachability information. Extended reachability information is required for traffic engineering features using path computation element (PCE) or optimal route reflection.

The no form of this command removes the prefix-attributes-tlv configuration.

Default

no prefix-attributes-tlv

Platforms

All

prefix-delegation

Syntax

[no] prefix-delegation

Context

[Tree] (config>service>ies>if>ipv6>dhcp6-server prefix-delegation)

Full Context

configure service ies interface ipv6 dhcp6-server prefix-delegation

Description

This command enables the prefix delegation options for delegating a long-lived prefix from a delegating router to a requesting router, where the delegating router does not require knowledge about the topology of the links in the network to which the prefixes are assigned.

The no form of this command disables prefix-delegation.

Platforms

All

prefix-exclude

Syntax

prefix-exclude policy-name [policy-name]

no prefix-exclude

Context

[Tree] (config>router>ldp>aggregate-prefix-match prefix-exclude)

Full Context

configure router ldp aggregate-prefix-match prefix-exclude

Description

This command specifies the policy name containing the prefixes to be excluded from the aggregate prefix match procedures. In this case, LDP will perform an exact match of a specific FEC element prefix as opposed to a longest match of one or more LDP FEC element prefixes, against this prefix when it receives a FEC-label binding or when a change to this prefix occurs in the routing table.

The no form of this command removes all policies from the configuration.

Default

no prefix-exclude

Parameters

policy-name

Specifies the route policy name, up to five. Allowed values are any string up to 32 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.

The specified name(s) must already be defined.

Platforms

All

prefix-exclude

Syntax

[no] prefix-excludeip-prefix/prefix-length

Context

[Tree] (config>filter>match-list>ip-pfx-list prefix-exclude)

Full Context

configure filter match-list ip-prefix-list prefix-exclude

Description

This command excludes IPv4 prefix(es) from an ip-prefix-list. The prefix-exclude command is mutually exclusive with apply-path.

The no form of this command deletes the specified excluded prefixes from the ip-prefix-list.

Parameters

ip-prefix

Specifies a valid IPv4 address prefix in dotted decimal notation.

Values: 0.0.0.0 to 255.255.255.255 (host bit must be 0)

prefix-length

Specifies the length of the entered IPv4 prefix.

Values: 0 to 32

Platforms

All

prefix-exclude

Syntax

[no] prefixipv6-prefix/prefix-length

Context

[Tree] (config>filter>match-list>ipv6-pfx-list prefix-exclude)

Full Context

configure filter match-list ipv6-prefix-list prefix-exclude

Description

This command excludes IPv6 prefix(es) from an ipv6-prefix-list.The prefix-exclude command is mutually exclusive with apply-path.

The no form of this command deletes the specified excluded prefixes from the ipv6-prefix-list.

Parameters

ipv6-prefix/prefix-length

Specifies an IPv6 address prefix written as hexadecimal numbers separated by colons with host bits set to 0. One string of zeros can be omitted, so 2001:db8::700:0:217A is equivalent to 2001:db8:0:0:0:700:0:217A.

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x: [0..FFFF]H

d: [0..255]D

prefix-length

Specifies the length of the entered IPv6 prefix.

Values: 1 to 128

Platforms

All

prefix-ipv4

Syntax

prefix-ipv4 {enable | disable}

Context

[Tree] (config>router>ldp>session-params>peer>fec-type-capability prefix-ipv4)

[Tree] (config>router>ldp>if-params>if>ipv6>fec-type-capability prefix-ipv4)

[Tree] (config>router>ldp>if-params>if>ipv4>fec-type-capability prefix-ipv4)

Full Context

configure router ldp session-parameters peer fec-type-capability prefix-ipv4

configure router ldp interface-parameters interface ipv6 fec-type-capability prefix-ipv4

configure router ldp interface-parameters interface ipv4 fec-type-capability prefix-ipv4

Description

This command enables or disables IPv4 prefix FEC capability on the session or interface.

The config>router>ldp>if-params>if>ipv6>fec-type-capability>prefix-ipv4 command is not supported on the 7450 ESS.

Platforms

All

prefix-ipv6

Syntax

prefix-ipv6 {enable | disable}

Context

[Tree] (config>router>ldp>if-params>if>ipv6>fec-type-capability prefix-ipv6)

[Tree] (config>router>ldp>if-params>if>ipv4>fec-type-capability prefix-ipv6)

[Tree] (config>router>ldp>session-params>peer>fec-type-capability prefix-ipv6)

Full Context

configure router ldp interface-parameters interface ipv6 fec-type-capability prefix-ipv6

configure router ldp interface-parameters interface ipv4 fec-type-capability prefix-ipv6

configure router ldp session-parameters peer fec-type-capability prefix-ipv6

Description

This command enables or disables IPv6 prefix FEC capability on the session or interface.

This command is not supported on the 7450 ESS.

Platforms

All

prefix-limit

Syntax

prefix-limit family limit [threshold percentage] [idle-timeout {minutes | forever} | log-only | hold-excess percentage] [post-import]

no prefix-limit family

Context

[Tree] (config>service>vprn>bgp>group prefix-limit)

[Tree] (config>service>vprn>bgp>group>neighbor prefix-limit)

Full Context

configure service vprn bgp group prefix-limit

configure service vprn bgp group neighbor prefix-limit

Description

This command configures the maximum number of BGP routes received from a peer before administrative action is taken. The administrative action can include generating a log or taking the session down. If a session is taken down, configure the idle-timeout parameter to bring it back up automatically after a specific duration. Alternatively, it can be configured to stay down indefinitely, until the user performs a reset.

No prefix limits for any address family are configured by default.

This command allows the user to apply a separate limit to each address family. A set of address family limits can be applied to one neighbor or to all neighbors in a group.

The no form of this command removes the prefix-limit.

Parameters

threshold percentage

Specifies the threshold value (as a percentage) that triggers a warning message to be sent.

Values: 1 to 100

family

Specifies the address family to which the limit applies.

Values: ipv4, label-ipv4, ipv6, mcast-ipv4, flow-ipv4, flow-ipv6, mcast-ipv6

limit

Specifies the number of routes that can be learned from a peer expressed as a decimal integer.

Values: 1 to 4294967295

idle-timeout minutes

Specifies the duration in minutes before automatically re-establishing a session.

Values: 1 to 1024

idle-timeout forever: Specifies that the session is re-established only after the clear router bgp command is executed.

log-only: Enables the warning message to be sent at the specified threshold percentage, and also when the limit is reached. However, the BGP session is not taken down.

post-import: Specifies that the limit should be applied only to the number of routes that are accepted by import policies.

hold-excess percentage: Specifies the percentage of maximum routes that are allowed to be installed in the route table. If a peer within scope of the configuration exceeds the limit, the overflow routes are held in the BGP RIB as inactive routes and are ineligible for forwarding or advertisement to other peers. If the post-import parameter is configured, only routes not rejected by import policies count toward the limit. A BGP route in the overflow state is reconsidered for activation and reinstallation when an UPDATE message is received for the route. This parameter is mutually exclusive with the idle-timeout and log-only parameters.

Platforms

All

prefix-limit

Syntax

prefix-limit limit [log-only] [threshold percent] [overload-timeout { seconds | forever}]

no prefix-limit

Context

[Tree] (config>service>vprn>isis prefix-limit)

Full Context

configure service vprn isis prefix-limit

Description

This command configures the maximum number of prefixes that IS-IS can learn, and use to protect the system from a router that has accidentally advertised a large number of prefixes. If the number of prefixes reaches the configured percentage of this limit, an SNMP trap is sent. If the limit is exceeded, IS-IS will go into overload.

The overload-timeout option controls the length of time that IS-IS is in the overload state when the prefix limit is reached. The system automatically attempts to restart IS-IS at the end of this duration. If the overload-timeout forever option is used, IS-IS is not restarted automatically and stays in overload until the condition is manually cleared by the administrator. This is also the default behavior when the overload-timeout option is not configured.

The no form of this command removes the prefix-limit.

Default

prefix-limit overload-timeout forever

Parameters

limit

Specifies the number of prefixes that can be learned, expressed as a decimal integer.

Values: 1 to 4294967296

log-only: Enables a warning message to be sent at the specified threshold percentage and also when the limit is exceeded. However, overload is not set when this parameter is configured.

percent

Specifies the threshold value (as a percentage) that triggers a warning message to be sent.

Values: 0 to 100

overload-timeout: Keyword used to control the length of time that IS-IS is in the overload state when the prefix limit is reached.

seconds

Specifies the time in minutes before IS-IS is restarted.

Values: 1 to 1800

forever: Specifies that IS-IS should be restarted only after the execution of the clear router isis overload prefix-limit command.

Platforms

All

prefix-limit

Syntax

prefix-limit family limit [threshold percentage] [idle-timeout {minutes | forever} | log-only | hold-excess percentage] [post-import]

no prefix-limit family

Context

[Tree] (config>router>bgp>group>neighbor prefix-limit)

[Tree] (config>router>bgp>group prefix-limit)

Full Context

configure router bgp group neighbor prefix-limit

configure router bgp group prefix-limit

Description

This command configures the maximum number of BGP routes received from a peer before administrative action is taken. The administrative action can include generating a log or taking the session down. If a session is taken down, configure the idle-timeout parameter to bring it back up automatically after a specific duration. Alternatively, it can be configured to stay down indefinitely, until the user performs a reset.

No prefix limits for any address family are configured by default.

This command allows the user to apply a separate limit to each address family. A set of address family limits can be applied to one neighbor or to all neighbors in a group.

The no form of this command removes the prefix-limit.

Parameters

log-only: Enables the warning message to be sent at the specified threshold percentage, and also when the limit is reached. However, the BGP session is not taken down.

threshold percentage

Specifies the threshold value (as a percentage) that triggers a warning message to be sent.

Values: 1 to 100

family

Specifies the address family to which the limit applies.

Values: ipv4, label-ipv4, vpn-ipv4, ipv6, label-ipv6, vpn-ipv6, mcast-ipv4, l2-vpn, mvpn-ipv4, mdt-safi, ms-pw, flow-ipv4, route-target, mcast-vpn-ipv4, mvpn-ipv6, flow-ipv6, evpn, mcast-ipv6, bgp-ls, sr-policy-ipv4, sr-policy-ipv6, mcast-vpn-ipv6, flow-vpn-ipv4, flow-vpn-ipv6

limit

Specifies the number of routes that can be learned from a peer expressed as a decimal integer.

Values: 1 to 4294967295

idle-timeout minutes

Specifies the duration in minutes before automatically re-establishing a session.

Values: 1 to 1024

idle-timeout forever: Specifies that the session is re-established only after the clear router bgp command is executed.

post-import: Specifies that the limit applies only to the number of routes that are accepted by import policies.

hold-excess percentage: Specifies the percentage of maximum routes that are allowed to be installed in the route table. If a peer within scope of the configuration exceeds the limit, the overflow routes are held in the BGP RIB as inactive routes and are ineligible for forwarding or advertisement to other peers. If the post-import parameter is configured, only routes not rejected by import policies count toward the limit. A BGP route in the overflow state is reconsidered for activation and reinstallation when an UPDATE message is received for the route. This parameter is mutually exclusive with the idle-timeout and log-only parameters.

Platforms

All

prefix-limit

Syntax

prefix-limit limit [log-only] [threshold percent] [overload-timeout { seconds | forever}]

no prefix-limit

Context

[Tree] (config>router>isis prefix-limit)

Full Context

configure router isis prefix-limit

Description

This command configures the maximum number of prefixes that IS-IS can learn, and use to protect the system from a router that has accidentally advertised a large number of prefixes. If the number of prefixes reaches the configured percentage of this limit, an SNMP trap is sent. If the limit is exceeded, IS-IS will go into overload.

The overload-timeout option controls the length of time that IS-IS is in the overload state when the prefix-limit is reached. The system automatically attempts to restart IS-IS at the end of this duration. If the overload-timeout forever option is used, IS-IS is not restarted automatically and stays in overload until the condition is manually cleared by the administrator. This is also the default behavior when the overload-timeout option is not configured.

The no form of this command removes the prefix-limit.

Default

no prefix-limit

Parameters

log-only: Enables a warning message to be sent at the specified threshold percentage and also when the limit is exceeded. However, overload is not set when this parameter is configured.

limit

Specifies the number of prefixes that can be learned expressed as a decimal integer.

Values: 1 to 4294967296

percent

Specifies the threshold value (as a percentage) that triggers a warning message to be sent.

Values: 0 to 100

seconds

Specifies the time in minutes before IS-IS is restarted.

Values: 1 to 1800

forever: Specifies that IS-IS should be restarted only after the execution of the clear router isis overload prefix-limit command.

Platforms

All

prefix-limits

Syntax

prefix-limits family limit [threshold percentage] [idle-timeout minutes] [log-only] [post-import]

no prefix-limits family

Context

[Tree] (config>subscr-mgmt>bgp-prng-plcy prefix-limits)

Full Context

configure subscriber-mgmt bgp-peering-policy prefix-limits

Description

This command configures the maximum number of BGP routes per address family that can be received from an ESM dynamic BGP peer before an administrative action is taken. Administrative actions include the generation of a log event and taking down the session. If a session is taken down, it can be brought back up automatically after an idle-timeout period. With no idle timeout configured, the session stays down until the user performs a reset.

The no form of this command removes the prefix limits for the specified family.

Default

prefix-limits threshold 90

Parameters

family

Specifies the IP address family for prefix limits.

Values: ipv4, ipv6

limit

Specifies the prefix limit.

Values: 1 to 4294967295

percentage

Specifies the percentage at which a warning log message is sent.

Values: 1 to 100

minutes

Specifies the time, in minutes, before a BGP peer is automatically reestablished on reaching the prefix limit.

Values: 1 to 1024

log-only: Keyword used to specify if the maximum limit is reached, only a log event is generated. This parameterdoes not disable the BGP session upon reaching the prefix limit.

post-import: Keyword used to specify that limits are only applied to the number of routes accepted by the import policy.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

prefix-list

Syntax

prefix-list prefix-list-name [{all | none | any}] [router-instance router-instance-name]

no prefix-list [prefix-list-name] [{all | none | any}] [router-instance router-instance-name]

Context

[Tree] (config>service>vprn>static-route-entry>black-hole prefix-list)

[Tree] (config>service>vprn>static-route-entry>indirect prefix-list)

[Tree] (config>service>vprn>static-route-entry>next-hop prefix-list)

Full Context

configure service vprn static-route-entry black-hole prefix-list

configure service vprn static-route-entry indirect prefix-list

configure service vprn static-route-entry next-hop prefix-list

Description

This command associates a constraint to the associated static route such that the static route is only active if any, none, or all of the routes in the prefix list are present and active in the route table.

If the conditional static route is configured in a VPRN and the router-instance-name is configured as “Base”, the activation of the static route is dependent on the existence of routes in the Base router; the prefix-list and flag are evaluated in this context.

No router instance is specified by default, and the conditional static route is dependent on the existence of routes in the same router instance as the static route itself, subject to the details of the prefix list and the flag setting.

Entries in a referenced prefix list that are not match type ‘exact’ are interpreted as though they are ‘exact’.

The no form of this command disables these constraints on the static route.

Default

no prefix-list

Parameters

prefix-list-name: Specifies the name of a currently configured prefix list.

all: Specifies that the static route condition is met if all prefixes in the prefix list are present in the active static route.

none: Specifies that the static route condition is met if none of the prefixes in the named prefix-list are present in the active static route.

any: Specifies that the static route condition is met if any prefixes in the prefix list are present in the active static route.

router-instance-name: Specifies the name of the router instance. Must be "Base".

Platforms

All

prefix-list

Syntax

prefix-list prefix-list-name [{all | none}]

no prefix-list [prefix-list-name] [{all | none}]

Context

[Tree] (config>router>static-route-entry>black-hole prefix-list)

[Tree] (config>router>static-route-entry>next-hop prefix-list)

[Tree] (config>router>static-route-entry>indirect prefix-list)

Full Context

configure router static-route-entry black-hole prefix-list

configure router static-route-entry next-hop prefix-list

configure router static-route-entry indirect prefix-list

Description

This command associates a new constraint to the associated static route such that the static route is only active if none or all of the routes in the prefix list are present and active in the route-table.

Default

no prefix-list

Parameters

prefix-list-name: Specifies the name of a currently configured prefix-list.

all: Specifies that the static route condition is met if all prefixes in the prefix-list must be present in the active route-table.

none: Specifies that the static route condition is met if none of the prefixes in the named prefix-list can be present in the active route-table.

Platforms

All

prefix-list

Syntax

[no] prefix-list name

Context

[Tree] (config>router>policy-options prefix-list)

Full Context

configure router policy-options prefix-list

Description

This command creates a context to configure a prefix list to use in route policy entries.

The no form of this command deletes the named prefix list.

Parameters

name

Specifies the prefix list name. Allowed values are any string up to 64 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. Policy parameters must be enclosed by at-signs (@) and may be midstring; for example, "@variable@," "start@variable@end"," @variable@end", or "start@variable@".

An empty prefix list can be configured for pre-provisioning. This empty prefix list will not find a match when referred to by a policy. When removing member prefixes from a prefix list, the prefix list will not be automatically removed when the last member is removed. If required, an empty prefix list must be explicitly removed using the no form of this command.

Platforms

All

prefix-list

Syntax

prefix-list name [name]

no prefix-list

Context

[Tree] (config>router>policy-options>policy-statement>entry>to prefix-list)

[Tree] (config>router>policy-options>policy-statement>entry>from prefix-list)

Full Context

configure router policy-options policy-statement entry to prefix-list

configure router policy-options policy-statement entry from prefix-list

Description

This command configures a prefix list as a match criterion for a route policy statement entry.

If no prefix list is specified, any network prefix is considered a match.

An empty prefix list will evaluate as if 'no match' was found.

The prefix lists specify the network prefix (this includes the prefix and length) a specific policy entry applies.

A maximum of 28 prefix names can be specified.

The no form of this command removes the prefix list match criterion.

Default

no prefix-list

Parameters

name: Specifies the prefix list name. Allowed values are any string up to 64 characters composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. Policy parameters must be enclosed by at-signs (@) and may be midstring; for example, "@variable@," "start@variable@end"," @variable@end", or "start@variable@".

Platforms

All

prefix-list-override

Syntax

no prefix-list-override

prefix-list-override name {exact | longer}

prefix-list-override name prefix-length-range length1-length2

prefix-list-override name through length

Context

[Tree] (config>router>policy-options>policy-statement>entry>from prefix-list-override)

Full Context

configure router policy-options policy-statement entry from prefix-list-override

Description

This command converts a prefix list to a specific match type. The routing policy uses the converted list as a match condition.

The prefix list to be converted can be specified by its name, as an expression containing the name of a global variable that holds the name of the prefix list, or as an expression containing the name of a subroutine variable that holds the name of the prefix list.

Parameters

name: Specifies the prefix list to be converted, up to 64 characters.

exact: Keyword to convert all entries in the specified prefix list to the exact match type.

longer: Keyword to convert all entries in the specified prefix list to the longer match type.

length1-length2

Specifies the start and end length of the prefix range.

Values: 0 to 128

Note: length2 (end length) must be equal to or greater than length1 (start length).

length

Specifies the through length of the prefix.

Values: 0 to 128

Note: Configure the through length of the prefix to a value higher than the prefix length configured in the configure router policy-options prefix-list prefix command.

Platforms

All

prefix-map

Syntax

prefix-map ip-prefix/length subscriber-type nat-sub-type nat-policy nat-policy-name [create]

prefix-map ip-prefix/length subscriber-type nat-sub-type

no prefix-map ip-prefix/length subscriber-type nat-sub-type

Context

[Tree] (config>router>nat>inside>deterministic prefix-map)

[Tree] (config>service>vprn>nat>inside>deterministic prefix-map)

Full Context

configure router nat inside deterministic prefix-map

configure service vprn nat inside deterministic prefix-map

Description

This command is applicable to deterministic NAT and static 1:1 NAT. It is used to configure source IP prefixes on the inside and their association with outside deterministic NAT pools via the NAT policy. Hosts within the source IP prefix are deterministically mapped to outside IP addresses and port ranges in the associated deterministic NAT pool.

Multiple source IP prefixes within an inside routing instance can be defined and they can reference different NAT policies (and therefore, outside deterministic NAT pools and routing instances). Source IP prefixes from multiple routing instances can share the same deterministic NAT pool.

With this command, multiple NAT policies based on a destination prefix or filter criteria can be used together with deterministic NAT.

Non-deterministic NAT can be used simultaneously with deterministic NAT within the same inside routing instance. However, they cannot share the same NAT pool.

Source IP prefixes can be added or removed as long as the associated deterministic NAT pool is in a no shutdown mode.

Removing a prefix or modifying the map statement under it requires that the source IP prefix be in a shutdown mode.

Parameters

ip-prefix/length

Specifies source IP prefix on the inside whose hosts is deterministically mapped to an outside IP address and port block in the corresponding deterministic NAT pool.

Values


<ip-prefix/ip-pref*>	<ipv4-prefix>/<ipv4-prefix-length>
	<ipv6-prefix>/<ipv6-prefix-length>
<ipv4-prefix>	a.b.c.d (host bits must be 0)
<ipv4-prefix-length>	0 to 32
<ipv6-prefix>	x:x:x:x:x:x:x:x (eight 16-bit pieces)
	x:x:x:x:x:x:d.d.d.d
	x - [0 to FFFF]H
	d - [0 to 255]D
<ipv6-prefix-length>	0 to 128

nat-sub-type

Specifies the subscriber type.

Values

classic-lsn-sub: LSN44 subscriber

dslit-lsn-sub: DT-lite subscriber

nat-policy-name: Specifies a NAT policy, up to 32 characters, that points to an outside pool and outside routing instance.

create: Keyword used to create the particular prefix instance.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

prefix-options

Syntax

[no] prefix-options

Context

[Tree] (config>subscr-mgmt>rtr-adv-plcy prefix-options)

[Tree] (config>service>ies>sub-if>grp-if>ipv6>rtr-adv prefix-options)

[Tree] (config>service>ies>sub-if>grp-if>ipv6 prefix-options)

[Tree] (config>service>vprn>sub-if>ipv6>rtr-adv prefix-options)

[Tree] (config>service>ies>sub-if>ipv6>rtr-adv prefix-options)

[Tree] (config>service>vprn>sub-if>grp-if>ipv6 prefix-options)

[Tree] (config>service>vprn>sub-if>grp-if>ipv6>rtr-adv prefix-options)

Full Context

configure subscriber-mgmt router-advertisement-policy prefix-options

configure service ies subscriber-interface group-interface ipv6 router-advertisements prefix-options

configure service ies subscriber-interface group-interface ipv6 prefix-options

configure service vprn subscriber-interface ipv6 router-advertisements prefix-options

configure service ies subscriber-interface ipv6 router-advertisements prefix-options

configure service vprn subscriber-interface group-interface ipv6 prefix-options

configure service vprn subscriber-interface group-interface ipv6 router-advertisements prefix-options

Description

This command configures Router Advertisement parameters for IPv6 prefixes returned via RADIUS Framed-IPv6-Prefix. All prefixes will inherit these configuration parameters.

The no form of this command unconfigures the Router Advertisement parameters for IPv6 prefixes returned via RADIUS Framed-IPv6-Prefix.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

prefix-policy

Syntax

prefix-policy prefix-policy [prefix-policy]

no prefix-policy

Context

[Tree] (config>service>vprn>isis>loopfree-alternates>exclude prefix-policy)

Full Context

configure service vprn isis loopfree-alternates exclude prefix-policy

Description

This command specifies the name of the policy for the prefixes to exclude from the LFA SPF calculation in this ISIS instance.

The no form of this command deletes the exclude prefix policy.

Default

no prefix-policy

Parameters

prefix-policy prefix-policy: Specifies the name of the prefix policy, up to 32 characters. Up to five prefix policies can be specified. The specified name must have been already defined.

Platforms

All

prefix-policy

Syntax

[no] prefix-policy prefix-policy [prefix-policy]

Context

[Tree] (config>service>vprn>ospf3>loopfree-alternates>exclude prefix-policy)

[Tree] (config>service>vprn>ospf>loopfree-alternates>exclude prefix-policy)

Full Context

configure service vprn ospf3 loopfree-alternates exclude prefix-policy

configure service vprn ospf loopfree-alternates exclude prefix-policy

Description

This command specifies the name of the policy for the prefixes to exclude from the LFA SPF calculation in this OSPF or OSPF3 instance.

The no form of this command deletes the exclude prefix policy.

Default

no prefix-policy

Parameters

prefix-policy prefix-policy: Specifies the name of the prefix policy, up to 32 characters. Up to five prefix policies can be specified. The specified name must have been already defined.

Platforms

All

prefix-policy

Syntax

prefix-policy prefix-policy [prefix-policy]

no prefix-policy

Context

[Tree] (config>router>isis>loopfree-alternates>exclude prefix-policy)

Full Context

configure router isis loopfree-alternates exclude prefix-policy

Description

This command excludes from LFA SPF calculation prefixes that match a prefix entry or a tag entry in a prefix policy.

The implementation already allows the user to exclude an interface in IS-IS or OSPF, an OSPF area, or an IS-IS level from the LFA SPF.

If a prefix is excluded from LFA, then it will not be included in LFA calculation regardless of its priority. The prefix tag will, however, be used in the main SPF.

This command specifies the name of the policy for the prefixes to exclude from the LFA SPF calculation in this IS-IS instance.

Note:

Prefix tags are defined for the IS-IS protocol but not for the OSPF protocol.

The default action, when not explicitly specified by the user in the prefix policy, is a "reject". Thus, regardless if the user did or did not explicitly add the statement "default-action reject" to the prefix policy, a prefix that did not match any entry in the policy will be accepted into LFA SPF.

The no form of this command deletes the exclude prefix policy.

Default

no prefix-policy

Parameters

prefix-policy prefix-policy: Specifies the name of the prefix policy, up to 32 characters. Up to five prefix policies can be specified. The specified name must have been already defined.

Platforms

All

prefix-policy

Syntax

prefix-policy prefix-policy [prefix-policy]

no prefix-policy

Context

[Tree] (config>router>ospf3>loopfree-alternates>exclude prefix-policy)

[Tree] (config>router>ospf>loopfree-alternates>exclude prefix-policy)

Full Context

configure router ospf3 loopfree-alternates exclude prefix-policy

configure router ospf loopfree-alternates exclude prefix-policy

Description

This command excludes from LFA SPF calculation prefixes that match a prefix entry or a tag entry in a prefix policy.

The implementation already allows the user to exclude an interface in IS-IS or OSPF, an OSPF area, or an IS-IS level from the LFA SPF.

If a prefix is excluded from LFA, then it will not be included in LFA calculation regardless of its priority. The prefix tag will, however, be used in the main SPF.

This command specifies the name of the policy for the prefixes to exclude from the LFA SPF calculation in this OSPF or OSPF3 instance.

Note:

Prefix tags are defined for the IS-IS protocol but not for the OSPF protocol.

The default action, when not explicitly specified by the user in the prefix policy, is a "reject”. Thus, regardless if the user did or did not explicitly add the statement "default-action reject” to the prefix policy, a prefix that did not match any entry in the policy will be accepted into LFA SPF.

The no form of this command deletes the exclude prefix policy.

Default

no prefix-policy

Parameters

prefix-policy: Specifies the name of the prefix policy, up to 32 characters. Up to five prefix policies can be specified. The specified name must have been already defined.

Platforms

All

prefix-sid-range

Syntax

prefix-sid-range global

prefix-sid-range start-label start-label max-index max-index

no prefix-sid-range

Context

[Tree] (config>router>bgp>segment-routing prefix-sid-range)

Full Context

configure router bgp segment-routing prefix-sid-range

Description

This command configures the label block that BGP segment routing is allowed to use.

The start-label and max-index parameters specify that BGP should be restricted to a subrange of the SRGB, with the subrange starting at start-label and ending at max-index.

It is not possible to enable segment routing (perform a no shutdown) unless the prefix-sid-range is configured using the global keyword or using the start-label and max-index parameters.

The no form of the command allocates no labels for BGP segment-routing.

Default

no prefix-sid-range

Parameters

global: Specifies that BGP is allowed to allocate labels from the entire space of the SRGB, as defined under config>router>mpls-labels>sr-labels.

start-label

Specifies the first label value that is available to BGP in a contiguous range of labels.

Values: 0 to 524287

max-index

Specifies the last label value that is available to BGP in a contiguous range of labels.

Values: 1 to 524287

Platforms

All

prefix-sid-range

Syntax

prefix-sid-range {global | start-label label-value max-index index-value}

no prefix-sid-range

Context

[Tree] (config>router>isis>segment-routing prefix-sid-range)

Full Context

configure router isis segment-routing prefix-sid-range

Description

This command configures the prefix SID index range and offset label value for a given IGP instance.

The key parameter is the configuration of the prefix SID index range and the offset label value which this IGP instance will use. Since each prefix SID represents a network global IP address, the SID index for a prefix must be network-wide unique. Thus, all routers in the network are expected to configure and advertise the same prefix SID index range for a given IGP instance. However, the label value used by each router to represent this prefix; that is, the label programmed in the ILM can be local to that router by the use of an offset label, referred to as a start label:

Local Label (Prefix SID) = start-label + {SID index}

The label operation in the network becomes thus very similar to LDP when operating in the independent label distribution mode (RFC 5036, LDP Specification) with the difference that the label value used to forward a packet to each downstream router is computed by the upstream router based on advertised prefix SID index using the above formula.

There are two mutually exclusive modes of operation for the prefix SID range on the router. In the global mode of operation, the user configures the global value and this IGP instance will assume the start label value is the lowest label value in the SRGB and the prefix SID index range size equal to the range size of the SRGB. Once one IGP instance selected the global option for the prefix SID range, all IGP instances on the system will be restricted to do the same. The user must shutdown the segment routing context and delete the prefix-sid-range command in all IGP instances in order to change the SRGB. Once the SRGB is changed, the user must re-enter the prefix-sid-range command again. The SRGB range change will be failed if an already allocated SID index/label goes out of range.

In the per-instance mode of operation, the user partitions the SRGB into non-overlapping sub-ranges among the IGP instances. The user thus configures a subset of the SRGB by specifying the start label value and the prefix SID index range size. All resulting net label values (start-label + index} must be within the SRGB or the configuration will be failed. Furthermore, the code checks for overlaps of the resulting net label value range across IGP instances and will strictly enforce that these ranges do not overlap. The user must shutdown the segment routing context of an IGP instance in order to change the SID index/label range of that IGP instance using the prefix-sid-range command. In addition, any range change will be failed if an already allocated SID index/label goes out of range. The user can however change the SRGB on the fly as long as it does not reduce the current per IGP instance SID index/label range defined with the prefix-sid-range. Otherwise, the user must shutdown the segment routing context of the IGP instance and delete and re-configure the prefix-sid-range command.

Default

no prefix-sid-range

Parameters

label-value

Specifies the label offset for the SR label range of this IGP instance.

Values: 0 to 524287

index-value

Specifies the maximum value of the prefix SID index range for this IGP instance.

Values: 1 to 524287

Platforms

All

prefix-sid-range

Syntax

prefix-sid-range global

prefix-sid-range start-label label-value max-index index-value

no prefix-sid-range

Context

[Tree] (config>router>ospf3>segm-rtng prefix-sid-range)

[Tree] (config>router>ospf>segm-rtng prefix-sid-range)

Full Context

configure router ospf3 segment-routing prefix-sid-range

configure router ospf segment-routing prefix-sid-range

Description

This command configures the prefix SID index range and offset label value for an IGP instance.

The key parameter is the configuration of the prefix SID index range and the offset label value that this IGP instance will use. Because each prefix SID represents a network global IP address, the SID index for a prefix must be unique network-wide. Therefore, all routers in the network are expected to configure and advertise the same prefix SID index range for an IGP instance. However, the label value used by each router to represent this prefix, that is, the label programmed in the ILM, can be local to that router by the use of an offset label, referred to as a start label:

Local Label (Prefix SID) = start-label + {SID index}

The label operation in the network is very similar to LDP when operating in independent label distribution mode (RFC 5036, LDP Specification), with the difference being that the label value used to forward a packet to each downstream router is computed by the upstream router based on the advertised prefix SID index using the above formula.

There are two mutually exclusive modes of operation for the prefix SID range on the router. In the global mode of operation, the user configures the global value and this IGP instance will assume the start label value is the lowest label value in the SRGB and the prefix SID index range size equal to the range size of the SRGB. After one IGP instance selected the global option for the prefix SID range, all IGP instances on the system will be restricted to do the same. The user must shutdown the segment routing context and delete the prefix-sid-range command in all IGP instances in order to change the SRGB. After the SRGB is changed, the user must re-enter the prefix-sid-range command again. The SRGB range change will be failed if an already allocated SID index/label goes out of range.

In per-instance mode, the user partitions the SRGB into non-overlapping sub-ranges among the IGP instances. The user configures a subset of the SRGB by specifying the start label value and the prefix SID index range size. All resulting net label values (start-label + index) must be within the SRGB or the configuration will fail. The 7750 SR checks for overlaps of the resulting net label value range across IGP instances and will strictly enforce no overlapping of these ranges. The user must shut down the segment routing context of an IGP instance in order to change the SID index/label range of that IGP instance using the prefix-sid-range command. A range change will fail if an already allocated SID index/label goes out of range. The user can change the SRGB without shutting down the segment routing context as long as it does not reduce the current per-IGP instance SID index/label range defined with the prefix-sid-range command. Otherwise, shut down the segment routing context of the IGP instance, and disable and re-enable the prefix-sid-range command.

Default

no prefix-sid-range

Parameters

label-value

Specifies the label offset for the SR label range of this IGP instance.

Values: 0 to 524287

index-value

Specifies the maximum value of the prefix SID index range for this IGP.

Values: 1 to 524287

Platforms

All

prefix-sids

Syntax

prefix-sids ip-int-name

no prefix-sids ip-int-name

Context

[Tree] (config>router>segment-routing>sr-mpls prefix-sids)

Full Context

configure router segment-routing sr-mpls prefix-sids

Description

This command configures the prefix SIDs for an interface.

The no form of this command removes the prefix SIDs list instance.

Default

no prefix-sids

Parameters

ip-int-name: Specifies the loopback or system interface name that owns the prefix to be advertised, up to 32 characters.

Platforms

All

prefix-unreachable

Syntax

prefix-unreachable

Context

[Tree] (config>router>isis prefix-unreachable)

Full Context

configure router isis prefix-unreachable

Description

Commands in this context configure the prefix-unreachable context.

Platforms

All

preserve-key

Syntax

[no] preserve-key

Context

[Tree] (config>system>security>ssh preserve-key)

Full Context

configure system security ssh preserve-key

Description

After enabling this command, private keys, public keys, and host key file are saved by the server. It is restored following a system reboot or the ssh server restart.

The no form of this command specifies that the keys are held in memory by an SSH server and is not restored following a system reboot.

Default

no preserve-key

Platforms

All

primary

Syntax

primary

Context

[Tree] (config>aaa>radius-scr-plcy primary)

Full Context

configure aaa radius-script-policy primary

Description

Commands in this context configure a primary script.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

primary

Syntax

primary

Context

[Tree] (config>subscr-mgmt>sub-ident-pol primary)

Full Context

configure subscriber-mgmt sub-ident-policy primary

Description

Commands in this context configure primary identification script parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

primary

Syntax

primary path-name

no primary

Context

[Tree] (config>router>mpls>lsp primary)

Full Context

configure router mpls lsp primary

Description

This command specifies a preferred path for the LSP. This command is optional only if the secondary path-name is included in the LSP definition. Only one primary path can be defined for an LSP.

Some of the attributes of the LSP such as the bandwidth, and hop-limit can be optionally specified as the attributes of the primary path. The attributes specified in the primary path path-name command, override the LSP attributes.

The no form of this command deletes the association of this path-name from the LSP lsp-name. All configurations specific to this primary path, such as record, bandwidth, and hop limit, are deleted. The primary path must be shutdown first in order to delete it. The no primary command will not result in any action except a warning message on the console indicating that the primary path is administratively up.

Parameters

path-name: Specifies the case-sensitive alphanumeric name label for the LSP path up to 64 characters in length.

Platforms

All

primary

Syntax

[no] primary [mda-id | esa-vm-id]

Context

[Tree] (config>isa>aa-grp primary)

Full Context

configure isa application-assurance-group primary

Description

This command assigns an AA ISA or ESA-VM configured in the specified location to this application assurance group. Primary and backup ISAs have equal operational status and when both ISAs are coming up, the one that becomes operational first becomes the active ISA.

On an activity switch from the primary ISA, all configurations are already on the backup ISA but flow state information must be re-learned. Any statistics not yet spooled are lost. Auto-switching from the backup to primary, after the primary becomes available again, is not supported.

The user is notified through SNMP events when:

When AA service goes down (all ISAs in the group are down) or comes back up (an ISA in the group becomes active)
When AA redundancy fails (one of the ISAs in the group is down) or recovers (the failed MDA comes back up)
When an AA activity switch occurred.

The no form of this command removes the specified ISA from the application assurance group.

Parameters

mda-id

Specifies the slot/mda or esa/vm, identifying a provisioned AA ISA.

Values


slot/mda
slot	1 to 10, depending on chassis model
mda	1 to 2

esa-vm-id

Specifies the ESA and VM, identifying a provisioned ESA-VM. The value of the esa-vm-id for application assurance is used as the esa-id plus 128. For example, an ESA 1 with VM2 would be referred to as esa-129/2.

Values


esa-id+128/vm-id
esa-id	1 to 16
vm-id	1 to 4

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

primary

Syntax

primary mda-id

no primary

Context

[Tree] (config>isa>tunnel-grp primary)

Full Context

configure isa tunnel-group primary

Description

This command assigns an ISA IPsec module configured in the specified slot to this IPsec group. The backup ISA IPsec provides the IPsec group with warm redundancy when the primary ISA IPsec in the group is configured. Primary and backup ISA IPsec have equal operational status and when both MDAs are coming up, the one that becomes operational first becomes the active ISA IPsec.

All configuration information is pushed down to the backup MDA from the CPM once the CPM gets notice that the primary module has gone down. This allows multiple IPsec groups to use the same backup module. Any statistics not yet spooled will be lost. Auto-switching from the backup to primary, once the primary becomes available again, is supported.

The operator is notified through SNMP events when:

When the ISA IPsec service goes down (all modules in the group are down) or comes back up (a module in the group becomes active).
When ISA IPsec redundancy fails (one of the modules in the group is down) or recovers (the failed module comes back up).
When an ISA IPsec activity switch took place.

The no form of this command removes the specified primary ID from the group’s configuration.

Default

no primary

Parameters

mda-id: Specifies the card/slot identifying a provisioned IPsec ISA.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

primary

Syntax

primary primary secondary secondary

Context

[Tree] (config>service>ies>if>ipsec>ipsec-tunnel>dyn>cert>status-verify primary)

[Tree] (config>service>vprn>if>sap>ipsec-tun>dyn>cert>status-verify primary)

[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel>dyn>cert>status-verify primary)

[Tree] (config>service>vprn>if>sap>ipsec-gw>cert>status-verify primary)

[Tree] (config>ipsec>trans-mode-prof>dyn>cert>status-verify primary)

[Tree] (config>router>if>ipsec>ipsec-tun>dyn>cert>status-verify primary)

[Tree] (config>service>ies>if>sap>ipsec-gw>cert>status-verify primary)

Full Context

configure service ies interface ipsec ipsec-tunnel dynamic-keying cert status-verify primary

configure service vprn interface sap ipsec-tunnel dynamic-keying cert status-verify primary

configure service vprn interface ipsec ipsec-tunnel dynamic-keying cert status-verify primary

configure service vprn interface sap ipsec-gw cert status-verify primary

configure ipsec ipsec-transport-mode-profile dynamic-keying cert primary

configure router interface ipsec ipsec-tunnel dynamic-keying cert status-verify primary

configure service ies interface sap ipsec-gw cert status-verify primary

Description

This command specifies the primary and secondary CVS methods used to verify the revocation status of the peer’s certificate.

OCSP or CRL uses the corresponding configuration in the CA profile of the issuer of the certificate in question.

Default

primary crl

Parameters

primary

Specifies the primary CSV method used to verify the revocation status of the peer’s certificate.

Values

ocsp — Specifies that the OCSP protocol should be used. The OCSP server is configured in the corresponding CA profile.

crl — Specifies that the local CRL file should be used. The CRL file is configured in the corresponding CA profile.

Default: crl

secondary

Specifies the secondary CSV method used to verify the revocation status of the peer’s certificate.

Values

ocsp — Specifies that the OCSP protocol should be used. The OCSP server is configured in the corresponding CA profile.

crl — Specifies that the local CRL file should be used. The CRL file is configured in the corresponding CA profile.

none — Specifies that no secondary method of CSV is used.

Default: none

Platforms

VSR

configure router interface ipsec ipsec-tunnel dynamic-keying cert status-verify primary
configure service vprn interface ipsec ipsec-tunnel dynamic-keying cert status-verify primary
configure service ies interface ipsec ipsec-tunnel dynamic-keying cert status-verify primary

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure service ies interface sap ipsec-gw cert status-verify primary
configure ipsec ipsec-transport-mode-profile dynamic-keying cert primary
configure service vprn interface sap ipsec-gw cert status-verify primary
configure service vprn interface sap ipsec-tunnel dynamic-keying cert status-verify primary

primary

Syntax

[no] primary mda-id

Context

[Tree] (config>isa>video-group primary)

Full Context

configure isa video-group primary

Description

This command configures the primary video group ISA. Only one primary can be configured per video group when ad insertion is enabled. The maximum number of primaries per video-group for FCC and RD is 4.

Parameters

mda-id

Specifies the slot and MDA number for the primary video group ISA.

Values


slot/mda
	slot	1 to 10 (depending on the chassis model)
	mda	1 to 2

Platforms

7450 ESS, 7750 SR, 7750 SR-s

primary-cf

Syntax

primary-cf cflash-id

Context

[Tree] (config>call-trace primary-cf)

Full Context

configure call-trace primary-cf

Description

This command specifies which compact-flash is used as the primary CF for call-trace operation.

Default

primary-cf cf1

Parameters

cflash-id

Specifies the compact flash card to be used as the primary local storage location to save the generated call trace log files.

Values: cf1, cf2

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

primary-config

Syntax

primary-config file-url

no primary-config

Context

[Tree] (bof primary-config)

Full Context

bof primary-config

Description

This command specifies the name and location of the primary configuration file.

The system attempts to use the configuration specified in primary-config. If the specified file cannot be located, the system automatically attempts to obtain the configuration from the location specified in secondary-config and then the tertiary-config.

If an error in the configuration file is encountered, the boot process aborts.

The no form of this command removes the primary-config configuration.

Parameters

file-url

Specifies the primary configuration file location, expressed as a file URL.

Values


file-url	{local-url \| remote-url} (up to 180 characters)
local-url	[cflash-id/][file-path]
remote-url	[{ftp://\| tftp://} login:pswd@remote-locn/][file-path]
cflash-id	cf1:, cf1-A:, cf1-B:, cf2:, cf2-A:, cf2-B:, cf3:, cf3-A:, cf3-B:

Platforms

All

primary-dns

Syntax

primary-dns ip-address

no primary-dns

Context

[Tree] (config>service>vprn>sub-if>grp-if>wlan-gw>ranges>range>dhcp primary-dns)

[Tree] (config>service>ies>sub-if>grp-if>wlan-gw>ranges>range>dhcp primary-dns)

Full Context

configure service vprn subscriber-interface group-interface wlan-gw vlan-tag-ranges range dhcp primary-dns

configure service ies subscriber-interface group-interface wlan-gw vlan-tag-ranges range dhcp primary-dns

Description

This command configures the primary DNS address to be returned via DHCP on WLAN-GW ISA.

The no form of this command reverts to the default.

Parameters

ip-address: Specifies the primary DNS address.

Platforms

7750 SR, 7750 SR-e, 7750 SR-s, VSR

primary-dns

Syntax

primary-dns ip-address

no primary-dns

Context

[Tree] (config>service>vprn>dns primary-dns)

Full Context

configure service vprn dns primary-dns

Description

This command configures the primary DNS server used for DNS name resolution. DNS name resolution can be used when executing ping, traceroute, and service-ping, and also when defining file URLs. DNS name resolution is not supported when DNS names are embedded in configuration files.

The no form of this command removes the primary DNS server from the configuration.

Default

no primary-dns — No primary DNS server is configured.

Parameters

ip-address

The IP or IPv6 address of the primary DNS server.

Values


ipv4-address -a.b.c.d
ipv6-address:	x:x:x:x:x:x:x:x[-interface]
	x:x:x:x:x:x:d.d.d.d[-interface]
	x: [0..FFFF]H
	d: [0..255]D
	interface - 32 characters max, for link local addresses.

Platforms

All

primary-dns

Syntax

primary-dns ip-address

no primary-dns [ip-address]

Context

[Tree] (bof primary-dns)

Full Context

bof primary-dns

Description

This command configures the primary DNS server used for DNS name resolution. DNS name resolution can be used when executing ping, traceroute, and service-ping, and also when defining file URLs. DNS name resolution is not supported when DNS names are embedded in configuration files.

The no form of this command removes the primary DNS server from the configuration.

Default

no primary-dns

Parameters

ip-address

Specifies the IP or IPv6 address of the primary DNS server.

Values


ipv4-address	a.b.c.d
ipv6-address	x:x:x:x:x:x:x:x[-interface]
	x:x:x:x:x:x:d.d.d.d[-interface]
	x: [0 to FFFF]H
	d: [0 to 255]D
interface	32 chars max, for link local addresses

Note:

IPv6 is applicable to the 7750 SR and 7950 XRS only.

Platforms

All

primary-image

Syntax

primary-image file-url

no primary image

Context

[Tree] (bof primary-image)

Full Context

bof primary-image

Description

This command specifies the primary directory location for runtime image file loading.

The system attempts to load all runtime image files configured in the primary-image first. If this fails, the system attempts to load the runtime images from the location configured in the secondary-image. If the secondary image load fails, the tertiary image specified in tertiary-image is used.

All runtime image files (*.tim files) must be located in the same directory.

The no form of this command removes the primary-image configuration.

Parameters

file-url

Specifies the file-url can be either local (this CPM) or a remote FTP server.

Values


file-url	{local-url \| remote-url} (up to 180 characters)
local-url	[cflash-id/][file-path]
remote-url	[{ftp://\| tftp://} login:pswd@remote-locn/][file-path]
cflash-id	cf1:, cf1-A:, cf1-B:, cf2:, cf2-A:, cf2-B:, cf3:, cf3-A:, cf3-B:

Platforms

All

primary-ip-address

Syntax

primary-ip-address ipv4-address

no primary-ip-address

Context

[Tree] (config>router>bgp>orr>location primary-ip-address)

Full Context

configure router bgp optimal-route-reflection location primary-ip-address

Description

This command specifies the primary IP address of a reference location used for BGP optimal route reflection. Up to three IPv4 addresses and three IPv6 addresses can be specified per location.

If the TE DB is unable find a node in its topology database that matches a primary address of the location, then it tries to find a node matching a secondary address. If this attempt also fails, the TE DB tries to find a node matching a tertiary address.

The IP addresses specified for a location should be topologically "close” to a set of clients that should all receive the same optimal path for that location.

The no form of this command removes the primary IP address information.

Default

no primary-ip-address

Parameters

ipv4-address

Specifies the primary IPv4 address of a location expressed in dotted decimal notation.

Values: a.b.c.d

Platforms

All

primary-ipv6-address

Syntax

primary-ipv6-address ipv6-address

no primary-ipv6-address

Context

[Tree] (config>router>bgp>orr>location primary-ipv6-address)

Full Context

configure router bgp optimal-route-reflection location primary-ipv6-address

Description

This command specifies the primary IPv6 address of a reference location used for BGP optimal route reflection. Up to three IPv4 addresses and three IPv6 addresses can be specified per location.

If the TE DB is unable find a node in its topology database that matches a primary address of the location, then it tries to find a node matching a secondary address. If this attempt also fails, the TE DB tries to find a node matching a tertiary address.

The IP addresses specified for a location should be topologically "close” to a set of clients that should all receive the same optimal path for that location.

The no form of this command removes the primary IPv6 address information.

Default

no primary-ipv6-address

Parameters

ipv6-address

Specifies the primary IPv6 address of a location expressed in dotted decimal notation.

Values

ipv6-address:

x:x:x:x:x:x:x:x (eight 16-bit pieces)
x:x:x:x:x:x:d.d.d.d
x: [0 to FFFF]H
d: [0 to 255]D

Platforms

All

primary-location

Syntax

primary-location file-url

no primary-location

Context

[Tree] (config>system>software-repository primary-location)

Full Context

configure system software-repository primary-location

Description

This command configures the primary location for the files in the software repository. See the software-repository command description for more information.

The no form of the command removes the primary location.

Parameters

file-url

Specifies the primary location to be used to access the files in the software repository.

Values


file url	local-url \| remote-url
local-url	[cflash-id/][file-path]	200 chars maximum, including cflash-id directory length 99 characters maximum each
remote-url	[{ftp://} login:pswd@remote-locn/][file-path] 243 characters maximum directory length 99 characters maximum each
	remote-locn	[hostname \| ipv4-address \| [ipv6- address]]
	ipv4-address	a.b.c.d
	ipv6-address	x:x:x:x:x:x:x:x[-interface]
		x:x:x:x:x:x:d.d.d.d[-interface]
		x - [0 to FFFF]H
		d - [0 to 255]D
		interface - 32 characters max, for link local addresses
cflash-id	cf1:, cf1-A:, cf1-B:, cf2:, cf2-A:, cf2-B:, cf3:, cf3-A:, cf3-B:

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

primary-nbns

Syntax

primary-nbns ip-address

no primary-nbns

Context

[Tree] (config>service>ies>sub-if>grp-if>wlan-gw>ranges>range>dhcp primary-nbns)

[Tree] (config>service>vprn>sub-if>grp-if>wlan-gw>ranges>range>dhcp primary-nbns)

Full Context

configure service ies subscriber-interface group-interface wlan-gw vlan-tag-ranges range dhcp primary-nbns

configure service vprn subscriber-interface group-interface wlan-gw vlan-tag-ranges range dhcp primary-nbns

Description

This command configures the primary NBNS address to be returned via DHCP on WLAN-GW ISA.

The no form of this command reverts to the default.

Parameters

ip-address: Specifies the primary NBNS address.

Platforms

7750 SR, 7750 SR-e, 7750 SR-s, VSR

primary-next-hop

Syntax

[no] primary-next-hop

Context

[Tree] (config>router>mpls>fwd-policies>fwd-policy>nh-grp primary-next-hop)

Full Context

configure router mpls forwarding-policies forwarding-policy next-hop-group primary-next-hop

Description

Commands in this context configure the primary next hop of an NHG entry in a forwarding policy.

The no form of this command removes the primary next-hop context from an NHG entry in a forwarding policy.

Platforms

All

primary-p2mp-instance

Syntax

[no] primary-p2mp-instance instance-name

Context

[Tree] (config>router>mpls>lsp primary-p2mp-instance)

Full Context

configure router mpls lsp primary-p2mp-instance

Description

This command creates the primary instance of a P2MP LSP. The primary instance of a P2MP LSP is modeled as a set of root-to-leaf (S2L) sub-LSPs. The root, for example a head-end node triggers signaling using one path message per S2L path. The leaf sub-LSP paths are merged at branching points.

This command is not supported on the 7450 ESS.

Parameters

instance-name: Specifies a name that identifies the P2MP LSP instance. The instance name can be up to 32 characters long and must be unique.

Platforms

All

primary-path

Syntax

primary-path

Context

[Tree] (config>mcast-mgmt>bw-plcy>t2-paths primary-path)

Full Context

configure mcast-management bandwidth-policy t2-paths primary-path

Description

Commands in this context configure primary path parameters.

Platforms

7450 ESS, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-7/12/12e, 7750 SR-s, 7950 XRS, VSR

primary-ports

Syntax

primary-ports

Context

[Tree] (config>service>template>vpls-template>mac-move primary-ports)

[Tree] (config>service>vpls>mac-move primary-ports)

Full Context

configure service template vpls-template mac-move primary-ports

configure service vpls mac-move primary-ports

Description

Commands in this context define primary VPLS ports. VPLS ports that were declared as secondary prior to the execution of this command will be moved from secondary port-level to primary port-level. Changing a port to the tertiary level can only be done by first removing it from the secondary port-level.

Platforms

All

primary-tunnel-interface

Syntax

primary-tunnel-interface ldp-p2mp p2mp-identifier sender ip-address

primary-tunnel-interface rsvp-p2mp lsp-name sender ip-address

no primary-tunnel-interface

Context

[Tree] (config>mcast-mgmt>mcast-info-plcy>bundle>channel primary-tunnel-interface)

[Tree] (config>mcast-mgmt>mcast-info-plcy>bundle primary-tunnel-interface)

[Tree] (config>mcast-mgmt>mcast-info-plcy>bundle>channel>source-override primary-tunnel-interface)

Full Context

configure mcast-management multicast-info-policy bundle channel primary-tunnel-interface

configure mcast-management multicast-info-policy bundle primary-tunnel-interface

configure mcast-management multicast-info-policy bundle channel source-override primary-tunnel-interface

Description

This command allows the user to define a bundle in the multicast-info-policy and specify channels in the bundle that must be received from the primary tunnel interface associated with an RSVP P2MP LSP. The multicast info policy is applied to the base router instance.

The egress LER can accept multicast packets via two different methods. The regular RPF check on unlabeled IP multicast packets, which is based on routing table lookup. The static assignment which specifies the receiving of a multicast group <*,G> or a specific <S,G> from a primary tunnel-interface associated with an RSVP P2MP LSP.

One or more primary tunnel interfaces in the base router instance can be configured. That is, the user can specify to receive different multicast groups, <*,G> or specific <S,G>, from different P2MP LSPs. This assumes that there are static joins configured for the same multicast groups at the ingress LER to forward over a tunnel interface associated with the same P2MP LSP.

At any given time, packets of the same multicast group can be accepted from either the primary tunnel interface associated with a P2MP LSP or from a PIM interface. These are mutually exclusive options. As soon as a multicast group is configured against a primary tunnel interface in the multicast info policy, it is blocked from other PIM interfaces.

A multicast packet received on a tunnel interface associated with a P2MP LSP can be forwarded over a PIM or IGMP interface which can be an IES interface, a spoke SDP terminated IES interface, or a network interface.

The no form of this command removes the static RPF check.

Parameters

lsp-name: Species a string of up to 32 characters identifying the LSP name as configured at the ingress LER.

ip-address: Specifies a string of 15 characters representing the IP address of the ingress LER for the LSP.

p2mp-id

Identifier used for signaling mLDP P2MP LSP (applies only to the 7750 SR).

Values: 1 to 4294967296

Platforms

All

primary-url

Syntax

primary-url url

no primary-url

Context

[Tree] (config>python>py-script primary-url)

Full Context

configure python python-script primary-url

Description

This command specifies the location of the primary Python script. The system supports three locations for each Python script. Users can store the script file on either a local CF card or an FTP server.

The no form of this command removes the URL.

Parameters

url: Specifies the primary URL of the Python script up to 180 characters, either a local CF card url or a FTP server URL.

Platforms

All

prio-code-point

Syntax

prio-code-point priority-code-point

no prio-code-point

Context

[Tree] (config>test-oam>build-packet>header>dot1q prio-code-point)

Full Context

configure test-oam build-packet header dot1q prio-code-point

Description

This command defines the priority code point to be used in the test Dot1Q header.

The no form of this command removes the priority code point value.

Default

prio-code-point 0 (BE)

Parameters

priority-code-point

Specifies the priority code point to be used in the test Dot1Q header.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

prio-code-point

Syntax

prio-code-point priority-code-point

no prio-code-point

Context

[Tree] (debug>oam>build-packet>packet>field-override>header>dot1q prio-code-point)

Full Context

debug oam build-packet packet field-override header dot1q prio-code-point

Description

This command configures a Priority Code Point (PCP) for an IEEE 802.1Q packet header to be launched by the OAM find-egress tool.

The no form of this command removes the priority code point value.

Default

no override

Parameters

priority-code-point

Specifies the priority code point to be used in the test Dot1Q header.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority level

Context

[Tree] (config>subscr-mgmt>sub-prof>ingress>policer-control-policy>priority-mbs-thresholds priority)

[Tree] (config>subscr-mgmt>sub-prof>egress>policer-control-policy>priority-mbs-thresholds priority)

Full Context

configure subscriber-mgmt sub-profile ingress policer-control-policy priority-mbs-thresholds priority

configure subscriber-mgmt sub-profile egress policer-control-policy priority-mbs-thresholds priority

Description

The priority level command contains the mbs-contribution configuration command for a given strict priority level. Eight levels are supported numbered 1 through 8 with 8 being the highest strict priority.

Each of the eight priority CLI nodes always exists and do not need to be created. While parameters exist for each priority level, the parameters are only applied when the priority level within a parent policer instance is currently supporting child policers.

Parameters

level

Specifies the priority level override.

Values: 1 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

priority priority source {python | diameter-gx | ludb | radius | diameter-nasreq | gtp | dhcp | local-address-assignment}

no priority priority

Context

[Tree] (config>subscr-mgmt>auth-orig priority)

Full Context

configure subscriber-mgmt authentication-origin priority

Description

This command allows the relative order of authentication priorities to be swapped between RADIUS and LUDB by configuring the RADIUS source priority to value 3. By moving RADIUS to the third position, LUDB, and all the origins below LUDB, are pushed down.The active order of priorities can be displayed in the output of the show subscriber-mgmt authentication-origin command.

The no form of this command deletes the priority value. To restore defaults, the priority configuration must be deleted.

Parameters

priority

Specifies the authentication origin priority override.

Values: 1 to 7

source

Specifies the source of authentication priority. Only radius can be configured. RADIUS as the authentication origin can be assigned priority 3 which places it above LUDB.

Values: python, diameter-gx, ludb, radius, diameter-nasreq, gtp, dhcp, local-address-assignment

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>vprn>sub-if>grp-if>srrp priority)

[Tree] (config>service>ies>sub-if>grp-if>srrp priority)

Full Context

configure service vprn subscriber-interface group-interface srrp priority

configure service ies subscriber-interface group-interface srrp priority

Description

This command overrides the default base priority for the SRRP instance. The SRRP instance priority is advertised by the SRRP instance to its neighbor router and is compared to the priority received from the neighbor router. The router with the best (highest) priority enters the master state while the other router enters the backup state. If the priority of each router is the same, the router with the lowest source IP address in the SRRP advertisement message assumes the master state.

The base priority of an SRRP instance can be managed by VRRP policies. A VRRP policy defines a set of connectivity or verification tests which, when they fail, may lower an SRRP instances base priority (creating an in-use priority for the instance). Every time an SRRP instances in-use priority changes when in master state, it sends an SRRP advertisement message with the new priority. If the dynamic priority drops to zero or receives an SRRP Advertisement message with a better priority, the SRRP instance transitions to the becoming backup state.

When the priority command is not specified, or the no priority command is executed, the system uses a default base priority of 100. The priority command may be executed at any time.

The no form of this command restores the default base priority to the SRRP instance. If a VRRP policy is associated with the SRRP instance, it will use the default base priority as the basis for any modifications to the SRRP instances in-use priority.

Default

priority 100

Parameters

priority

Specifies a base priority for the SRRP instance to override the default.

Values: 1 to 254

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

[no] priority level

Context

[Tree] (config>card>fp>ingress>network>queue-group>policer-control-override>priority-mbs-thresholds priority)

[Tree] (config>card>fp>ingress>access>queue-group>policer-control-override>priority-mbs-thresholds priority)

Full Context

configure card fp ingress network queue-group policer-control-override priority-mbs-thresholds priority

configure card fp ingress access queue-group policer-control-override priority-mbs-thresholds priority

Description

The priority level command contains the mbs-contribution configuration command for a given strict priority level. Eight levels are supported numbered 1 through 8 with 8 being the highest strict priority.

Each of the eight priority CLI nodes always exists and do not need to be created. While parameters exist for each priority level, the parameters are only applied when the priority level within a parent policer instance is currently supporting child policers.

Parameters

level

Specifies the priority level.

Values: 1 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority

Syntax

priority priority-value

no priority

Context

[Tree] (config>port>ethernet>eth-cfm>mep>ais-enable priority)

[Tree] (config>lag>eth-cfm>mep>ais-enable priority)

Full Context

configure port ethernet eth-cfm mep ais-enable priority

configure lag eth-cfm mep ais-enable priority

Description

This command specifies the priority of the AIS messages generated by the node.

The no form of the command reverts to the default values.

Parameters

priority-value

Specifies the priority value of the AIS messages originated by the node.

Values: 0 to 7

Default: 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority priority

no priority

Context

[Tree] (config>port>ethernet>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>lag>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>eth-ring>path>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>eth-tunnel>path>eth-cfm>mep>grace>eth-ed priority)

Full Context

configure port ethernet eth-cfm mep grace eth-ed priority

configure lag eth-cfm mep grace eth-ed priority

configure eth-ring path eth-cfm mep grace eth-ed priority

configure eth-tunnel path eth-cfm mep grace eth-ed priority

Description

This command sets the priority bits and determines the forwarding class based on the mapping of priority to FC.

The no form of this command disables the local priority configuration and sets the priority to the ccm-ltm-priority associated with this MEP.

Default

no priority

Parameters

priority

Specifies the priority bit.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

[no] priority level

Context

[Tree] (config>service>ipipe>sap>ingress>policy-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>cpipe>sap>egress>policy-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>epipe>sap>ingress>policy-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>cpipe>sap>ingress>policy-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>ipipe>sap>egress>policy-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>epipe>sap>egress>policy-ctrl-over>mbs-thrshlds priority)

Full Context

configure service ipipe sap ingress policer-control-override priority-mbs-thresholds priority

configure service cpipe sap egress policer-control-override priority-mbs-thresholds priority

configure service epipe sap ingress policer-control-override priority-mbs-thresholds priority

configure service cpipe sap ingress policer-control-override priority-mbs-thresholds priority

configure service ipipe sap egress policer-control-override priority-mbs-thresholds priority

configure service epipe sap egress policer-control-override priority-mbs-thresholds priority

Description

The priority-level level override CLI node contains the specified priority level’s mbs-contribution override value.

This node does not need to be created and will not be output in show or save configurations unless an mbs-contribution override exist for level.

Parameters

level

The level parameter is required when specifying priority-level and identifies which of the parent policer instances priority level’s the mbs-contribution is overriding.

Values: 1 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

configure service epipe sap ingress policer-control-override priority-mbs-thresholds priority
configure service epipe sap egress policer-control-override priority-mbs-thresholds priority
configure service ipipe sap egress policer-control-override priority-mbs-thresholds priority
configure service ipipe sap ingress policer-control-override priority-mbs-thresholds priority

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS

configure service cpipe sap egress policer-control-override priority-mbs-thresholds priority
configure service cpipe sap ingress policer-control-override priority-mbs-thresholds priority

priority

Syntax

priority priority-value

no priority

Context

[Tree] (config>service>epipe>sap>eth-cfm>mep priority)

[Tree] (config>service>epipe>spoke-sdp>eth-cfm>aid-enable priority)

Full Context

configure service epipe sap eth-cfm mep priority

configure service epipe spoke-sdp eth-cfm aid-enable priority

Description

This command specifies the priority of AIS messages originated by the node.

Parameters

priority-value

Specifies the priority value of the AIS messages originated by the node.

Values: 0 to 7

Default: 1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>ipipe>sap>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>epipe>sap>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>epipe>spoke-sdp>eth-cfm>mep>grace>eth-ed priority)

Full Context

configure service ipipe sap eth-cfm mep grace eth-ed priority

configure service epipe sap eth-cfm mep grace eth-ed priority

configure service epipe spoke-sdp eth-cfm mep grace eth-ed priority

Description

This command sets the priority bits and determines the forwarding class based on the mapping of priority to FC.

The no form of this command disables the local priority configuration and sets the priority to the ccm-ltm-priority associated with this MEP.

Default

no priority

Parameters

priority

Specifies the priority bit.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority stp-priority

no priority [stp-priority]

Context

[Tree] (config>service>vpls>stp priority)

[Tree] (config>service>template>vpls-template>stp priority)

[Tree] (config>service>template>vpls-sap-template>stp priority)

Full Context

configure service vpls stp priority

configure service template vpls-template stp priority

configure service template vpls-sap-template stp priority

Description

The bridge-priority command is used to populate the priority portion of the bridge ID field within outbound BPDUs (the most significant 4 bits of the bridge ID). It is also used as part of the decision process when determining the best BPDU between messages received and sent. All values are truncated to multiples of 4096, conforming with IEEE 802.1t and 802.1D-2004.

The no form of this command returns the bridge priority to the default value.

Default

priority 4096

Parameters

bridge-priority

Specifies the bridge priority for the STP instance

Values: Allowed values are integers in the range of 4096 to 65535 with 4096 being the highest priority. The actual bridge priority value stored/used is the number entered with the lowest 12 bits masked off which means the actual range of values is 4096 to 61440 in increments of 4096.

Platforms

All

priority

Syntax

priority stp-priority

no priority

Context

[Tree] (config>service>vpls>sap>stp priority)

[Tree] (config>service>vpls>spoke-sdp>stp priority)

[Tree] (config>service>vpls>spoke-sdp priority)

Full Context

configure service vpls sap stp priority

configure service vpls spoke-sdp stp priority

configure service vpls spoke-sdp priority

Description

This command configures the Nokia Spanning Tree Protocol (STP) priority for the SAP or spoke SDP.

STP priority is a configurable parameter associated with a SAP or spoke SDP. When configuration BPDUs are received, the priority is used in some circumstances as a tie breaking mechanism to determine whether the SAP or spoke SDP be designated or blocked.

In traditional STP implementations (802.1D-1998), this field is called the port priority and has a value of 0 to 255. This field is coupled with the port number (0 to 255 also) to create a 16 bit value. In the latest STP standard (802.1D-2004) only the upper 4 bits of the port priority field are used to encode the SAP or spoke SDP priority. The remaining 4 bits are used to extend the port ID field into a 12 bit virtual port number field. The virtual port number uniquely references a SAP or spoke SDP within the STP instance.

STP computes the actual priority by taking the input value and masking out the lower four bits. The result is the value that is stored in the SDP priority parameter. For instance, if a value of 0 is entered, masking out the lower 4 bits results in a parameter value of 0. If a value of 255 is entered, the result is 240.

The no form of this command returns the STP priority to the default value.

Default

priority 128

Parameters

stp-priority

Specifies the STP priority value for the SAP or spoke SDP. 0 is the highest priority. The actual value used for STP priority (and stored in the configuration) is the result of masking out the lower 4 bits, therefore the actual value range is 0 to 240 in increments of 16.

Values: 0 to 255

Platforms

All

priority

Syntax

priority priority-value

no priority

Context

[Tree] (config>service>vpls>spoke-sdp>eth-cfm>mep>ais-enable priority)

[Tree] (config>service>vpls>mesh-sdp>eth-cfm>mep>ais-enable priority)

Full Context

configure service vpls spoke-sdp eth-cfm mep ais-enable priority

configure service vpls mesh-sdp eth-cfm mep ais-enable priority

Description

This command specifies the priority of AIS messages originated by the node.

Parameters

priority-value

Specifies the priority value of the AIS messages originated by the node

Values: 0 to 7

Default: 1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>vpls>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>vpls>spoke-sdp>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>vpls>sap>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>vpls>mesh-sdp>eth-cfm>mep>grace>eth-ed priority)

Full Context

configure service vpls eth-cfm mep grace eth-ed priority

configure service vpls spoke-sdp eth-cfm mep grace eth-ed priority

configure service vpls sap eth-cfm mep grace eth-ed priority

configure service vpls mesh-sdp eth-cfm mep grace eth-ed priority

Description

This command sets the priority bits and determines the forwarding class based on the mapping of priority to FC.

The no form of this command disables the local priority configuration and sets the priority to the ccm-ltm-priority associated with this MEP.

Default

no priority

Parameters

priority

Specifies the priority bit.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

[no] priority level

Context

[Tree] (config>service>vpls>sap>ingress>policy-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>vpls>sap>egress>policy-ctrl-over>mbs-thrshlds priority)

Full Context

configure service vpls sap ingress policer-control-override priority-mbs-thresholds priority

configure service vpls sap egress policer-control-override priority-mbs-thresholds priority

Description

The priority-level level override CLI node contains the specified priority level’s mbs-contribution override value.

This node does not need to be created and will not be output in show or save configurations unless an mbs-contribution override exist for level.

The no form of this command sets the MBS contribution for the associated priority to its default value.

Parameters

level

Specifies that the level parameter is required when specifying priority-level and identifies which of the parent policer instances priority level’s the mbs-contribution is overriding

Values: 1 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority

Syntax

priority base-priority

no priority

Context

[Tree] (config>service>ies>if>ipv6>vrrp priority)

Full Context

configure service ies interface ipv6 vrrp priority

Description

This command provides the ability to configure a specific priority value to the virtual router instance. In conjunction with an optional policy command, the base-priority is used to derive the in-use priority of the virtual router instance.

This command is only available in the non-owner vrrp virtual-router-id nodal context. The priority of owner virtual router instances is permanently set to 255 and cannot be changed. For non-owner virtual router instances, if the priority command is not executed, the base-priority will be set to 100.

The no form of this command restores the default value of 100 to base-priority.

Default

priority 100

Parameters

base-priority

The base-priority parameter configures the base priority used by the virtual router instance. If a VRRP Priority Control policy is not also defined, the base-priority will be the in-use priority for the virtual router instance.

Values: 1 to 254

Default: 100

Platforms

All

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>ies>sub-if>grp-if>sap>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>ies>if>spoke-sdp>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>ies>if>sap>eth-cfm>mep>grace>eth-ed priority)

Full Context

configure service ies subscriber-interface group-interface sap eth-cfm mep grace eth-ed priority

configure service ies interface spoke-sdp eth-cfm mep grace eth-ed priority

configure service ies interface sap eth-cfm mep grace eth-ed priority

Description

This command sets the priority bits and determines the forwarding class based on the mapping of priority to FC.

The no form of this command disables the local priority configuration and sets the priority to the ccm-ltm-priority associated with this MEP.

Default

no priority

Parameters

priority

Specifies the priority bit.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s

configure service ies subscriber-interface group-interface sap eth-cfm mep grace eth-ed priority

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

configure service ies interface sap eth-cfm mep grace eth-ed priority
configure service ies interface spoke-sdp eth-cfm mep grace eth-ed priority

priority

Syntax

[no] priority level

Context

[Tree] (config>service>ies>if>sap>ingress>policer-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>ies>if>sap>egress>policer-ctrl-over>mbs-thrshlds priority)

Full Context

configure service ies interface sap ingress policer-control-override priority-mbs-thresholds priority

configure service ies interface sap egress policer-control-override priority-mbs-thresholds priority

Description

The priority-level level override CLI node contains the specified priority level’s mbs-contribution override value.

This node does not need to be created and will not be output in show or save configurations unless an mbs-contribution override exist for level.

The no form of this command sets the MBS contribution for the associated priority to its default value.

Parameters

level

Specifies that the level parameter is required when specifying priority-level and identifies which of the parent policer instances priority level’s the mbs-contribution is overriding.

Values: 1 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority

Syntax

priority base-priority

no priority

Context

[Tree] (config>service>ies>if>vrrp priority)

Full Context

configure service ies interface vrrp priority

Description

The priority command provides the ability to configure a specific priority value to the virtual router instance. In conjunction with an optional policy command, the base-priority is used to derive the in-use priority of the virtual router instance.

The priority command is only available in the non-owner vrrp virtual-router-id nodal context. The priority of owner virtual router instances is permanently set to 255 and cannot be changed. For non-owner virtual router instances, if the priority command is not executed, the base-priority will be set to 100.

The no form of this command restores the default value of 100 to base-priority.

Parameters

base-priority

The base-priority parameter configures the base priority used by the virtual router instance. If a VRRP Priority Control policy is not also defined, the base-priority will be the in-use priority for the virtual router instance.

Values: 1 to 254

Default: 100

Platforms

All

priority

Syntax

priority {low | high}

no priority [{low | high}]

Context

[Tree] (config>service>vprn>static-route-entry>indirect>forwarding-class priority)

[Tree] (config>service>vprn>static-route-entry>next-hop>forwarding-class priority)

[Tree] (config>service>vprn>static-route-entry>ipsec-tunnel>forwarding-class priority)

Full Context

configure service vprn static-route-entry indirect forwarding-class priority

configure service vprn static-route-entry next-hop forwarding-class priority

configure service vprn static-route-entry ipsec-tunnel forwarding-class priority

Description

This optional command associates an enqueuing priority with the static route. The options are either high or low, with low being the default. This parameter has the ability to affect the likelihood that a packet will be enqueued at SAP ingress in the face of ingress congestion.

Once a packet is enqueued into an ingress buffer, the significance of this parameter is lost.

Default

priority low

Parameters

low: Setting the enqueuing parameter for a packet to low decreases the likelihood of enqueuing the packet when the ingress queue is congested. Ingress enqueuing priority only affects ingress SAP queuing. Once the packet is placed in a buffer on the ingress queue, the significance of the enqueuing priority is lost.

high: Setting the enqueuing parameter for a packet to high increases the likelihood of enqueuing the packet when the ingress queue is congested. Ingress enqueuing priority only affects ingress SAP queuing. Once the packet is placed in a buffer on the ingress queue, the significance of the enqueuing priority is lost.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>vprn>if>spoke-sdp>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>vprn>sub-if>grp-if>sap>eth-cfm>mep>grace>eth-ed priority)

[Tree] (config>service>vprn>if>sap>eth-cfm>mep>grace>eth-ed priority)

Full Context

configure service vprn interface spoke-sdp eth-cfm mep grace eth-ed priority

configure service vprn subscriber-interface group-interface sap eth-cfm mep grace eth-ed priority

configure service vprn interface sap eth-cfm mep grace eth-ed priority

Description

This command sets the priority bits and determines the forwarding class based on the mapping of priority to FC.

The no form of this command disables the local priority configuration and sets the priority to the ccm-ltm-priority associated with this MEP.

Default

no priority

Parameters

priority

Specifies the priority bit.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

configure service vprn interface spoke-sdp eth-cfm mep grace eth-ed priority
configure service vprn interface sap eth-cfm mep grace eth-ed priority

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s

configure service vprn subscriber-interface group-interface sap eth-cfm mep grace eth-ed priority

priority

Syntax

[no] priority level

Context

[Tree] (config>service>vprn>if>sap>egress>policer-ctrl-over>mbs-thrshlds priority)

[Tree] (config>service>vprn>if>sap>ingress>policer-ctrl-over>mbs-thrshlds priority)

Full Context

configure service vprn interface sap egress policer-control-override priority-mbs-thresholds priority

configure service vprn interface sap ingress policer-control-override priority-mbs-thresholds priority

Description

The priority-level level override CLI node contains the specified priority level’s mbs-contribution override value.

This node does not need to be created and will not be output in show or save configurations unless an mbs-contribution override exist for level.

The no form of this command sets the MBS contribution for the associated priority to its default value.

Parameters

level

Specifies that the level parameter is required when specifying priority-level and identifies which of the parent policer instances priority level’s the mbs-contribution is overriding.

Values: 1 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>vprn>if>ipv6>vrrp priority)

[Tree] (config>service>vprn>if>vrrp priority)

Full Context

configure service vprn interface ipv6 vrrp priority

configure service vprn interface vrrp priority

Description

The priority command provides the ability to configure a specific priority value to the virtual router instance. In conjunction with an optional policy command, the base-priority is used to derive the in-use priority of the virtual router instance.

The priority command is only available in the non-owner vrrp virtual-router-id nodal context. The priority of owner virtual router instances is permanently set to 255 and cannot be changed. For non-owner virtual router instances, if the priority command is not executed, the base-priority will be set to 100.

The no form of this command restores the default value of 100 to base-priority.

Parameters

base-priority

The base-priority parameter configures the base priority used by the virtual router instance. If a VRRP priority control policy is not also defined, the base-priority will be the in-use priority for the virtual router instance.

Values: 1 to 254

Default: 100

Platforms

All

priority

Syntax

priority number

no priority

Context

[Tree] (config>service>vprn>isis>if>level priority)

Full Context

configure service vprn isis interface level priority

Description

This command configures the priority of the IS-IS router interface for designated router election on a multi-access network.

This priority is included in hello PDUs transmitted by the interface on a multi-access network. The router with the highest priority is the preferred designated router. The designated router is responsible for sending LSPs with regard to this network and the routers that are attached to it.

The no form of this command reverts to the default value.

Default

priority 64

Parameters

number

Specifies the priority for this interface at this level.

Values: 0 to 127

Platforms

All

priority

Syntax

priority number

no priority

Context

[Tree] (config>service>vprn>ospf>area>if priority)

[Tree] (config>service>vprn>ospf3>area>if priority)

Full Context

configure service vprn ospf area interface priority

configure service vprn ospf3 area interface priority

Description

This command configures the priority of the OSPF interface that is used to elect the designated router (DR) on the subnet.

This parameter is only used if the interface is of type broadcast. The router with the highest priority interface becomes the DR. A router with priority 0 is not eligible to be the designated router or backup designated router.

The no form of this command resets the interface priority to the default value.

Default

priority 1

Parameters

number

The interface priority expressed as a decimal integer. A value of 0 indicates the router is not eligible to be the Designated Router of Backup Designated Router on the interface subnet.

Values: 0 to 255

Platforms

All

priority

Syntax

priority dr-priority

no priority

Context

[Tree] (config>service>vprn>pim>if priority)

Full Context

configure service vprn pim interface priority

Description

This command sets the priority value to become the rendezvous point (RP) that is included in bootstrap messages sent by the router. The RP is sometimes called the bootstrap router. The priority command indicates whether the router is eligible to be a bootstrap router.

The no form of this command disqualifies the router to participate in the bootstrap election.

Default

priority 1 (The router is the least likely to become the designated router.)

Parameters

dr-priority

Specifies the priority to become the designated router. The higher the value, the higher the priority.

Values: 1 to 4294967295

Platforms

All

priority

Syntax

priority bootstrap-priority

Context

[Tree] (config>service>vprn>pim>rp>ipv6>bsr-candidate priority)

[Tree] (config>service>vprn>pim>rp>bsr-candidate priority)

Full Context

configure service vprn pim rp ipv6 bsr-candidate priority

configure service vprn pim rp bsr-candidate priority

Description

This command defines the priority used to become the rendezvous point (RP). The higher the priority value the more likely that this router becomes the RP. If there is a tie, the router with the highest IP address is elected.

Parameters

bootstrap-priority

The priority to become the bootstrap router.

Values: 0 to 255

Default: 0 (the router is not eligible to be the bootstrap router)

Platforms

All

priority

Syntax

priority priority

no priority

Context

[Tree] (config>service>vprn>pim>rp>rp-candidate priority)

Full Context

configure service vprn pim rp rp-candidate priority

Description

This command defines the priority used to become the rendezvous point (RP). The higher the priority value, the more likely that this router will become the RP.

Use the no form of this command to revert to the default value.

Default

priority 192

Parameters

priority

Specifies the priority to become the designated router. The higher the value the more likely the router will become the RP.

Values: 0 to 255

Platforms

All

priority

Syntax

priority priority-level

no priority

Context

[Tree] (config>router>ldp>lsp-bfd priority)

Full Context

configure router ldp lsp-bfd priority

Description

This command configures a priority value that is used to order prefix list processing if multiple prefix lists are configured.

The no form of this command restores the default priority value.

Default

priority 1

Parameters

priority-level

Specifies the priority value of the prefix list.

Values: 1 to 16

Platforms

All

priority

Syntax

priority setup-priority hold-priority

no priority

Context

[Tree] (config>router>mpls>lsp>secondary priority)

[Tree] (config>router>mpls>lsp>primary priority)

[Tree] (config>router>mpls>lsp-template priority)

Full Context

configure router mpls lsp secondary priority

configure router mpls lsp primary priority

configure router mpls lsp-template priority

Description

This command enables the soft preemption procedures for this LSP path. The operator enables the soft preemption mechanism on a specific LSP name by explicitly configuring the setup and holding priorities for the primary path at the head-end node. The operator can similarly configure priority values for a secondary path for this LSP name. Different values could be used for the primary and for any of the secondary paths. In the absence of explicit user configuration, the setup priority is internally set to the default value of 7 and the holding priority is set to the default value of 0.

Note:

Valid user-entered values for these two parameters require that the holding priority be numerically lower than or equal to the setup priority, otherwise preemption loops can occur.

Preemption is effected when a router preempting node processes a new RSVP session reservation and there is not enough available bandwidth on the RSVP interface, or the Class Type (CT) when Diff-Serv is enabled, to satisfy the bandwidth in the FlowSpec object while there exist other session reservations for LSP paths with a strictly lower holding priority (numerically higher holding priority value) than the setup priority of the new LSP reservation. If enough available bandwidth is freed on the link or CT to accommodate the new reservation by preempting one or more lower priority LSP paths, the preempting node allows temporary overbooking of the RSVP interface and honors the new reservation.

The preempting node will immediately set the 'Preemption pending’ flag (0x10) in the IPv4 Sub-Object in the RRO object in the Resv refresh for each of the preempted LSP paths. The IPv4 Sub-Object corresponds to the outgoing interface being used by the preempting and preempted LSP paths; however, the bandwidth value in the FlowSpec object is not changed. The Resv flag must also be set if the preempting node is a merge point for the primary LSP path and the backup bypass LSP or detour LSP and the backup LSP is activated.

When evaluating if enough available bandwidth will be freed, the preempting node considers the reservations in order from the lowest holding priority (numerically higher holding priority value) to the holding priority just below the setup priority of the new reservation. A new reservation cannot preempt a reservation which has a value of the holding priority equal to the new reservation setup priority.

When Diff-Serv is enabled on the preempting node and the MAM bandwidth allocation model is used, a new reservation can only preempt a reservation in the same Class Type (CT).

LSP paths which were not flagged at the head-end for soft preemption will be hard preempted. LSP paths with the default holding priority of 0 cannot be preempted. LSP paths with zero bandwidth do not preempt other LSP paths regardless of the values of the path setup priority and the path holding priority. They can also not be preempted.

When evaluating if enough available bandwidth will be freed, the preempting node considers the reservations in order from the lowest holding priority (numerically higher holding priority) to the holding priority just below the setup priority of the new reservation. There is no specific order in which the reservations in the same holding priority are considered.

The preempting node starts a preemption timer for each of the preempted LSP paths. While this timer is on, the node should continue to refresh the Path and Resv for the preempted LSP paths. When the preemption timer expires, the node tears down the reservation if the head-end node has not already done so.

A head-end node upon receipt of the Resv refresh message with the 'Preemption pending’ flag must immediately perform a make-before-break on the affected adaptive CSPF LSP. Both IGP metric and TE metric based CSPF LSPs are included. If an alternative path that excludes the flagged interface is not found, then the LSP is put on a retry in a similar way to the Global Revertive procedure at a head-end node. However, the number of retries and the retry timer are governed by the values of the retry-limit and retry-timer parameters: config>router>mpls>lsp>retry-limit; config>router>mpls>lsp>retry-timer.

MPLS will keep the address list of flagged interfaces for a maximum of 60 s (not user-configurable) from the time the first Resv message with the 'Preemption pending’ flag is received. This actually means that MPLS will request CSPF to find a path that excludes the flagged interfaces in the first few retries until success or until 60 s have elapsed. Subsequent retries after the 60 s will not exclude the flagged interfaces as it is assumed IGP has converged by then and the Unreserved Bandwidth sub-TLV for that priority, or TE Class, in the TE database will show the updated value taking into account the preempting LSP path reservation or a value of zero if overbooked.

If the LSP has a configured secondary standby which is operationally UP, the router will switch the path of the LSP to it and then start the MBB. If no standby path is available and a secondary non-standby is configured, the router will start the MBB and signal the path of the secondary. The LSP path will be switched to either the secondary or the new primary, whichever comes up first.

The no form of this command reverts the LSP path priority to the default values and results in setting the setup priority to 7, in setting the hold priority to 0, and in clearing the 'soft preemption desired’ flag in the RRO in the Resv refresh message.

Default

no priority

Parameters

setup-priority

Specifies the priority of the reservation for this session at setup time.

Values: 0 to 7 (0 is the highest priority and 7 is the lowest priority.)

Default: 7 — This session does not preempt any other session.

holding-priority

Specifies the priority of the reservation for this session at preemption action.

Values: 0 to 7 (0 is the highest priority and 7 is the lowest priority.)

Default: 0 — This session does not get preempted by any other session.

Platforms

All

priority

Syntax

priority value

no priority

Context

[Tree] (config>app-assure>aarp priority)

Full Context

configure application-assurance aarp priority

Description

This command defines the priority for the AARP instance. The priority value is used to determine the master/backup upon initialization or re-balance.

The no form of this command reverts to the default value.

Default

priority 100

Parameters

value

Specifies an integer that defines the priority of an AARP instance.

Values: 0 to 255

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

priority priority-level

no priority

Context

[Tree] (config>app-assure>group>policy>aqp>entry>action>remark priority)

Full Context

configure application-assurance group policy app-qos-policy entry action remark priority

Description

This command configures remark discard priority action on flows matching this AQP entry. When enabled, all packets for all flows matching this AQP entry will be remarked to the configured discard priority.

Default

no priority

Parameters

priority-level

Specifies the priority to apply to a packet.

Values: high, low

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

priority priority

no priority

Context

[Tree] (config>redundancy>multi-chassis>peer>mc-ipsec>tunnel-group priority)

Full Context

configure redundancy multi-chassis peer mc-ipsec tunnel-group priority

Description

This command specifies the local priority of the tunnel-group, this is used to elect master, higher number win. If priority are same, then the peer has more active ISA win; and priority and the number of active ISA are same, then the peer with higher IP address win.

The no form of this command removes the priority value from the configuration.

Default

priority 100

Parameters

priority

Specifies the priority of this tunnel-group.

Values: 0 to 255

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

priority dr-priority

no priority

Context

[Tree] (config>router>pim>interface priority)

Full Context

configure router pim interface priority

Description

This command sets the priority value to elect the designated router (DR). The DR election priority is a 32-bit unsigned number and the numerically larger priority is always preferred.

The no form of this command reverts to the default value.

Default

priority 1

Parameters

priority

Specifies the priority to become the designated router. The higher the value, the higher the priority.

Values: 1 to 4294967295

Platforms

All

priority

Syntax

priority priority

no priority

Context

[Tree] (config>router>pim>rp>ipv6>rp-candidate priority)

[Tree] (config>router>pim>rp>rp-candidate priority)

Full Context

configure router pim rp ipv6 rp-candidate priority

configure router pim rp rp-candidate priority

Description

This command configures the Candidate-RP priority for becoming a rendezvous point (RP). This value is used to elect RP for a group range.

The no form of this command reverts to the default value.

Default

priority 192

Parameters

priority

Specifies the priority to become a rendezvous point (RP). A value of 0 is considered as the highest priority.

Values: 0 to 255

Platforms

All

priority

Syntax

priority priority

no priority

Context

[Tree] (config>oam-pm>session>ethernet priority)

Full Context

configure oam-pm session ethernet priority

Description

This command defines the CoS priority across all tests configured under this session. This CoS value is exposed to the various QoS policies the frame passes through and does not necessarily map directly to the CoS value on the wire.

The no form of this command removes changes the priority to the default value.

Default

priority 0

Parameters

priority

Specifies the CoS value.

Values: 0 to 7

Default: 0

Platforms

All

priority

Syntax

priority level

Context

[Tree] (config>qos>plcr-ctrl-plcy>root>priority-mbs-thresholds priority)

Full Context

configure qos policer-control-policy root priority-mbs-thresholds priority

Description

The priority level command contains the mbs-contribution configuration command for a given strict priority level. Eight levels are supported numbered 1 through 8 with 8 being the highest strict priority.

Each of the eight priority CLI nodes always exists and do not need to be created. While parameters exist for each priority level, the parameters are only applied when the priority level within a parent policer instance is currently supporting child policers.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority

Syntax

priority [priority]

no priority

Context

[Tree] (config>filter>redirect-policy>dest priority)

Full Context

configure filter redirect-policy destination priority

Description

Redirect policies can contain multiple destinations. Each destination is assigned an initial or base priority which describes its relative importance within the policy.

Default

priority 100

Parameters

priority

Specifies the priority, expressed as a decimal integer, used to weigh the destination’s relative importance within the policy.

Values: 1 to 255

Platforms

All

priority

Syntax

priority {low | high}

no priority [{low | high}]

Context

[Tree] (config>router>static-route-entry>indirect>forwarding-class priority)

[Tree] (config>router>static-route-entry>next-hop>forwarding-class priority)

Full Context

configure router static-route-entry indirect forwarding-class priority

configure router static-route-entry next-hop forwarding-class priority

Description

This optional command associates an enqueuing priority with the static route. The options are either high or low, with low being the default. This parameter has the ability to affect the likelihood that a packet will be enqueued at SAP ingress in the face of ingress congestion.

Once a packet is enqueued into an ingress buffer, the significance of this parameter is lost.

Default

priority low

Parameters

low: Setting the enqueuing parameter for a packet to low decreases the likelihood of enqueuing the packet when the ingress queue is congested. Ingress enqueuing priority only affects ingress SAP queuing. Once the packet is placed in a buffer on the ingress queue, the significance of the enqueuing priority is lost.

high: Setting the enqueuing parameter for a packet to high increases the likelihood of enqueuing the packet when the ingress queue is congested. Ingress enqueuing priority only affects ingress SAP queuing. Once the packet is placed in a buffer on the ingress queue, the significance of the enqueuing priority is lost.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority priority

no priority

Context

[Tree] (config>router>if>eth-cfm>mep>grace>eth-ed priority)

Full Context

configure router interface eth-cfm mep grace eth-ed priority

Description

This command sets the priority bits and determines the forwarding class based on the mapping of priority to FC.

The no form of this command disables the local priority configuration and sets the priority to the ccm-ltm-priority associated with this MEP.

Default

no priority

Parameters

priority

Specifies the priority bit.

Values: 0 to 7

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority

Syntax

priority priority

no priority

Context

[Tree] (config>router>fad>flex-algo priority)

Full Context

configure router flexible-algorithm-definitions flex-algo priority

Description

This command configures the priority of the FAD. This priority is used as a tie-breaker when the router has received multiple FADs for the same flexible algorithm.

Every router that is configured to participate in a particular flexible algorithm uses the same tie-breaker logic to select the winning FAD. This allows for consistent FAD definition selection in cases where routers advertise different definitions for a specific flexible algorithm. The following rules apply to the breaker mechanism.

From the advertisements of the FAD in the area (including both locally generated advertisements and received advertisements), select the one with the highest priority value.
If there are multiple advertisements of the FAD with the same highest priority, select the one that is originated from the router with either the highest system ID or router ID.

The no form of this command sets the priority to the default value.

Default

priority 100

Parameters

priority

Configures the priority of this FAD.

Values: 0 to 255

Default: 100

Platforms

All

priority

Syntax

priority priority

no priority

Context

[Tree] (config>router>if>vrrp priority)

[Tree] (config>router>if>ipv6>vrrp priority)

Full Context

configure router interface vrrp priority

configure router interface ipv6 vrrp priority

Description

This command configures the base router priority for the virtual router instance used in the master election process.

The priority is the most important parameter set on a non-owner virtual router instance. The priority defines a virtual router’s selection order in the master election process. Together, the priority value and the preempt mode allow the virtual router with the best priority to become the master virtual router.

The base-priority is used to derive the in-use priority of the virtual router instance as modified by any optional VRRP priority control policy. VRRP priority control policies can be used to either override or adjust the base priority value depending on events or conditions within the chassis.

The priority command is only available in the non-owner vrrp nodal context. The priority of owner virtual router instances is permanently set to 255 and cannot be changed.

For non-owner virtual router instances, the default base priority value is 100.

The no form of the command reverts to the default value.

Default

priority 100

Parameters

priority

The base priority used by the virtual router instance expressed as a decimal integer. If no VRRP priority control policy is defined, the base-priority is the in-use priority for the virtual router instance.

Values: 1 to 254

Platforms

All

priority

Syntax

priority priority-level [{delta | explicit}]

no priority

Context

[Tree] (config>vrrp>policy>priority-event>lag-port-down>weight-down priority)

[Tree] (config>vrrp>policy>priority-event>port-down priority)

[Tree] (config>vrrp>policy>priority-event>route-unknown priority)

[Tree] (config>vrrp>policy>priority-event>lag-port-down>number-down priority)

[Tree] (config>vrrp>policy>priority-event>host-unreachable priority)

Full Context

configure vrrp policy priority-event lag-port-down weight-down priority

configure vrrp policy priority-event port-down priority

configure vrrp policy priority-event route-unknown priority

configure vrrp policy priority-event lag-port-down number-down priority

configure vrrp policy priority-event host-unreachable priority

Description

This command controls the effect the set event has on the virtual router instance in-use priority.

When the event is set, the priority-level is either subtracted from the base priority of each virtual router instance or it defines the explicit in-use priority value of the virtual router instance depending on whether the delta or explicit keywords are specified.

Multiple set events in the same policy have interaction constraints:

If any set events have an explicit priority value, all the delta priority values are ignored.
The set event with the lowest explicit priority value defines the in-use priority that are used by all virtual router instances associated with the policy.
If no set events have an explicit priority value, all the set events delta priority values are added and subtracted from the base priority value defined on each virtual router instance associated with the policy.
If the delta priorities sum exceeds the delta-in-use-limit parameter, then the delta-in-use-limit parameter is used as the value subtracted from the base priority value defined on each virtual router instance associated with the policy.

If the priority command is not configured on the priority event, the priority-value defaults to 0 and the qualifier keyword defaults to delta, therefore, there is no impact on the in-use priority.

The no form of the command configures the set event to subtract 0 from the base priority (no effect).

Default

no priority

Parameters

priority-level

The priority level adjustment value expressed as a decimal integer.

Values: 0 to 254

delta

Configures what effect the priority-level will have on the base priority value. The default base priority value is delta.

When delta is specified, the priority-level value is subtracted from the associated virtual router instance’s base priority when the event is set and no explicit events are set. The sum of the priority event priority-level values on all set delta priority events are subtracted from the virtual router base priority to derive the virtual router instance in-use priority value. If the delta priority event is cleared, the priority-level is no longer used in the in-use priority calculation.

explicit

Configures what effect the priority-level will have on the base priority value.

When explicit is specified, the priority-level value is used to override the base priority of the virtual router instance if the priority event is set and no other explicit priority event is set with a lower priority-level. The set explicit priority value with the lowest priority-level determines the actual in-use protocol value for all virtual router instances associated with the policy.

Platforms

All

priority

Syntax

priority priority-level explicit

no priority

Context

[Tree] (config>vrrp>policy>priority-event>mc-ipsec-non-forwarding priority)

Full Context

configure vrrp policy priority-event mc-ipsec-non-forwarding priority

Description

This command controls the effect the set event has on the virtual router instance in-use priority.

When the event is set, the priority-level is either subtracted from the base priority of each virtual router instance or it defines the explicit in-use priority value of the virtual router instance depending on whether the delta or explicit keywords are specified.

Multiple set events in the same policy have interaction constraints:

If any set events have an explicit priority value, all the delta priority values are ignored.
The set event with the lowest explicit priority value defines the in-use priority that are used by all virtual router instances associated with the policy.
If no set events have an explicit priority value, all the set events delta priority values are added and subtracted from the base priority value defined on each virtual router instance associated with the policy.
If the delta priorities sum exceeds the delta-in-use-limit parameter, then the delta-in-use-limit parameter is used as the value subtracted from the base priority value defined on each virtual router instance associated with the policy.

If the priority command is not configured on the priority event, the priority-value defaults to 0 and the qualifier keyword defaults to delta, therefore, there is no impact on the in-use priority.

The no form of the command configures the set event to subtract 0 from the base priority (no effect).

Default

no priority

Parameters

priority-level

The priority level adjustment value expressed as a decimal integer.

Values: 0 to 254

explicit: When explicit is specified, the priority-level value is used to override the base priority of the virtual router instance if the priority event is set and no other explicit priority event is set with a lower priority-level. The set explicit priority value with the lowest priority-level determines the actual in-use protocol value for all virtual router instances associated with the policy.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority

Syntax

priority bridge-priority

no priority

Context

[Tree] (config>service>pw-template>stp priority)

Full Context

configure service pw-template stp priority

Description

The bridge-priority command is used to populate the priority portion of the bridge ID field within outbound BPDUs (the most significant 4 bits of the bridge ID). It is also used as part of the decision process when determining the best BPDU between messages received and sent. All values will be truncated to multiples of 4096, conforming with IEEE 802.1t and 802.1D-2004.

The no form of this command returns the bridge priority to the default value.

Default

priority 4096

Parameters

bridge-priority

Specifies the bridge priority for the STP instance.

Values: Allowed values are integers in the range of 4096 to 65535 with 4096 being the highest priority. The actual bridge priority value stored/used is the number entered with the lowest 12 bits masked off which means the actual range of values is 4096 to 61440 in increments of 4096.

Platforms

All

priority

Syntax

priority number

no priority

Context

[Tree] (config>router>isis>if>level priority)

Full Context

configure router isis interface level priority

Description

This command configures the priority of the IS-IS router interface for designated router election on a multi-access network.

This priority is included in hello PDUs transmitted by the interface on a multi-access network. The router with the highest priority is the preferred designated router. The designated router is responsible for sending LSPs with regard to this network and the routers that are attached to it.

The no form of this command reverts to the default value.

Default

priority 64

Parameters

number

Specifies the priority for this interface at this level.

Values: 0 to 127

Platforms

All

priority

Syntax

priority number

no priority

Context

[Tree] (config>router>ospf>area>interface priority)

[Tree] (config>router>ospf3>area>interface priority)

Full Context

configure router ospf area interface priority

configure router ospf3 area interface priority

Description

This command configures the priority of the OSPF interface that is used in an election of the designated router on the subnet.

This parameter is only used if the interface is of type broadcast. The router with the highest priority interface becomes the designated router. A router with priority 0 is not eligible to be Designated Router or Backup Designated Router.

The no form of this command reverts the interface priority to the default value.

Default

priority 1

Parameters

number

Specifies the interface priority expressed as a decimal integer. A value of 0 indicates the router is not eligible to be the Designated Router or Backup Designated Router on the interface subnet.

Values: 0 to 255

Platforms

All

priority

Syntax

priority [value]

no priority

Context

[Tree] (config>redundancy>multi-chassis>ipsec-domain priority)

Full Context

configure redundancy multi-chassis ipsec-domain priority

Description

This command configures the priority for the tunnel group in the IPsec domain. The node with the higher priority is more likely to be elected as active within the domain.

The no form of this command reverts to the default value.

Default

priority 100

Parameters

value: Specifies the IPsec domain tunnel group priority.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority-event

Syntax

[no] priority-event

Context

[Tree] (config>vrrp>policy priority-event)

Full Context

configure vrrp policy priority-event

Description

This command creates the context to configure VRRP priority control events used to define criteria to modify the VRRP in-use priority.

A priority control event specifies an object to monitor and the effect on the in-use priority level for an associated virtual router instance.

Up to 32 priority control events can be configured within the priority-event node.

The no form of the command clears any configured priority events.

Platforms

All

priority-marking

Syntax

priority-marking dscp dscp-name

priority-marking prec ip-prec-value

no priority-marking

Context

[Tree] (config>service>vpls>gsmp>group>neighbor priority-marking)

[Tree] (config>service>vprn>gsmp>group>neighbor priority-marking)

Full Context

configure service vpls gsmp group neighbor priority-marking

configure service vprn gsmp group neighbor priority-marking

Description

This command configures the type of priority marking to be used.

The no form of this command reverts to the default.

Parameters

dscp-name

Specifies the DSCP code-point to be used.

Values: be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23, cs3, cp25, af31, cp27, af32, cp29, af33, cp31, cs4, cp33, af41, cp35, af42, cp37, af43, cp39, cs5, cp41, cp42, cp43, cp44, cp45, ef, cp47, nc1, cp49, cp50, cp51, cp52, cp53, cp54, cp55, nc2, cp57, cp58, cp59, cp60, cp61, cp62, cp63

ip-prec-value

Specifies the precedence value to be used.

Values: 0 to 7

Platforms

All

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>subscr-mgmt>sub-prof>ingress>policer-control-policy priority-mbs-thresholds)

[Tree] (config>subscr-mgmt>sub-prof>egress>policer-control-policy priority-mbs-thresholds)

Full Context

configure subscriber-mgmt sub-profile ingress policer-control-policy priority-mbs-thresholds

configure subscriber-mgmt sub-profile egress policer-control-policy priority-mbs-thresholds

Description

The priority-mbs-thresholds command contains the root arbiter parent policer’s min-thresh-separation command and each priority level’s mbs-contribution command that is used to internally derive each priority level’s shared-portion and fair-portion values. The system uses each priority level’s shared-portion and fair-portion value to calculate each priority level’s discard-unfair and discard-all MBS thresholds that enforce priority sensitive rate-based discards within the root arbiter’s parent policer.

The priority-mbs-thresholds CLI node always exists and does not need to be created.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>card>fp>ingress>access>queue-group>policer-control-override priority-mbs-thresholds)

[Tree] (config>card>fp>ingress>network>queue-group>policer-control-override priority-mbs-thresholds)

Full Context

configure card fp ingress access queue-group policer-control-override priority-mbs-thresholds

configure card fp ingress network queue-group policer-control-override priority-mbs-thresholds

Description

This command contains the root arbiter parent policer’s min-thresh-separation command and each priority level’s mbs-contribution command that is used to internally derive each priority level’s shared-portion and fair-portion values. The system uses each priority level’s shared-portion and fair-portion value to calculate each priority level’s discard-unfair and discard-all MBS thresholds that enforce priority sensitive rate-based discards within the root arbiter’s parent policer.

The priority-mbs-thresholds CLI node always exists and does not need to be created.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>service>cpipe>sap>egress>policer-control-override priority-mbs-thresholds)

[Tree] (config>service>ipipe>sap>egress>policer-control-override priority-mbs-thresholds)

[Tree] (config>service>ipipe>sap>ingress>policer-control-override priority-mbs-thresholds)

[Tree] (config>service>epipe>sap>egress>policer-control-override priority-mbs-thresholds)

[Tree] (config>service>epipe>sap>ingress>policer-control-override priority-mbs-thresholds)

[Tree] (config>service>cpipe>sap>ingress>policer-control-override priority-mbs-thresholds)

Full Context

configure service cpipe sap egress policer-control-override priority-mbs-thresholds

configure service ipipe sap egress policer-control-override priority-mbs-thresholds

configure service ipipe sap ingress policer-control-override priority-mbs-thresholds

configure service epipe sap egress policer-control-override priority-mbs-thresholds

configure service epipe sap ingress policer-control-override priority-mbs-thresholds

configure service cpipe sap ingress policer-control-override priority-mbs-thresholds

Description

This command overrides the CLI node contains the configured min-thresh-separation and the various priority level mbs-contribution override commands.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS

configure service cpipe sap ingress policer-control-override priority-mbs-thresholds
configure service cpipe sap egress policer-control-override priority-mbs-thresholds

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

configure service ipipe sap egress policer-control-override priority-mbs-thresholds
configure service ipipe sap ingress policer-control-override priority-mbs-thresholds
configure service epipe sap ingress policer-control-override priority-mbs-thresholds
configure service epipe sap egress policer-control-override priority-mbs-thresholds

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>service>vpls>sap>egress>policer-ctrl-over priority-mbs-thresholds)

[Tree] (config>service>vpls>sap>ingress>policer-ctrl-over priority-mbs-thresholds)

Full Context

configure service vpls sap egress policer-control-override priority-mbs-thresholds

configure service vpls sap ingress policer-control-override priority-mbs-thresholds

Description

This command overrides the CLI node contains the configured min-thresh-separation and the various priority level mbs-contribution override commands.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>service>ies>if>sap>egress>policer-ctrl-over priority-mbs-thresholds)

[Tree] (config>service>ies>if>sap>ingress>policer-ctrl-over priority-mbs-thresholds)

Full Context

configure service ies interface sap egress policer-control-override priority-mbs-thresholds

configure service ies interface sap ingress policer-control-override priority-mbs-thresholds

Description

This command overrides the CLI node contains the configured min-thresh-separation and the various priority level mbs-contribution override commands.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>service>vprn>if>sap>ingress>policer-ctrl-over priority-mbs-thresholds)

[Tree] (config>service>vprn>if>sap>egress>policer-ctrl-over priority-mbs-thresholds)

Full Context

configure service vprn interface sap ingress policer-control-override priority-mbs-thresholds

configure service vprn interface sap egress policer-control-override priority-mbs-thresholds

Description

This command overrides the CLI node contains the configured min-thresh-separation and the various priority level mbs-contribution override commands.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority-mbs-thresholds

Syntax

priority-mbs-thresholds

Context

[Tree] (config>qos>plcr-ctrl-plcy>root priority-mbs-thresholds)

Full Context

configure qos policer-control-policy root priority-mbs-thresholds

Description

The priority-mbs-thresholds command contains the root arbiter parent policer’s min-thresh-separation command and each priority level’s mbs-contribution command that is used to internally derive each priority level’s shared-portion and fair-portion values. The system uses each priority level’s shared-portion and fair-portion value to calculate each priority level’s discard-unfair and discard-all MBS thresholds that enforce priority-sensitive rate-based discards within the root arbiter’s parent policer.

The priority-mbs-thresholds CLI node always exists and does not need to be created.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

priority-sessions

Syntax

[no] priority-sessions

Context

[Tree] (config>service>nat>nat-policy priority-sessions)

[Tree] (config>service>nat>firewall-policy priority-sessions)

[Tree] (config>service>nat>up-nat-policy priority-sessions)

Full Context

configure service nat nat-policy priority-sessions

configure service nat firewall-policy priority-sessions

configure service nat up-nat-policy priority-sessions

Description

This command configures the prioritized sessions of this NAT or residential firewall policy.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure service nat up-nat-policy priority-sessions
configure service nat nat-policy priority-sessions

7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure service nat firewall-policy priority-sessions

priority1

Syntax

priority1 priority-value

no priority1

Context

[Tree] (config>system>ptp priority1)

Full Context

configure system ptp priority1

Description

This command configures the priority1 value of the local clock. This parameter is only used when the profile is set to ieee1588-2008. This value is used by the Best Master Clock Algorithm to determine which clock should provide timing for the network.

This value is used for the value to advertise in the Announce messages and for the local clock value in data set comparisons.

The no form of the command reverts to the default configuration.

Default

priority1 128

Parameters

priority-value

Specifies the value of the priority1 field.

Values: 0 to 255

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority2

Syntax

priority2 priority-value

no priority2

Context

[Tree] (config>system>ptp priority2)

Full Context

configure system ptp priority2

Description

This command configures the priority2 value of the local clock. This parameter is only used when the profile is set to ieee1588-2008, g8275dot1-2014, or g8275dot2-2016. The parameter is ignored when any other profile is selected.

This value is used by the Best timeTransmitter Clock algorithm to determine which clock should provide timing for the network.

Note:

This value is used for the value to advertise in the Announce messages and for local clock value in data set comparisons.

The no form of the command reverts to the default configuration.

Default

priority2 128

Parameters

priority-value

Specifies the value of the priority2 field.

Values: 0 to 255

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priv-lvl

Syntax

priv-lvl priv-lvl user-profile-name

no priv-lvl priv-lvl

Context

[Tree] (config>system>security>tacplus>priv-lvl-map priv-lvl)

[Tree] (config>service>vprn>aaa>rmt-srv>tacplus>priv-lvl-map priv-lvl)

Full Context

configure system security tacplus priv-lvl-map priv-lvl

configure service vprn aaa remote-servers tacplus priv-lvl-map priv-lvl

Description

This command maps a specific TACACS+ priv-lvl to a locally configured profile for authorization. This mapping is used when the use-priv-lvl option is specified for TACPLUS authorization.

Parameters

priv-lvl

Specifies the privilege level used when sending a TACACS+ ENABLE request.

Values: 0 to 15

user-profile-name: Specifies the user profile for this mapping.

Platforms

All

priv-lvl-map

Syntax

[no] priv-lvl-map

Context

[Tree] (config>service>vprn>aaa>rmt-srv>tacplus priv-lvl-map)

[Tree] (config>system>security>tacplus priv-lvl-map)

Full Context

configure service vprn aaa remote-servers tacplus priv-lvl-map

configure system security tacplus priv-lvl-map

Description

Commands in this context specify a series of mappings between TACACS+ priv-lvl and locally configured profiles for authorization. These mappings are used when the use-priv-lvl option is specified for tacplus authorization.

The no form of this command reverts to the default.

Default

priv-lvl-map

Platforms

All

private-interface

Syntax

private-interface ip-int-name

no private-interface

Context

[Tree] (config>ipsec>client-db>client private-interface)

Full Context

configure ipsec client-db client private-interface

Description

This command specifies the private interface name that is used for tunnel setup.

The no form of this command reverts to the default.

Default

no private-interface

Parameters

ip-int-name: Specifies the name of the private interface.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

private-ki

Syntax

private-ki hex-string

no private-ki

Context

[Tree] (config>li>x-interfaces>lics>lic>authentication private-ki)

Full Context

configure li x-interfaces lics lic authentication private-ki

Description

This command configures the private key for the X1 and X2 interfaces.

The no form of this command reverts to the default.

Parameters

hex-string: Specifies the password. Must contain exactly 32 hex nibbles.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

private-retail-subnets

Syntax

[no] private-retail-subnets

Context

[Tree] (config>service>vprn>sub-if private-retail-subnets)

Full Context

configure service vprn subscriber-interface private-retail-subnets

Description

This command controls the export of retail subnets and prefixes to the wholesale forwarding service. When this attribute is configured, subnets and prefixes configured on the retail subscriber interface are no longer exported to the associated wholesale VPRN and remain private to the retail VPRN. This is useful in a IPoE or PPPoE business service context, as it allows retail services to use overlapping IP address spaces even if those services are associated with the same wholesale service. IPoE and PPPoE sessions are actually terminated in the retail service although their traffic transits on a SAP belonging to the wholesale service.

Configuring private retail subnets is not supported for IPv4 static hosts and ARP hosts. If PPPoE sessions need to coexist with IPv4 static hosts or ARP hosts, then this attribute should not be configured on the retail subscriber interface.

This command fails if the subscriber interface is not associated with a wholesale service.

If the retail VPRN is of the type hub, this attribute is mandatory. In this case, private retail subnets are enabled by default and cannot be unconfigured.

The no form of this command disables overlapping IP addresses between different retailers referring to this interface.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

private-service

Syntax

private-service service-id

private-service name service-name

no private-service

Context

[Tree] (config>ipsec>client-db>client private-service)

Full Context

configure ipsec client-db client private-service

Description

This command specifies the private service ID that is used for tunnel setup.

The no form of this command reverts to the default.

Default

no private-service

Parameters

service-id

Specifies the service ID of the tunnel delivery service.

This variant of this command is only supported in 'classic' configuration-mode (configure system management-interface configuration-mode classic). The private-service name service-name variant can be used in all configuration modes.

Values

{id | svc-name}


id:	1 to 2147483647
svc-name:	up to 64 characters (svc-name is an alias for input only. The svc-name gets replaced with an id automatically by SR OS in the configuration).

name service-name: Identifies the service, up to 64 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

private-tcp-mss-adjust

Syntax

private-tcp-mss-adjust octets

private-tcp-mss-adjust default

no private-tcp-mss-adjust

Context

[Tree] (config>service>vprn>l2tp>group>tunnel>l2tpv3 private-tcp-mss-adjust)

[Tree] (config>service>vprn>l2tp>group>l2tpv3 private-tcp-mss-adjust)

[Tree] (config>service>vprn>l2tp>l2tpv3 private-tcp-mss-adjust)

[Tree] (config>router>l2tp>group>l2tpv3 private-tcp-mss-adjust)

[Tree] (config>router>l2tp>group>tunnel>l2tpv3 private-tcp-mss-adjust)

Full Context

configure service vprn l2tp group tunnel l2tpv3 private-tcp-mss-adjust

configure service vprn l2tp group l2tpv3 private-tcp-mss-adjust

configure service vprn l2tp l2tpv3 private-tcp-mss-adjust

configure router l2tp group l2tpv3 private-tcp-mss-adjust

configure router l2tp group tunnel l2tpv3 private-tcp-mss-adjust

Description

This command enables TCP MSS adjust for L2TPv3 tunnels on the private side of the group or tunnel level. When this command is configured, the system updates the TCP MSS option value of the received TCP SYN packet on the private side.

Note that this command can be overridden by the corresponding configuration on the group or tunnel level.

With the default parameter, the system uses the upper-level configuration. With the non-default parameter, the system uses this configuration instead of the upper level configuration.

The no form of this command disables TCP MSS adjust on the private side.

Default

no private-tcp-mss-adjust

Parameters

octets

Specifies the new TCP MSS value in octets.

Values: 512 to 9000

default: Specifies to use the upper-level configuration

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

private-tcp-mss-adjust

Syntax

private-tcp-mss-adjust bytes

private-tcp-mss-adjust octets

no private-tcp-mss-adjust

Context

[Tree] (config>service>vprn>if>sap>ipsec-tun private-tcp-mss-adjust)

[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel private-tcp-mss-adjust)

[Tree] (config>ipsec>tnl-temp private-tcp-mss-adjust)

[Tree] (config>service>vprn>if>sap>ip-tunnel private-tcp-mss-adjust)

[Tree] (config>service>ies>if>ipsec>ipsec-tunnel private-tcp-mss-adjust)

[Tree] (config>router>if>ipsec>ipsec-tunnel private-tcp-mss-adjust)

[Tree] (config>service>ies>if>sap>ip-tunnel private-tcp-mss-adjust)

Full Context

configure service vprn interface sap ipsec-tunnel private-tcp-mss-adjust

configure service vprn interface ipsec ipsec-tunnel private-tcp-mss-adjust

configure ipsec tunnel-template private-tcp-mss-adjust

configure service vprn interface sap ip-tunnel private-tcp-mss-adjust

configure service ies interface ipsec ipsec-tunnel private-tcp-mss-adjust

configure router interface ipsec ipsec-tunnel private-tcp-mss-adjust

configure service ies interface sap ip-tunnel private-tcp-mss-adjust

Description

This command enables TCP MSS to adjust for L2TPv3 tunnels, IPsec, or IP tunnels on the private side. When the command is configured, the system updates the TCP MSS option to the value of the received TCP SYN packet on the private side.

The no form of this command disables TCP MSS adjust on the private side.

Default

no private-tcp-mcc-adjust

Parameters

bytes

Specifies the new TCP MSS value in bytes.

Values: 512 to 9000

octets

Specifies the new TCP MSS value in octets.

Values: 512 to 9000

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure ipsec tunnel-template private-tcp-mss-adjust
configure service ies interface sap ip-tunnel private-tcp-mss-adjust
configure service vprn interface sap ip-tunnel private-tcp-mss-adjust
configure service vprn interface sap ipsec-tunnel private-tcp-mss-adjust

VSR

configure router interface ipsec ipsec-tunnel private-tcp-mss-adjust
configure service vprn interface ipsec ipsec-tunnel private-tcp-mss-adjust
configure service ies interface ipsec ipsec-tunnel private-tcp-mss-adjust

probe-count

Syntax

probe-count probes-per-hop

no probe-count

Context

[Tree] (config>saa>test>type-multi-line>lsp-trace>sr-policy probe-count)

Full Context

configure saa test type-multi-line lsp-trace sr-policy probe-count

Description

This command configures the number of probes per hop.

The no form of this command reverts to the default value.

Default

probe-count 1

Parameters

probes-per-hop

Specifies the probes-per-hop count, expressed as number of packets.

Values: 1 to 10

Default: 1

Platforms

All

probe-fail-enable

Syntax

[no] probe-fail-enable

Context

[Tree] (config>saa>test>trap-gen probe-fail-enable)

Full Context

configure saa test trap-gen probe-fail-enable

Description

This command enables the generation of an SNMP trap when the consecutive probe failure threshold (configured using the probe-fail-threshold command) is reached during the execution of the SAA ping test. This command is not applicable to SAA trace route tests.

The no form of this command disables the generation of an SNMP trap.

Platforms

All

probe-fail-threshold

Syntax

probe-fail-threshold threshold

no probe-fail-threshold

Context

[Tree] (config>saa>test>trap-gen probe-fail-threshold)

Full Context

configure saa test trap-gen probe-fail-threshold

Description

This command configures the threshold for trap generation after ping probe failure.

This command has no effect when probe-fail-enable is disabled. This command is not applicable to SAA trace route tests.

The no form of this command returns the threshold value to the default.

Default

probe-fail-threshold 1

Parameters

threshold

Specifies the number of consecutive ping probe failures required to generate a trap.

Values: 0 to 15

Platforms

All

probe-history

Syntax

probe-history {keep | drop | auto}

Context

[Tree] (config>saa>test probe-history)

Full Context

configure saa test probe-history

Description

Specifies history probe behavior. Defaults are associated with various configured parameters within the SAA test. Auto (keep) is used for test with probe counts of 100 or less, and intervals of 1 second and above. Auto (drop) only maintains summary information for tests marked as continuous with file functions, probe counts more than 100 and intervals of less than 1 second. SAA tests that are not continuous with a write to file defaults to Auto (keep). The operator is free to change the default behaviors for each type. Each test that maintains per probe history consumes more system memory. When per probe entries are required, the probe history is available at the completion of the test.

Default

probe-history auto

Parameters

auto: An auto selector that determines the storage of the history information.

drop: Stores summarized min/max/avg data not per probe information for test runs. This may be configured for all tests to conserve memory.

keep: Stores per probe information for tests. This consumes significantly more memory than summary information and should only be used if necessary.

Platforms

All

process-arp-probes

Syntax

[no] process-arp-probes

Context

[Tree] (config>service>vpls>proxy-arp process-arp-probes)

Full Context

configure service vpls proxy-arp process-arp-probes

Description

This command enables router proxy ARP function replies to Duplicate Address Detection (DAD) ARP probes upon a successful proxy ARP table lookup.

The no form of this command disables the router from replying to DAD ARP probes.

Default

process-arp-probes

Platforms

All

process-cpm-traffic-on-sap-down

Syntax

[no] process-cpm-traffic-on-sap-down

Context

[Tree] (config>service>vpls>sap process-cpm-traffic-on-sap-down)

Full Context

configure service vpls sap process-cpm-traffic-on-sap-down

Description

This command is applicable to simple SAPs configured on LAGs that are not part of any "endpoint” configurations or complicated resiliency schemes like MC-LAG with inter-chassis-backup (ICB) configurations. When configured, a simple LAG SAP is not removed from the forwarding plane and flooded traffic (unknown unicast, broadcast and multicast) is dropped on egress. This allows applicable control traffic that is extracted at the egress interface to be processed by the CPM. This command will not prevent a VPLS service from entering an operationally down state if it is the last active connection to enter a nonoperational state. By default, without this command, when a SAP on a LAG enters a nonoperational state, it is removed from the forwarding plane and no forwarding occurs to the egress.

The no form of this command removes a SAP over a LAG that is not operational from the forwarding process.

Default

no process-cpm-traffic-on-sap-down

Platforms

All

process-dad-neighbor-solicitations

Syntax

[no] process-dad-neighbor-solicitations

Context

[Tree] (config>service>vpls>proxy-nd process-dad-neighbor-solicitations)

Full Context

configure service vpls proxy-nd process-dad-neighbor-solicitations

Description

This command enables the router proxy ND replies to Duplicate Address Detection (DAD) neighbor solicitations upon a successful proxy ND table lookup.

The no form of this command disables the router from replying to DAD neighbor solicitations.

Default

process-dad-neighbor-solicitations

Platforms

All

process-received-upa

Syntax

[no] process-received-upa

Context

[Tree] (config>router>isis>upa process-received-upa)

Full Context

configure router isis prefix-unreachable process-received-upa

Description

This command enables processing of UPAs received from other routers. When configured, received UPAs are inserted into the unicast routing table as unreachable prefixes. When configured on an Area Boundary Router (ABR), received UPAs are inserted into the unreachable prefix table and redistributed into the other areas.

The no form of this command disables the processing of UPAs received from other routers. When disabled, received UPAs are ignored by the router.

Default

no process-received-upa

Platforms

All

profile

Syntax

profile profile-name [create]

no profile profile-name

Context

[Tree] (config>app-assure>group>url-filter>web-service profile)

Full Context

configure application-assurance group url-filter web-service profile

Description

This command configures the category profiles of the web service.

The no form of this command removes the category profiles configuration.

Parameters

profile-name: Specifies the name of the category profile, up to 256 characters.

create: Keyword that specifies to create a category profile.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

profile

Syntax

[no] profile user-profile-name

Context

[Tree] (config>system>security profile)

Full Context

configure system security profile

Description

This command creates a context to create user profiles for command authorization and other functions associated with a user.

Profiles can be used to deny or permit user access to entire command branches or to specific commands.

Once the profiles are created, the user command assigns users to one or more profiles. You can define up to 16 user profiles but a maximum of 8 profiles can be assigned to a user.

The no form of this command deletes a user profile.

Parameters

user-profile-name: Specifies the user profile name entered as a character string. The string is case sensitive and limited to 32 ASCII 7-bit printable characters with no spaces.

Platforms

All

profile

Syntax

profile {in | out}

no profile

Context

[Tree] (config>saa>test>type-multi-line>lsp-ping profile)

[Tree] (config>saa>test>type-multi-line>lsp-trace>sr-policy profile)

[Tree] (config>saa>test>type-multi-line>lsp-ping>sr-policy profile)

Full Context

configure saa test type-multi-line lsp-ping profile

configure saa test type-multi-line lsp-trace sr-policy profile

configure saa test type-multi-line lsp-ping sr-policy profile

Description

This command configures the profile state of the MPLS echo request packet.

The no form of this command reverts to the default value.

Default

profile out

Parameters

in: Specifies "in” as the profile state of the MPLS echo request packet.

out: Specifies "out” as the profile state of the MPLS echo request packet.

Platforms

All

profile

Syntax

profile {in | out}

no profile

Context

[Tree] (config>oam-pm>session>ip profile)

Full Context

configure oam-pm session ip profile

Description

This command defines whether the TWAMP Light PDU packet should be treated as in-profile or out-of-profile. The default has been selected because the forwarding class defaults to best effort.

The no form of this command restores the default value.

Default

profile out

Parameters

in: Specifies that the TWAMP Light PDU packet is sent as in-profile.

out: Specifies that the TWAMP Light PDU packet is sent as out-of-profile.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile

Syntax

profile {in | out}

no profile

Context

[Tree] (config>oam-pm>session>mpls profile)

Full Context

configure oam-pm session mpls profile

Description

This command defines whether the DM PDU packet should be treated as in profile or out-of-profile.

The no form of this command reverts the default value.

Default

profile out

Parameters

in: Marks the PDU in profile.

out

Marks the PDU out of profile.

Default: out

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile

Syntax

profile {in | out}

no profile

Context

[Tree] (config>qos>sap-ingress>fc profile)

Full Context

configure qos sap-ingress fc profile

Description

This command places a forwarding class or subclass into a color aware profile mode. Normally, packets associated with a class are considered in-profile or out-of-profile solely based on the dynamic rate of the ingress queue relative to its CIR. Explicitly defining a class as in-profile or out-of-profile overrides this function by handling each packet with the defined profile state.

The profile command may only be executed when the forwarding class or the parent forwarding class (for a subclass) is mapped to a queue that has been enabled to support color aware profile packets. The queue may only be configured for profile-mode at the time the queue is created in the SAP ingress QoS policy.

A queue operating in profile-mode may support in-profile, out-of-profile, and non-profiled packets simultaneously. However, the high- and low-priority classification actions are ignored when the queue is in profile-mode.

The no form of this command removes an explicit in-profile or out-of-profile configuration on a forwarding class or subclass.

Default

no profile — The default profile state of a forwarding class or subclass is not to treat ingress packets as color aware. An explicit definition for in-profile or out-of-profile must be specified on the forwarding class or subclass.

Parameters

in: The in keyword is mutually exclusive to the out keyword. When the profile in command is executed, all packets associated with the class will be handled as in-profile. Packets explicitly handled as in-profile or out-of-profile still flow through the ingress service queue associated with the class to preserve order within flows. In-profile packets will count against the CIR of the queue, diminishing the amount of CIR available to other classes using the queue that are not configured with an explicit profile.

out: The out keyword is mutually exclusive to the in keyword. When the profile out command is executed, all packets associated with the class will be handled as out-of-profile. Packets explicitly handled as in-profile or out-of-profile still flow through the ingress service queue associated with the class to preserve order within flows. Out-of-profile packets will not count against the CIR of the queue, allowing other classes using the queue that are not configured with an explicit profile to be measured against the full CIR.

Platforms

All

profile

Syntax

profile {g8265dot1-2010 | ieee1588-2008 | g8275dot1-2014 | g8275dot2-2016}

Context

[Tree] (config>system>ptp profile)

Full Context

configure system ptp profile

Description

This command configures the profile for the internal PTP clock, which defines the Best timeTransmitter Clock Algorithm (BTCA) behavior.

The profile setting for the clock cannot be changed unless PTP is shutdown.

The clock-type is restricted based on the PTP profile setting.

If the profile is ieee1588-2008, the clock-type is not restricted.
If the profile is g8265dot1-2010, the clock type may only be ordinary slave or ordinary master; boundary clock is not allowed.
If the profile is g8275dot1-2014 or g8275dot2-2016, the clock-type may only be boundary clock or ordinary slave; ordinary master is not allowed.

When the profile is changed, the domain changes to the default value for the new profile. Any command parameters that are set to default for the original profile are changed to the default for the new profile. This applies to the following:

log-anno-interval set for the clock
log-sync-interval set for a peer or a port
log-delay-interval set for a port

Non-default parameter values for the original profile remain unchanged.

Default

profile g8265dot1-2010

Parameters

g8265dot1-2010: Conforms to the ITU-T G.8265.1 specification.

ieee1588-2008: Conforms to the 2008 version of the IEEE1588 standard.

g8275dot1-2014: Conforms to the ITU-T G.8275.1 specification.

g8275dot2-2016: Conforms to the ITU-T G.8275.2 specification.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile

Syntax

profile {g8265dot1-2010 | g8275dot1-2014 | g8275dot2-2016 | ieee1588-2008}

Context

[Tree] (config>system>ptp>alternate-profile profile)

Full Context

configure system ptp alternate-profile profile

Description

This command configures the standard profile that is used as the basis for the alternate profile.

The profile setting controls the content of PTP messages sent on ports and peers using this alternate profile.

Modification of this setting is allowed only when the alternate profile is shut down.

Default

profile g8275dot1-2014

Parameters

g8265dot1-2010: Keyword to conform to the ITU-T G.8265.1 specification.

g8275dot1-2014: Keyword to conform to the ITU-T G.8275.1 specification.

g8275dot2-2016: Keyword to conform to the ITU-T G.8275.2 specification.

ieee1588-2008: Keyword to conform to the 2008 version of the IEEE1588 standard.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile

Syntax

profile name [create]

no profile name

Context

[Tree] (config>system>network-element-discovery profile)

Full Context

configure system network-element-discovery profile

Description

This command configures a profile to be used by IGP to advertise the network element information to its neighbors.

The no form of this command deletes the specified profile.

Parameters

name: Specifies the name of the profile, up to 32 characters.

Platforms

All

profile

Syntax

profile user-profile-name

no profile

Context

[Tree] (config>system>security>user-template profile)

Full Context

configure system security user-template profile

Description

This command configures the command authorization profile to associate with a user template. See the user-template command for more details.

Parameters

user-profile-name: The user profile name entered as a character string. The string is case sensitive and limited to 32 ASCII 7-bit printable characters with no spaces.

Platforms

All

profile

Syntax

profile quality-of-service-profile

Context

[Tree] (config>test-oam>link-meas>template>twl profile)

Full Context

configure test-oam link-measurement measurement-template twamp-light profile

Description

This command configures the QoS profile. The profile indicator determines if the packet is treated as in or out of profile as it moves through the local node.

Default

profile in

Parameters

quality-of-service-profile

Specifies the QoS profile used when launching the link measurement test belonging to the specified template.

Values: in, out

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile

Syntax

profile cert-update-profile

Context

[Tree] (config>system>security>pki>cert-auto-upd>cert profile)

Full Context

configure system security pki certificate-auto-update cert profile

Description

This command configures a certificate-update-profile to reference the update behavior.

Parameters

cert-update-profile: Specifies the certificate profile name, up to 32 characters.

Platforms

All

profile

Syntax

profile quality-of-service-profile

Context

[Tree] (config>test-oam>lag-meas>template>twl profile)

Full Context

configure test-oam lag-ip-measurement lag-ip-measurement-template twamp-light profile

Description

This command configures the QoS profile used to launch each TWAMP Light packet.

Default

profile in

Parameters

quality-of-service-profile

Specifies the QoS profile.

Values: in, out

Default: in

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile-capped

Syntax

[no] profile-capped

Context

[Tree] (config>qos>qgrps>egr>queue-group profile-capped)

[Tree] (config>qos>sap-ingress>policer profile-capped)

[Tree] (config>qos>qgrps>ingress>queue-group profile-capped)

[Tree] (config>qos>sap-egress>policer profile-capped)

Full Context

configure qos queue-group-templates egress queue-group profile-capped

configure qos sap-ingress policer profile-capped

configure qos queue-group-templates ingress queue-group profile-capped

configure qos sap-egress policer profile-capped

Description

Profile-capped mode enforces an overall in-profile burst limit to the CIR bucket for ingress undefined, ingress explicit in-profile, egress soft-in-profile, and egress explicit in-profile packets. The default behavior when profile-capped mode is not enabled is to ignore the CIR output state when an explicit in-profile packet is handled by an ingress or egress policer.

The profile-capped mode makes two changes:

At egress, soft-in-profile packets (packets received from ingress as in-profile) are treated the same as explicit in-profile (unless explicitly reclassified as out-of-profile) and have an initial policer state of in-profile.
At both ingress and egress, any packet output from the policer with a non-conforming CIR state are treated as out-of-profile (out-of-profile state is ignored for initial in-profile packets when profile-capped mode is not enabled).

Default

no profile-capped

Platforms

All

configure qos queue-group-templates egress queue-group profile-capped
configure qos queue-group-templates ingress queue-group profile-capped

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

configure qos sap-egress policer profile-capped
configure qos sap-ingress policer profile-capped

profile-capped

Syntax

[no] profile-capped

Context

[Tree] (config>qos>qgrps>egr>qgrp>policer profile-capped)

[Tree] (config>qos>qgrps>ing>qgrp>policer profile-capped)

Full Context

configure qos queue-group-templates egress queue-group policer profile-capped

configure qos queue-group-templates ingress queue-group policer profile-capped

Description

This command enables a limit on the profile.

Default

no profile-capped

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

profile-out-preserve

Syntax

[no] profile-out-preserve

Context

[Tree] (config>qos>sap-egress>policer profile-out-preserve)

Full Context

configure qos sap-egress policer profile-out-preserve

Description

This command specifies whether to preserve the color of offered out-of-profile traffic at sap-egress policer (profile of the packet can change based on egress CIR state).

When enabled, traffic determined as out-of-profile at ingress policer will be treated as out-of-profile at sap-egress policer.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

profile-preferred

Syntax

profile-preferred

no profile-preferred

Context

[Tree] (config>qos>plcr-ctrl-plcy>root profile-preferred)

Full Context

configure qos policer-control-policy root profile-preferred

Description

The profile-preferred command ensures that the root policer provides a preference to consume its PIR bucket tokens at a given priority level to packets that have their profile state set to in-profile by the output of the child policer CIR bucket.

Default

no profile-preferred

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

profiled-traffic-only

Syntax

[no] profiled-traffic-only

Context

[Tree] (config>subscr-mgmt>msap-policy>sub-sla-mgmt>single-sub profiled-traffic-only)

Full Context

configure subscriber-mgmt msap-policy sub-sla-mgmt single-sub-parameters profiled-traffic-only

Description

This command specifies whether only profiled traffic is applicable for an MSAP. When enabled, all queues are deleted.

The no form of this command reverts to the default setting.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

profiled-traffic-only

Syntax

[no] profiled-traffic-only

Context

[Tree] (config>service>vprn>if>sap>sub-sla-mgmt>single-sub profiled-traffic-only)

[Tree] (config>service>ies>if>sap>sub-sla-mgmt>single-sub profiled-traffic-only)

[Tree] (config>service>vprn>sub-if>grp-if>sap>sub-sla-mgmt>single-sub profiled-traffic-only)

[Tree] (config>service>vpls>sap>sub-sla-mgmt>single-sub-parameters profiled-traffic-only)

[Tree] (config>service>ies>sub-if>grp-if>sap>sub-sla-mgmt>single-sub profiled-traffic-only)

Full Context

configure service vprn interface sap sub-sla-mgmt single-sub profiled-traffic-only

configure service ies interface sap sub-sla-mgmt single-sub profiled-traffic-only

configure service vprn subscriber-interface group-interface sap sub-sla-mgmt single-sub-parameters profiled-traffic-only

configure service vpls sap sub-sla-mgmt single-sub-parameters profiled-traffic-only

configure service ies subscriber-interface group-interface sap sub-sla-mgmt single-sub-parameters profiled-traffic-only

Description

This command specifies whether only profiled traffic is applicable for this SAP. The profiled traffic refers to single subscriber traffic on a dedicated SAP (in the VLAN-per-subscriber model). When enabled, subscriber queues are instantiated through the QOS policy defined in the sla-profile and the associated SAP queues are deleted. This can increase subscriber scaling by reducing the number of queues instantiated per subscriber (in the VLAN-per-subscriber model). In order for this to be achieved, any configured multi-sub-sap limit must be removed (leaving the default of 1).

The no form of this command disables the command.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

progress-indicator

Syntax

progress-indicator

Context

[Tree] (config>system>management-interface>cli>md-cli>environment progress-indicator)

Full Context

configure system management-interface cli md-cli environment progress-indicator

Description

Commands in this context configure progress indicator parameters.

Platforms

All

promiscuous-mode

Syntax

[no] promiscuous-mode

Context

[Tree] (config>service>vprn>sub-if>grp-if>wlan-gw promiscuous-mode)

[Tree] (config>service>ies>sub-if>grp-if>wlan-gw promiscuous-mode)

Full Context

configure service vprn subscriber-interface group-interface wlan-gw promiscuous-mode

configure service ies subscriber-interface group-interface wlan-gw promiscuous-mode

Description

When promiscuous mode is enabled, the router accepts all traffic, including traffic that is not destined for a WLAN gateway group interface MAC or virtual MAC address for ESM processing.

The no form of this command causes the router to only accept traffic that is destined for a WLAN gateway group interface MAC or virtual MAC address for ESM processing.

Default

no promiscuous-mode

Platforms

7750 SR, 7750 SR-e, 7750 SR-s, VSR

prompt

Syntax

prompt

Context

[Tree] (config>system>management-interface>cli>md-cli>environment prompt)

Full Context

configure system management-interface cli md-cli environment prompt

Description

Commands in this context configure prompt parameters.

Platforms

All

propagate-admin-group

Syntax

[no] propagate-admin-group

Context

[Tree] (config>router>mpls>lsp>fast-reroute propagate-admin-group)

[Tree] (config>router>mpls>lsp-template>fast-reroute propagate-admin-group)

Full Context

configure router mpls lsp fast-reroute propagate-admin-group

configure router mpls lsp-template fast-reroute propagate-admin-group

Description

The command enables the signaling of the primary LSP path admin-group constraints in the FRR object at the ingress.

When this command is executed, the admin-group constraints configured in the context of the P2P LSP primary path, or the ones configured in the context of the LSP and inherited by the primary path, are copied into the FAST_REROUTE object. The admin-group constraints are copied into the 'include-any’ or 'exclude-any’ fields.

The ingress LER thus propagates these constraints to the downstream nodes during the signaling of the LSP to allow them to include the admin-group constraints in the selection of the FRR backup LSP for protecting the LSP primary path.

The ingress LER inserts the FAST_REROUTE object by default in a primary LSP path message. If the user disables the object using the following command, the admin-group constraints will not be propagated: config>router>mpls>no frr-object.

Note that the same admin-group constraints can be copied into the Session Attribute object. They are intended for the use of an LSR, typically an ABR, to expand the ERO of an inter-area LSP path. They are also used by any LSR node in the path of a CSPF or non-CSPF LSP to check the admin-group constraints against the ERO regardless if the hop is strict or loose. These are governed strictly by the command:

config>router>mpls>lsp>propagate-admin-group

In other words, the user may decide to copy the primary path admin-group constraints into the FAST_REROUTE object only, or into the Session Attribute object only, or into both. Note, however, that the PLR rules for processing the admin-group constraints can make use of either of the two object admin-group constraints.

This feature is supported with the following LSP types and in both intra-area and inter-area TE where applicable:

Primary path of a RSVP P2P LSP.
S2L path of an RSVP P2MP LSP instance
LSP template for an S2L path of an RSVP P2MP LSP instance.

The no form of this command disables the signaling of administrative group constraints in the FRR object.

Default

no propagate-admin-group

Platforms

All

propagate-admin-group

Syntax

[no] propagate-admin-group

Context

[Tree] (config>router>mpls>lsp propagate-admin-group)

[Tree] (config>router>mpls>lsp-template propagate-admin-group)

Full Context

configure router mpls lsp propagate-admin-group

configure router mpls lsp-template propagate-admin-group

Description

This command enables propagation of session attribute object with resource affinity (C-type 1) in PATH message. If an LSR receives a session attribute with resource affinity, then it will check the compatibility of admin-groups received in PATH message against configured admin-groups on the egress interface of LSP.

To support admin-group for inter-area LSP, the ingress node must configure propagating admin-groups within the session attribute object. If a PATH message is received by an LSR node that has the cspf-on-loose-hop option enabled and the message includes admin-groups, then the ERO expansion by CSPF to calculate the path to the next loose hop includes the admin-group constraints received from ingress node.

If this option is disabled, then the session attribute object without resource affinity (C-Type 7) is propagated in PATH message and CSPF at the LSR node does not include admin-group constraints.

This admin group propagation is supported with a P2P LSP, a P2MP LSP instance, and an LSP template.

The user can change the value of the propagate-admin-group option on the fly. A RSVP P2P LSP performs a Make-Before-Break (MBB) on changing the configuration. A S2L path of an RSVP P2MP LSP performs a Break-Before-Make on changing the configuration.

The no form of this command reverts to the default value.

Default

no propagate-admin-group

Platforms

All

propagate-hold-time

Syntax

propagate-hold-time seconds

no propagate-hold-time

Context

[Tree] (config>eth-cfm>redundancy>mc-lag propagate-hold-time)

Full Context

configure eth-cfm redundancy mc-lag propagate-hold-time

Description

This command configures the delay, in seconds, that fault propagation is delayed because of port or MC-LAG state changes. This provides the amount of time for system stabilization during a port state changes that may be protected by MC-LAG. This command requires the standby-mep-shutdown command in order to take effect.

The no form of the command reverts to the default.

Default

propagate-hold-time 1

Parameters

seconds

Specifies the amount of time in seconds. Zero means no delay.

Values: 0 to 60

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

propagate-mac-flush

Syntax

[no] propagate-mac-flush

Context

[Tree] (config>service>vpls propagate-mac-flush)

Full Context

configure service vpls propagate-mac-flush

Description

This command enabled propagation of mac-flush messages received from the specified T-LDP on all spoke and mesh-SDPs within the context of the VPLS service. The propagation will follow split-horizon principles and any data-path blocking in order to avoid looping of these messages.

Default

no propagate-mac-flush

Platforms

All

propagate-mac-flush-from-bvpls

Syntax

[no] propagate-mac-flush-from-bvpls

Context

[Tree] (config>service>vpls>pbb propagate-mac-flush-from-bvpls)

Full Context

configure service vpls pbb propagate-mac-flush-from-bvpls

Description

This command enables the propagation in the local PBB of any regular LDP MAC Flush received in the related B-VPLS. If an LDP MAC flush-all-but-mine is received in the B-VPLS context, the command controls also whether a flush is performed for all the customer MACs in the associated FDB. The command does not have any effect on a PBB MAC Flush (LDP MAC flush with PBB TLV) received in the related B-VPLS context.

The no form of this command disables the propagation of LDP MAC Flush i from the related B-VPLS.

Default

no propagate-mac-flush-from-bvpls

Platforms

All

propagate-metric

Syntax

[no] propagate-metric

Context

[Tree] (config>service>vprn>rip propagate-metric)

Full Context

configure service vprn rip propagate-metric

Description

This command enables the BGP MED to be used to configure the RIP metric at the BGP to RIP transition on egress routers. BGP always configures the BGP MED to the RIP metric at the ingress router. When propagate-metric is configured, the RIP metric at egress routers is configured as the BGP MED attribute added to the optional value configured with the metric-out command.

The no version of this command sets the RIP metric to the optional value configured with the metric-out command plus 1.

Default

no propagate-metric

Platforms

All

propagate-pmtu-v4

Syntax

[no] propagate-pmtu-v4

Context

[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel propagate-pmtu-v4)

[Tree] (config>service>ies>if>sap>ip-tunnel propagate-pmtu-v4)

[Tree] (config>service>ies>if>ipsec>ipsec-tunnel propagate-pmtu-v4)

[Tree] (config>ipsec>tnl-temp propagate-pmtu-v4)

[Tree] (config>service>vprn>if>sap>ipsec-tunnel propagate-pmtu-v4)

[Tree] (config>service>vprn>if>sap>ip-tunnel propagate-pmtu-v4)

[Tree] (config>router>if>ipsec>ipsec-tunnel propagate-pmtu-v4)

Full Context

configure service vprn interface ipsec ipsec-tunnel propagate-pmtu-v4

configure service ies interface sap ip-tunnel propagate-pmtu-v4

configure service ies interface ipsec ipsec-tunnel propagate-pmtu-v4

configure ipsec tunnel-template propagate-pmtu-v4

configure service vprn interface sap ipsec-tunnel propagate-pmtu-v4

configure service vprn interface sap ip-tunnel propagate-pmtu-v4

configure router interface ipsec ipsec-tunnel propagate-pmtu-v4

Description

This command enables the system to propagate the path MTU learned from public side to private side (IPv4 hosts).

The no form of this command prevents the learned path MTU propagation.

Default

propagate-pmtu-v4

Platforms

VSR

configure service ies interface ipsec ipsec-tunnel propagate-pmtu-v4
configure service vprn interface ipsec ipsec-tunnel propagate-pmtu-v4
configure router interface ipsec ipsec-tunnel propagate-pmtu-v4

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure service vprn interface sap ip-tunnel propagate-pmtu-v4
configure service ies interface sap ip-tunnel propagate-pmtu-v4
configure ipsec tunnel-template propagate-pmtu-v4
configure service vprn interface sap ipsec-tunnel propagate-pmtu-v4

propagate-pmtu-v6

Syntax

[no] propagate-pmtu-v6

Context

[Tree] (config>service>vprn>if>sap>ip-tunnel propagate-pmtu-v6)

[Tree] (config>service>vprn>if>sap>ipsec-tunnel propagate-pmtu-v6)

[Tree] (config>service>ies>if>ipsec>ipsec-tunnel propagate-pmtu-v6)

[Tree] (config>ipsec>tnl-temp propagate-pmtu-v6)

[Tree] (config>router>if>ipsec>ipsec-tunnel propagate-pmtu-v6)

[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel propagate-pmtu-v6)

[Tree] (config>service>ies>if>sap>ip-tunnel propagate-pmtu-v6)

Full Context

configure service vprn interface sap ip-tunnel propagate-pmtu-v6

configure service vprn interface sap ipsec-tunnel propagate-pmtu-v6

configure service ies interface ipsec ipsec-tunnel propagate-pmtu-v6

configure ipsec tunnel-template propagate-pmtu-v6

configure router interface ipsec ipsec-tunnel propagate-pmtu-v6

configure service vprn interface ipsec ipsec-tunnel propagate-pmtu-v6

configure service ies interface sap ip-tunnel propagate-pmtu-v6

Description

This command enables the system to propagate the path MTU learned from public side to private side (IPv6 hosts).

The no form of this command prevents the learned path MTU propagation.

Default

propagate-pmtu-v6

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure ipsec tunnel-template propagate-pmtu-v6
configure service vprn interface sap ipsec-tunnel propagate-pmtu-v6
configure service vprn interface sap ip-tunnel propagate-pmtu-v6
configure service ies interface sap ip-tunnel propagate-pmtu-v6

VSR

configure service vprn interface ipsec ipsec-tunnel propagate-pmtu-v6
configure service ies interface ipsec ipsec-tunnel propagate-pmtu-v6
configure router interface ipsec ipsec-tunnel propagate-pmtu-v6

propagate-topology-change

Syntax

[no] propagate-topology-change

Context

[Tree] (config>eth-ring>sub-ring>interconnect propagate-topology-change)

Full Context

configure eth-ring sub-ring interconnect propagate-topology-change

Description

This command configures the G.8032 sub-ring to propagate topology changes. From the sub-ring to the major ring as specified in the G.8032 interconnection flush logic. This command is only valid on the sub-ring and on the interconnection node. Since this command is only valid on a Sub-ring, a virtual link or non-virtual link must be specified to configure this command. The command is blocked on major rings (when both path a and b are specified on a ring).

The no form of this command reverts propagate to the default value.

Default

no propagate-topology-change

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

protect-circuit

Syntax

protect-circuit port-id

no protect-circuit

Context

[Tree] (config>port>aps protect-circuit)

Full Context

configure port aps protect-circuit

Description

This command configures a physical port that will act as the protection circuit for this APS group. The protect circuit port must contain only the default configuration and cannot belong to another APS group. The protect circuit port must be of the same type as the working circuit for the APS group, for the port to be added to an APS group port. If that’s not the case, the command will return an error.

A protection circuit can only be added if the working circuit already exists; the protection circuit must be removed from the configuration before the working circuit is removed.

When a port is a protect-circuit of an APS group, the configuration options available in the config>port port-id>sonet-sdh context is not allowed for that port unless it is part of the noted exceptions. The exception list includes these SONET/SDH commands:

clock-source
[no] loopback
[no] report-alarm
section-trace
[no] threshold

When is port configured as a protection circuit of an APS group, the configurations described above and all service configurations related to APS port are operationally inherited by the protect circuit. If the protect circuit cannot inherit the configurations (due to resource limitations), the configuration attempt fails and an error is returned to the user.

The protect circuit must be shutdown before it can be removed from the APS group port. The inherited configuration for the circuit and APS operational commands for that circuit are not preserved when the circuit is removed from the APS group.

The no form of this command removes the protect-circuit.

Parameters

port-id

Specifies the physical port that will act as the protection circuit for this APS group in the following format.


port-id	slot/mda/port
	eth-sat-id	esat-id/slot/port
		esat	keyword
		id	1 to 20
	pxc-id	pxc-id.sub-port
		pxc	keyword
		id	1 to 64
		sub-port	a, b

Refer to "Modifying Hold-Down Timer Values” in the config>port>aps working-circuit command description for information about modifying the timer defaults in the event of communication delays between the APS controllers.

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-a, 7750 SR-e

protect-nexthop-id

Syntax

protect-nexthop-id next-hop-index

no protect-nexthop-id

Context

[Tree] (config>router>p2mp-sr-tree>replication-segment>sr-mpls>downstream-nodes protect-nexthop-id)

Full Context

configure router p2mp-sr-tree replication-segment segment-routing-mpls downstream-nodes protect-nexthop-id

Description

This command provides the ID of the protection next hop used for FRR.

The protection next hop outgoing SID is pushed on top of the next hop SID list.

The no form of this command removes the protection next hop.

Default

no protect-nexthop-id

Parameters

next-hop-index

Specifies the ID of the protection next hop.

Values: 1 to 4096

Platforms

All

protect-tp-path

Syntax

[no] protect-tp-path

Context

[Tree] (config>router>mpls>lsp protect-tp-path)

Full Context

configure router mpls lsp protect-tp-path

Description

This command creates or edits the protect path for an MPLS-TP LSP. At least one working path must exist before a protect path can be created for an MPLS-TP LSP. If MPLS-TP linear protection is also configured, then this is the path that is used as the default protect path for the LSP. The protect path must be deleted before the working path. Only one protect path can be created for each MPLS-TP LSP.

The following commands are applicable to the working-tp-path: lsp-num, in-label, out-label, mep, shutdown.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

protection

Syntax

protection none

protection hmac-sha256 key key [hash | hash2 | custom]

no protection

Context

[Tree] (config>python>py-script protection)

Full Context

configure python python-script protection

Description

This command specifies the format of the Python script file(s) in this python-script. Unintentional changing of Python script file could be prevented by using protected format.

The no form of this command equals to protection none.

Parameters

none: Indicates the Python script is stored in plain text, without any mechanism in place to ensure the integrity nor the confidentiality of the content of the Python script.

hmac-sha256: Indicates the first line of the Python script must consist of the hash value obtained by hashing the rest of the Python script using the hmac-sha256 hashing algorithm.

key: The specified key along with original Python script file content are used to compute the hash. The computed hash will be compared to the hash in the Python script file. If there is no match, then system will fail to load the script.

hash: Specifies the key is entered in an encrypted form. If the hash or hash2 parameter is not used, the key is assumed to be in an unencrypted, clear text form. For security, all keys are stored in encrypted form in the configuration file with the hash or hash2 parameter specified.

hash2: Specifies the key is entered in a more complex encrypted form that involves more variables than the key value alone, meaning that the hash2 encrypted variable cannot be copied and pasted. If the hash or hash2 parameter is not used, the key is assumed to be in an unencrypted, clear text form. For security, all keys are stored in encrypted form in the configuration file with the hash or hash2 parameter specified.

custom: Specifies the key entered is a customized hashing scheme.

Platforms

All

protection

Syntax

protection protection

no protection

Context

[Tree] (config>router>segment-routing>srv6>inst>ms-loc>func>ua protection)

[Tree] (config>router>segment-routing>srv6>inst>loc>func>end-x protection)

Full Context

configure router segment-routing segment-routing-v6 base-routing-instance micro-segment-locator function ua protection

configure router segment-routing segment-routing-v6 base-routing-instance locator function end-x protection

Description

This command configures the protection type of the SID.

The no form of this command reverts to the default value of protected.

Default

protection protected

Parameters

protection

Specifies whether the adjacency SID is protected.

Values: protected, unprotected

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

protection-template

Syntax

protection-template name

no protection-template

Context

[Tree] (config>router>mpls>mpls-tp protection-template)

Full Context

configure router mpls mpls-tp protection-template

Description

Protection templates are used to define generally applicable protection parameters for MPLS-TP tunnels. Only linear protection is supported, and so the application of a named template to an MPLS-TP LSP implies that linear protection is used. A protection template is applied under the MEP context of the protect-path of an MPLS-TP LSP.

The protection-template command creates or edits a named protection template.

Default

no protection-template

Parameters

name: Specifies the protection template name as a text string of up to 32 characters in printable 7-bit ASCII, enclosed in double quotes.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

protection-template

Syntax

protection-template name

no protection-template

Context

[Tree] (config>router>mpls>lsp>protect-tp-path>mep protection-template)

Full Context

configure router mpls lsp protect-tp-path mep protection-template

Description

This command applies a protection template name to an MPLS-TP LSP that the protect path is configured under. If the template is applied, then MPLS-TP 1:1 linear protection is enabled on the LSP, using the parameters specified in the named template.

A named protection template can only be applied to the protect path context of an MPLS-TP LSP.

The no form of this command removes the template and thus disables mpls-tp linear protection on the LSP.

Default

no protection-template

Parameters

name: Specifies at text string for the template up to 32 characters in printable 7-bit ASCII, enclosed in double quotes.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

protection-type

Syntax

protection-type {g8031-1to1 | loadsharing}

Context

[Tree] (config>eth-tunnel protection-type)

Full Context

configure eth-tunnel protection-type

Description

This command configures the model used for determining which members are actively receiving and transmitting data.

When the value is set to "g8031-1to1 (1)”, as per the G.8031 specification, only two members are allowed, and only one of them can be active at one point in time.

When the value is set to "loadsharing (2)”, multiple members can be active at one point in time.

Default

protection-type g8031-1to1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

protection-type

Syntax

protection-type {link | node}

no protection-type

Context

[Tree] (config>router>route-next-hop-policy>template protection-type)

Full Context

configure router route-next-hop-policy template protection-type

Description

This command configures the protection type constraint into the route next-hop policy template.

The user can select if link protection or node protection is preferred in the selection of an LFA next-hop for all IP prefixes and LDP FEC prefixes to which a route next-hop policy template is applied. The default in SR OS implementation is node protection. The implementation will fall back to the other type if no LFA next-hop of the preferred type is found.

When the route next-hop policy template is applied to an IP interface, all prefixes using this interface as a primary next-hop will follow the protection type preference specified in the template.

The no form deletes the protection type constraint from the route next-hop policy template.

Default

protection-type node

Parameters

{link | node}

Specifies the two possible values for the protection type.

Default: node

Platforms

All

proto-version

Syntax

proto-version {v070 | latest}

Context

[Tree] (config>system>grpc>gnmi proto-version)

Full Context

configure system grpc gnmi proto-version

Description

This command sets the gnmi.proto version that the GRPC server should use for all gNMI RPCs.

Default

proto-version latest

Parameters

v070: Specifies to use v0.7.0 for gNMI RPCs. Only use this option for backward compatibility with legacy collectors.

latest: Specifies to use the latest gnmi.proto version for gNMI RPCs. The latest version is v0.8.0.

Platforms

All

protocol

Syntax

protocol protocol profile-name profile-name

Context

[Tree] (config>system>security>pki>cert-upd-prof protocol)

Full Context

configure system security pki certificate-update-profile protocol

Description

This command configures the protocol to update the certificate.

Default

protocol cmpv2

Parameters

protocol

Specifies the protocol type.

Values: cmpv2, est

profile-name

Specifies the name of the CA or EST profile to be used for the certificate update.

Platforms

All

protocol

Syntax

protocol protocol-id

no protocol

Context

[Tree] (config>subscr-mgmt>isa-svc-chain>vas-filter>entry>match protocol)

Full Context

configure subscriber-mgmt isa-service-chaining vas-filter entry match protocol

Description

This command configures the protocol ID to be matched in this entry of the VAS filter.

The no form of this command removes the protocol ID from the match criterium in the entry.

Parameters

protocol-id

Specifies the protocol to match.

Values

protocol-id: protocol-number | protocol-name

protocol-number: 1, 6, 17]D

[0x1,0x6,0x11]H [0b1,0b110,0b10001]B

protocol-name: none, icmp, tcp, udp

* udp/tcp wildcard

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

protocol protocol-name

Context

[Tree] (config>app-assure protocol)

Full Context

configure application-assurance protocol

Description

This command configures the shutdown of protocols system-wide.

Parameters

protocol-name: A string of up to 32 characters identifying a predefined protocol.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

protocol {eq | neq} protocol-name

no protocol

Context

[Tree] (config>app-assure>group>policy>app-filter>entry protocol)

Full Context

configure application-assurance group policy app-filter entry protocol

Description

This command configures protocol signature in the application definition.

The no form of this command restores the default (removes protocol from match application defined by this app-filter entry).

Default

no protocol

Parameters

eq: Specifies that the value configured and the value in the flow are equal.

neq: Specifies that the value configured differs from the value in the flow.

protocol-name: A string of up to 32 characters identifying a predefined protocol.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

protocol protocol-name export-using export-method

no protocol protocol-name

Context

[Tree] (config>app-assure>group>statistics>aa-sub protocol)

Full Context

configure application-assurance group statistics aa-sub protocol

Description

This command configures aa-sub accounting statistics for export of protocols of a given AA ISA group/partition.

The no form of this command removes the protocol name.

Parameters

protocol-name: Specifies an existing protocol name up to 32 characters in length.

export-using export-method: Specifies that the method of stats export to be used. Accounting-policy is the only option for protocol statistics.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

protocol

Context

[Tree] (config>app-assure>group>statistics protocol)

Full Context

configure application-assurance group statistics protocol

Description

Commands in this context configure accounting and statistics collection parameters per-system for protocols of application assurance for a given AA ISA group/partition.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

protocol ipsec-protocol

no protocol

Context

[Tree] (config>ipsec>static-sa protocol)

Full Context

configure ipsec static-sa protocol

Description

This command configures the security protocol to use for an IPsec manual SA. The no statement resets to the default value.

Default

protocol esp

Parameters

ipsec-protocol

Identifies the IPsec protocol used with this static SA.

Values: ah — Specifies the Authentication Header protocol.esp — Specifies the Encapsulation Security Payload protocol.

Platforms

All

protocol

Syntax

protocol any

protocol protocol-id port opaque

protocol protocol-id port any

protocol protocol-id port from begin-port-id to end-port-id

no protocol

Context

[Tree] (config>ipsec>ts-list>local>entry protocol)

[Tree] (config>ipsec>ts-list>remote>entry protocol)

Full Context

configure ipsec ts-list local entry protocol

configure ipsec ts-list remote entry protocol

Description

This command specifies the protocol and port range in the IKEv2 traffic selector.

The SR OS supports OPAQUE ports and port ranges for the following protocols:

TCP
UDP
SCTP
ICMP
ICMPv6
MIPv6

For ICMP and ICMPv6, the port value takes the form icmp-type/icmp-code. For MIPv6, the port value is the mobility header type. For other protocols, only the port any configuration can be used.

Default

no protocol

Parameters

protocol-id: Specifies the protocol ID. The value can be a number, a protocol name, or any.

begin-port-id

Specifies the beginning of the port range.

Values

For TCP, UDP, and SCTP, the value is the port number.

For ICMP and ICMPv6, the value takes the form icmp-type/icmp-code; for example, 0/0.

For MIPv6, the value is the mobility header type.

end-port-id

Specifies the end of the port range

Values

For TCP, UDP, and SCTP, the value is the port number.

For ICMP and ICMPv6, the value takes the form icmp-type/icmp-code; for example, 0/0.

For MIPv6, the value is the mobility header type.

opaque: Specifies OPAQUE ports.

any: Specifies any port.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

[no] protocol {number | any}

Context

[Tree] (config>service>nat>firewall-policy>unknown-protocols protocol)

Full Context

configure service nat firewall-policy unknown-protocols protocol

Description

This command configures the protocol numbers that are allowed to create unknown flows.

Protocol or IPv6 extension header values that are explicitly supported by SR OS can be configured but will not be treated as unknown protocols.

The no form of the command removes the allowance for the specified protocol to create unknown flows.

Parameters

any: Specifies that unknown flows can be created by any protocol.

number

Specifies the IANA number of a protocol that needs to be allowed to create unknown flows.

Values: 0 to 255

Platforms

7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol

Syntax

[no] protocol protocol-id

Context

[Tree] (config>filter>match-list>protocol-list protocol)

Full Context

configure filter match-list protocol-list protocol

Description

This command adds a protocol to the match protocol list.

The no form of this command removes the protocol from the protocol-list.

Parameters

protocol-id: protocol-number, protocol-name

protocol-number

Specifies the protocol number value to be added or removed from the protocol list. The value can be expressed as a decimal integer, or in hexadecimal or binary format.

Values

[0 to 255]D

[0x0 to 0xFF]H

[0b0 to 0b11111111]B

protocol-name

Specifies the protocol name to be added or removed from the protocol list.

Values: icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp.

Platforms

All

protocol

Syntax

protocol protocol

no protocol [protocol]

Context

[Tree] (config>vrrp>policy>priority-event>route-unknown protocol)

Full Context

configure vrrp policy priority-event route-unknown protocol

Description

This command adds one or more route sources to match the route unknown IP route prefix for a route unknown priority control event.

If the route source does not match one of the defined protocols, the match is considered unsuccessful and the route-unknown event transitions to the set state.

The protocol command is optional. If the protocol command is not executed, the comparison between the RTM prefix return and the route-unknown IP route prefix will not include the source of the prefix. The protocol command cannot be executed without at least one associated route source parameter. All parameters are reset each time the protocol command is executed and only the explicitly defined protocols are allowed to match.

The no form of the command removes protocol route source as a match criteria for returned RTM route prefixes.

To remove specific existing route source match criteria, execute the protocol command and include only the specific route source criteria. Any unspecified route source criteria is removed.

Default

no protocol — No route source for the route unknown priority event is defined.

Parameters

protocol

Explicitly defined protocols

Values

bgp - This parameter defines BGP as an eligible route source for a returned route prefix from the RTM when looking up the route-unknown route prefix. The bgp parameter is not exclusive from the other available protocol parameters. If protocol is executed without the bgp parameter, a returned route prefix with a source of BGP will not be considered a match and will cause the event to enter the set state. This parameter only applies to the 7750 SR and 7950 XRS.

bgp-vpn - This parameter defines bgp-vpn as an eligible route source for a returned route prefix from the RTM when looking up the route-unknown route prefix. The bgp-vpn parameter is not exclusive from the other available protocol parameters. If protocol is executed without the bgp-vpn parameter, a returned route prefix with a source of bgp-vpn will not be considered a match and will cause the event to enter the set state. This parameter only applies to the 7750 SR and 7950 XRS.

ospf - This parameter defines OSPF as an eligible route source for a returned route prefix from the RTM when looking up the route-unknown route prefix. The ospf parameter is not exclusive from the other available protocol parameters. If protocol is executed without the ospf parameter, a returned route prefix with a source of OSPF will not be considered a match and will cause the event to enter the set state.

is-is - This parameter defines IS-IS as an eligible route source for a returned route prefix from the RTM when looking up the route-unknown route prefix. The is-is parameter is not exclusive from the other available protocol parameters. If protocol is executed without the is-is parameter, a returned route prefix with a source of IS-IS will not be considered a match and will cause the event to enter the set state.

rip - This parameter defines RIP as an eligible route source for a returned route prefix from the RTM when looking up the route-unknown route prefix. The rip parameter is not exclusive from the other available protocol parameters. If protocol is executed without the rip parameter, a returned route prefix with a source of RIP will not be considered a match and will cause the event to enter the set state.

static - This parameter defines a static route as an eligible route source for a returned route prefix from the RTM when looking up the route-unknown route prefix. The static parameter is not exclusive from the other available protocol parameters. If protocol is executed without the static parameter, a returned route prefix with a source of static route will not be considered a match and will cause the event to enter the set state.

Platforms

All

protocol

Syntax

protocol protocol-id

no protocol

Context

[Tree] (config>system>security>mgmt-access-filter>ip-filter>entry protocol)

Full Context

configure system security management-access-filter ip-filter entry protocol

Description

This command configures an IP protocol type to be used as a management access filter match criterion.

The protocol type, such as TCP, UDP, and OSPF, is identified by its respective protocol number. Well-known protocol numbers include ICMP (1), TCP (6), and UDP (17).

The no form the command removes the protocol from the match criteria.

Parameters

protocol

Specifies the protocol number for the match criterion.

Values: 1 to 255 (decimal)

Platforms

All

protocol

Syntax

[no] protocol name [create]

Context

[Tree] (config>sys>security>dist-cpu-protection>policy protocol)

Full Context

configure system security dist-cpu-protection policy protocol

Description

This command creates the control protocol for the policy.

The no form of this command means packets of the specified protocol are not monitored or enforced (although they count in the FP protocol queue) on the objects to which this DCP policy is assigned. The packets are treated as part of the all-unspecified protocol if the protocol is created in the policy.

Parameters

names

Signifies the protocol name.

The following explanatory notes for specific protocols apply:

bfd-cpm - includes all BFD handled on the CPM, including the cpm-np type, single hop and multi hop, and MPLS-TP CC and CV BFD
dhcp - includes DHCP for IPv4 and IPv6
eth-cfm - 802.1ag and includes Y.1731. ETH-CFM packets on port and LAG-based facility MEPs are not included (but packets on tunnel MEPs are)
icmp - includes IPv4 and IPv6 ICMP (including RS/RA/Redirect), except NS/NA Neighbor Discovery packets that are classified as a separate NDIS protocol
icmp-ping-check - includes packets associated with ping-template functions
isis - includes IS-IS used for SPBM
ldp - includes LDP and T-LDP
mpls-ttl - includes MPLS packets that are extracted because of an expired MPLS-TTL field
ndis - includes IPv6 NS/NA Neighbor Discovery (not including RS/RA/Redirect which are classified as part of the ICMP protocol)
ospf - includes all OSPFv2 and OSPFv3 packets
pppoe-pppoa - includes PADx, LCP, PAP/CHAP, and NCPs
ssh - includes TCP port 22 or a user-configured SSH server port
vrrp - includes VRRP and SRRP packets
multi-chassis - includes SR OS Multi-Chassis UDP port 1025 packets
multi-chassis-sync - includes SR OS Multi-Chassis Sync TCP port 45067 packets
all-unspecified - a special aggregate entry for protocols that are not explicitly specified. When configured, this option treats all extracted control packets that are not explicitly configured in the DCP policy as a single aggregate flow (or virtual protocol). It lumps together remaining control traffic to allow it to be rate limited as one flow. It includes all control traffic of all protocols that are extracted and sent to the CPM (including protocols that cannot be explicitly configured with the distributed CPU protection feature). Control packets that are both forwarded and copied for extraction are not included. If a user later explicitly configures a protocol, that protocol is suddenly no longer part of the all-unspecified flow. This protocol must be explicitly configured to operate.

Values: all-unspecified, arp, bfd-cpm, bgp, dhcp, eth-cfm, http-redirect, icmp, icmp-ping-check, igmp, isis, ldp, mld, mpls-ttl, multi-chassis, multi-chassis-sync, ndis, ospf, pim, pppoe-pppoa, radius, rsvp, ssh, vrrp

create

Mandatory keyword to create the protocol.

Platforms

All

protocol

Syntax

protocol protocol [all | { instance instance}]

protocol protocol2 [protocol2 (up to 5 max)]

no protocol

Context

[Tree] (config>router>policy-options>policy-statement>entry>from protocol)

Full Context

configure router policy-options policy-statement entry from protocol

Description

This command configures a routing protocol as a match criterion for a route policy statement entry. This command is used for both import and export policies depending how it is used.

The protocol direct-interface route type matches the specific direct interface host IPv4 /32 and IPv6 /128 routes. The protocol direct route type matches direct routes and does not match the specific /32 or /128 interface route itself.

Note:

The instance command cannot be used if multiple protocol names are specified for the protocol2 parameter.

The no form of this command removes the protocol match criterion.

Default

no protocol

Parameters

protocol

Specifies the protocol name for the match criterion.

Values: direct, static, bgp, isis, ospf, rip, aggregate, bgp-vpn, igmp, pim, ospf3, ldp, sub-mgmt, mld, managed, vpn-leak, nat, periodic, ipsec, dhcpv6-pd, dhcpv6-na, dhcpv6-ta, dhcpv6-pd-excl, ripng, bgp-label, direct-interface, arp-nd, rib-api, evpn-ifl, evpn-iff, srv6

instance

Specifies the OSPF, OSPFv3, or IS-IS protocol instance.

Values

isis-inst — 0 to 127

ospf-inst — 0 to 31

ospf3-inst — 0 to 31, 64 to 95

protocol2

Specifies up to five protocol names to match on.

Values: direct, static, isis, aggregate, bgp, bgp-label, direct-interface

all: Keyword that specifies to match on any OSPF, OSPFv3, or IS-IS protocol instance.

Platforms

All

protocol

Syntax

protocol protocol [all | instance instance]

protocol bgp bgp-label

no protocol

Context

[Tree] (config>router>policy-options>policy-statement>entry>to protocol)

Full Context

configure router policy-options policy-statement entry to protocol

Description

This command configures a routing protocol as a match criterion for a route policy statement entry. This command is used for both import and export policies depending how it is used.

The no form of this command removes the protocol match criterion.

Default

no protocol

Parameters

protocol

Specifies the protocol name to match on.

Values: bgp, isis, ospf, rip, bgp-vpn, ospf3, vpn-leak, ldp, ripng, bgp-label

instance

Specifies the OSPF, OSPFv3, or IS-IS instance.

Values

isis-inst — 0 to 127

ospf-inst — 0 to 31

ospf3-inst — 0 to 31, 64 to 95

all: Keyword that specifies to match on any OSPF, OSPFv3, or IS-IS protocol instance.

Platforms

All

protocol

Syntax

protocol protocol

Context

[Tree] (config>anysec>tnl-enc>enc-grp>peer-tnl-attrs protocol)

Full Context

configure anysec tunnel-encryption encryption-group peer-tunnel-attributes protocol

Description

This command configures a routing protocol as a match criterion for the outgoing tunnel.

Note: Because the LSP is unidirectional, the incoming tunnel protocol may be different from the outgoing tunnel protocol.

Default

protocol sr-isis

Parameters

protocol

Specifies the protocol name.

Values: sr-isis, sr-ospf, sr-ospf3

Platforms

7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

protocol

Syntax

protocol protocol

Context

[Tree] (config>anysec>tnl-enc>sec-term-pol protocol)

Full Context

configure anysec tunnel-encryption security-termination-policy protocol

Description

This command configures a routing protocol that is used to advertise the node SID of the incoming tunnel.

Default

protocol sr-isis

Parameters

protocol

Specifies the protocol name to match on.

Values: sr-isis, sr-ospf, sr-ospf3

Platforms

7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

protocol-configuration-options

Syntax

protocol-configuration-options {apco | pco}

no protocol-configuration-options

Context

[Tree] (config>subscr-mgmt>gtp>peer-profile protocol-configuration-options)

Full Context

configure subscriber-mgmt gtp peer-profile protocol-configuration-options

Description

This command configures the Information Element to use for the Protocol Configuration Options.

The no form of this command reverts to the default value.

Default

protocol-configuration-options pco

Parameters

apco: Specifies that the system uses the Protocol Configuration Options Information Element.

pco: Specifies that the system uses the Additional Protocol Configuration Options Information Element.

Platforms

7750 SR, 7750 SR-e, 7750 SR-s, VSR

protocol-list

Syntax

protocol-list protocol-list-name [create]

no protocol-list protocol-list-name

Context

[Tree] (config>filter>match-list protocol-list)

Full Context

configure filter match-list protocol-list

Description

This command creates a list of IP protocols that can be used in line card IP and IPv6 filters.

The no form of this command removes the IP protocol list.

Default

no protocol-list

Parameters

protocol-list-name: Specifies the name of the protocol list.

create: This keyword is required to create the protocol list. After it is created, the protocol list can be enabled with or without the create keyword.

Platforms

All

protocol-port

Syntax

[no] protocol-port

Context

[Tree] (config>cflowd>collector>aggregation protocol-port)

Full Context

configure cflowd collector aggregation protocol-port

Description

This command specifies that flows be aggregated based on the IP protocol, source port number, and destination port number.

The no form of this command removes this type of aggregation from the collector configuration.

Platforms

All

protocol-protection

Syntax

protocol-protection [allow-sham-links] [block-pim-tunneled]

no protocol-protection

Context

[Tree] (config>sys>security>cpu-protection protocol-protection)

Full Context

configure system security cpu-protection protocol-protection

Description

This command causes the network processor on the CPM to discard all packets received for protocols that are not configured on the particular interface. This helps mitigate DoS attacks by filtering invalid control traffic before it hits the CPU. For example, if an interface does not have IS-IS configured, then protocol protection will discard any IS-IS packets received on that interface.

Default

no protocol-protection

Parameters

allow-sham-links: Allows sham links. As OSPF sham links form an adjacency over the MPLS-VPRN backbone network, when protocol-protection is enabled, the tunneled OSPF packets to be received over the backbone network must be explicitly allowed.

block-pim-tunneled: Blocks extraction and processing of PIM packets arriving at the SR OS node inside a tunnel (for example, MPLS or GRE) on a network interface. With protocol-protection enabled and tunneled pim blocked, PIM in an mVPN on the egress DR will not switch traffic from the (*,G) to the (S,G) tree.

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

protocol-version

Syntax

protocol-version TLS version

no protocol-version

Context

[Tree] (config>system>security>tls>client-tls-profile protocol-version)

Full Context

configure system security tls client-tls-profile protocol-version

Description

This command configures the TLS version to be negotiated between the client and server.

When configured, the client adds the specified version as a supported version in its Hello message to the server. If tls-version-all is specified, the client adds both TLS 1.2 and TLS 1.3 as supported versions in its Hello message.

The no form of this command reverts to the default TLS version.

Default

protocol-version tls-version12

Parameters

TLS version: Specifies the TLS version to include in the client Hello message.

Values: tls-version12, tls-version13, tls-version-all

Platforms

All

protocol-version

Syntax

protocol-version TLS version

no protocol-version

Context

[Tree] (config>system>security>tls>server-tls-profile protocol-version)

Full Context

configure system security tls server-tls-profile protocol-version

Description

This command configures the TLS version to be negotiated between the server and client.

When configured, the server adds the specified version as a supported version in its Hello message to the client. If tls-version-all is specified, the server adds both TLS 1.2 and TLS 1.3 as supported versions in its Hello message.

The no form of this command reverts to the default TLS version.

Default

protocol-version tls-version12

Parameters

TLS version: Specifies the TLS version to include in the server Hello message.

Values: tls-version12, tls-version13, tls-version-all

Platforms

All

provider-tunnel

Syntax

[no] provider-tunnel

Context

[Tree] (config>service>vpls provider-tunnel)

Full Context

configure service vpls provider-tunnel

Description

Commands in this context configure the use of a P2MP LSP to forward Broadcast, Unknown unicast, and Multicast (BUM) packets of a VPLS or B-VPLS instance. The P2MP LSP is referred to as the Provider Multicast Service Interface (PMSI).

Platforms

All

provider-tunnel

Syntax

provider-tunnel

Context

[Tree] (config>service>vprn>mvpn provider-tunnel)

Full Context

configure service vprn mvpn provider-tunnel

Description

This command enables context to configure tunnel parameters for the MVPN.

Platforms

All

provider-tunnel

Syntax

provider-tunnel

Context

[Tree] (config>router>gtm provider-tunnel)

Full Context

configure router gtm provider-tunnel

Description

This command enables context to configure tunnel parameters for the GTM.

Platforms

All

proxy-arp

Syntax

[no] proxy-arp

Context

[Tree] (config>service>vpls proxy-arp)

Full Context

configure service vpls proxy-arp

Description

Commands in this context configure the proxy-ARP parameters in a VPLS service.

Default

no proxy-arp

Platforms

All

proxy-arp

Syntax

[no] proxy-arp [mac [ieee-address]] [ ip [ipaddr] all]]

Context

[Tree] (debug>service>id proxy-arp)

Full Context

debug service id proxy-arp

Description

This command enables the debug of the proxy-arp function for a specified service. Alternatively, the debug can be enabled only for certain entries given by their IP or MAC addresses.

Platforms

All

proxy-arp-nd

Syntax

proxy-arp-nd

Context

[Tree] (config>service proxy-arp-nd)

Full Context

configure service proxy-arp-nd

Description

Commands in this context configure the service-level proxy-arp-nd commands.

Platforms

All

proxy-arp-policy

Syntax

[no] proxy-arp-policy policy-name [policy-name]

Context

[Tree] (config>service>vprn>if proxy-arp-policy)

[Tree] (config>service>ies>sub-if>grp-if proxy-arp-policy)

[Tree] (config>service>ies>if proxy-arp-policy)

[Tree] (config>service>vprn>sub-if>grp-if proxy-arp-policy)

Full Context

configure service vprn interface proxy-arp-policy

configure service ies subscriber-interface group-interface proxy-arp-policy

configure service ies interface proxy-arp-policy

configure service vprn subscriber-interface group-interface proxy-arp-policy

Description

This command specifies an existing policy-statement to analyze match and action criteria that controls the flow of routing information to and from a given protocol, set of protocols, or a neighbor.

The no form of this command disables the proxy ARP capability.

Parameters

policy-name

Specifies the export route policy name. Allowed values are any string, up to 32 characters, composed of printable, 7-bit ASCII characters excluding double quotes. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.

The specified name must already be defined.

Platforms

All

configure service vprn interface proxy-arp-policy
configure service ies interface proxy-arp-policy

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

configure service vprn subscriber-interface group-interface proxy-arp-policy
configure service ies subscriber-interface group-interface proxy-arp-policy

proxy-arp-policy

Syntax

proxy-arp-policy policy-name [policy-name]

no proxy-arp-policy

Context

[Tree] (config>subscr-mgmt>git>ipv4 proxy-arp-policy)

Full Context

configure subscriber-mgmt group-interface-template ipv4 proxy-arp-policy

Description

This command configures a proxy ARP policy for the interface.

The no form of this command disables the proxy ARP capability.

Default

no proxy-arp-policy

Parameters

policy-name: Specifies the export route policy name. Allowed values are any string, up to 32 characters, composed of printable, 7-bit ASCII characters excluding double quotes. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. A maximum of five policy names can be specified.

Note:
The specified policy name must already be defined.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

proxy-arp-policy

Syntax

proxy-arp-policy policy-name [policy-name]

no proxy-arp-policy

Context

[Tree] (config>router>if proxy-arp-policy)

Full Context

configure router interface proxy-arp-policy

Description

This command enables and configure proxy ARP on the interface and specifies an existing policy-statement to analyze match and action criteria that controls the flow of routing information to and from a given protocol, set of protocols, or a specific neighbor. The policy-name is configured in the config>router>policy-options context.

Use proxy ARP so the router responds to ARP requests on behalf of another device. Static ARP is used when a router needs to know about a device on an interface that cannot or does not respond to ARP requests. Therefore, the router configuration can state that if it has a packet that has a certain IP address to send it to the corresponding ARP address.

Default

no proxy-arp-policy

Parameters

policy-name: Specifies the export route policy name. Allowed values are any string up to 32 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. A maximum of five policy names can be specified in a single statement. The specified policy names must already be defined.

Platforms

All

proxy-authentication

Syntax

[no] proxy-authentication

Context

[Tree] (config>service>vprn>l2tp>group>tunnel>ppp proxy-authentication)

[Tree] (config>router>l2tp>group>tunnel>ppp proxy-authentication)

[Tree] (config>router>l2tp>group>ppp proxy-authentication)

[Tree] (config>service>vprn>l2tp>group>ppp proxy-authentication)

Full Context

configure service vprn l2tp group tunnel ppp proxy-authentication

configure router l2tp group tunnel ppp proxy-authentication

configure router l2tp group ppp proxy-authentication

configure service vprn l2tp group ppp proxy-authentication

Description

This command configures the use of the authentication AVPs received from the LAC.

Default

no proxy-authentication

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

proxy-lcp

Syntax

[no] proxy-lcp

Context

[Tree] (config>service>vprn>l2tp>group>tunnel>ppp proxy-lcp)

[Tree] (config>router>l2tp>group>tunnel>ppp proxy-lcp)

[Tree] (config>router>l2tp>group>ppp proxy-lcp)

[Tree] (config>service>vprn>l2tp>group>ppp proxy-lcp)

Full Context

configure service vprn l2tp group tunnel ppp proxy-lcp

configure router l2tp group tunnel ppp proxy-lcp

configure router l2tp group ppp proxy-lcp

configure service vprn l2tp group ppp proxy-lcp

Description

This command configures the use of the proxy LCP AVPs received from the LAC.

Default

no proxy-lcp

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

proxy-nd

Syntax

[no] proxy-nd

Context

[Tree] (config>service>vpls proxy-nd)

Full Context

configure service vpls proxy-nd

Description

Commands in this context configure the proxy-ND parameters in a VPLS service.

Default

no proxy-nd

Platforms

All

proxy-nd

Syntax

[no] proxy-nd [mac [ieee-address]] [ ip [ipaddr] all]]

Context

[Tree] (debug>service>id proxy-nd)

Full Context

debug service id proxy-nd

Description

This command enables the debug of the proxy-nd function for a specified service. Alternatively, the debug can be enabled only for certain entries given by their IPv6 or MAC addresses.

Platforms

All

proxy-nd-policy

Syntax

proxy-nd-policy policy-name [policy-name]

no proxy-nd-policy

Context

[Tree] (config>service>ies>if>ipv6 proxy-nd-policy)

Full Context

configure service ies interface ipv6 proxy-nd-policy

Description

This command configures a proxy neighbor discovery policy for the interface. This policy determines networks and sources for which proxy ND is attempted, when local proxy neighbor discovery is enabled.

The no form of this command reverts to the default value.

Parameters

policy-name

Specifies up to five the export route policy names. Allowed values are any string, up to 32 characters, composed of printable, 7-bit ASCII characters excluding double quotes. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.

The specified name(s) must already be defined.

Up to 5 policy-names can be specified in a single statement.

Platforms

All

proxy-nd-policy

Syntax

proxy-nd-policy policy-name [policy-name]

no proxy-nd-policy

Context

[Tree] (config>service>vprn>if>ipv6 proxy-nd-policy)

Full Context

configure service vprn interface ipv6 proxy-nd-policy

Description

This command configures a proxy neighbor discovery policy for the interface.

Parameters

policy-name: Specifies up to five existing policy names.

Platforms

All

proxy-nd-policy

Syntax

proxy-nd-policy policy-name [policy-name]

no proxy-nd-policy

Context

[Tree] (config>router>if>ipv6 proxy-nd-policy)

Full Context

configure router interface ipv6 proxy-nd-policy

Description

This command configure a proxy neighbor discovery policy for the interface.

Parameters

policy-name: The neighbor discovery policy name. Allowed values are any string up to 32 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes. A maximum of five policy names can be specified in a single statement. The specified policy names must already be defined.

Platforms

All

proxy-server

Syntax

proxy-server

Context

[Tree] (config>service>ies>sub-if>grp-if>dhcp proxy-server)

[Tree] (config>service>vprn>sub-if>grp-if>dhcp proxy-server)

[Tree] (config>service>ies>if>dhcp proxy-server)

[Tree] (config>subscr-mgmt>msap-policy>vpls-only>dhcp proxy-server)

[Tree] (config>service>vpls>sap>dhcp proxy-server)

Full Context

configure service ies subscriber-interface group-interface dhcp proxy-server

configure service vprn subscriber-interface group-interface dhcp proxy-server

configure service ies interface dhcp proxy-server

configure subscriber-mgmt msap-policy vpls-only-sap-parameters dhcp proxy-server

configure service vpls sap dhcp proxy-server

Description

Commands in this context configure DHCP proxy server parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

configure service ies subscriber-interface group-interface dhcp proxy-server
configure service vprn subscriber-interface group-interface dhcp proxy-server
configure subscriber-mgmt msap-policy vpls-only-sap-parameters dhcp proxy-server

All

configure service ies interface dhcp proxy-server
configure service vpls sap dhcp proxy-server

proxy-server

Syntax

[no] proxy-server

Context

[Tree] (config>service>vprn>sub-if>grp-if>ipv6>dhcp6 proxy-server)

Full Context

configure service vprn subscriber-interface group-interface ipv6 dhcp6 proxy-server

Description

This command allows access to the DHCP6 proxy server context. Within this context, DHCP6 proxy server parameters of the group interface can be configured.

Default

no proxy-server

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

proxy-server

Syntax

[no] proxy-server

Context

[Tree] (config>service>ies>sub-if>grp-if>ipv6>dhcp6 proxy-server)

Full Context

configure service ies subscriber-interface group-interface ipv6 dhcp6 proxy-server

Description

This command allows access to the DHCP6 proxy server context. Within this context, DHCP6 proxy server parameters of the group interface can be configured

Default

no proxy-server

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

ps-information

Syntax

[no] ps-information

Context

[Tree] (config>subscr-mgmt>diam-appl-plcy>gy>avp ps-information)

Full Context

configure subscriber-mgmt diameter-application-policy gy include-avp ps-information

Description

This command includes the following AVPs in Diameter DCCA CCR messages encapsulated in [3GPP-873] Service-Information or [3GPP-874] PS-Information grouped AVPs:

[8] Framed-IP-Address
[30] Called-Station-Id
[97] Framed-IPv6-Prefix
[123] Delegated-IPv6-Prefix
[6527-99] Alc-IPv6-Address
[10415-1] 3GPP-IMSI
[10415-2] 3GPP-Charging-Id
[10415-5] 3GPP-GPRS-Negotiated-QoS-Profile
[10415-7] 3GPP-GGSN-Address
[10415-10] GGSN-NSAPI
[10415-11] 3GPP-Session-Stop-Indicator
[10415-12] 3GPP-Selection-Mode
[10415-13] 3GPP-Charging-Characteristics
[10415-16] 3GPP-GGSN-IPv6-Address
[10415-21] 3GPP-RAT-Type
[10415-847] GGSN-Address
[10415-1004] Charging-Rule-Base-Name
[10415-1247] PDP-Context-Type

The AVPs are included when configured in the include-avp context.

By default, these AVPs are included at the command level.

The no form of this command resets to the default setting.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

psi-payload

Syntax

psi-payload

Context

[Tree] (config>port>otu psi-payload)

Full Context

configure port otu psi-payload

Description

Commands in this context configure payload structure identifier payload parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

psid-offset

Syntax

psid-offset psid-offset-length

no psid-offset

Context

[Tree] (config>service>nat>map-domain>mapping-rule psid-offset)

Full Context

configure service nat map-domain mapping-rule psid-offset

Description

This command configures the length of the high order bits in the protocol port field whose aggregate value should always be greater than 0. This automatically excludes certain ports (such as well-known ports) from the translation.

It is a function of the CE to make sure that the psid-offset bits are always greater than 0. The VSR does not check whether those bits are 0.

Default

psid-offset 6

Parameters

psid-offset-length

Specifies the length of the psid-offset bits in the protocol port field.

Values: 0 to 16

Platforms

7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se, 7750 SR-2se, 7750 SR-7s, 7750 SR-14s, VSR

psnp-authentication

Syntax

[no] psnp-authentication

Context

[Tree] (config>service>vprn>isis psnp-authentication)

[Tree] (config>service>vprn>isis>level psnp-authentication)

Full Context

configure service vprn isis psnp-authentication

configure service vprn isis level psnp-authentication

Description

This command enables authentication of individual ISIS packets of partial sequence number PDU (PSNP) type.

The no form of this command suppresses authentication of PSNP packets.

Platforms

All

psnp-authentication

Syntax

[no] psnp-authentication

Context

[Tree] (config>router>isis>level psnp-authentication)

[Tree] (config>router>isis psnp-authentication)

Full Context

configure router isis level psnp-authentication

configure router isis psnp-authentication

Description

This command enables authentication of individual IS-IS packets of partial sequence number PDU (PSNP) type.

The no form of this command suppresses authentication of PSNP packets.

Default

psnp-authentication

Platforms

All

ptp

Syntax

[no] ptp

Context

[Tree] (config>service>vprn ptp)

Full Context

configure service vprn ptp

Description

Commands in this context configure PTP parameters for the VPRN service.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp

Syntax

ptp

Context

[Tree] (config>system ptp)

Full Context

configure system ptp

Description

Commands in this context configure parameters for IEEE 1588-2008, Precision Time Protocol.

This command is only available on the control assemblies that support 1588.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp

Syntax

ptp

Context

[Tree] (config>system>sync-if-timing ptp)

Full Context

configure system sync-if-timing ptp

Description

Commands in this context configure parameters for system timing via IEEE 1588-2008, Precision Time Protocol.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp-asymmetry

Syntax

ptp-asymmetry nanoseconds

no ptp-asymmetry

Context

[Tree] (config>port>ethernet ptp-asymmetry)

Full Context

configure port ethernet ptp-asymmetry

Description

This command configures the PTP asymmetry delay on an Ethernet port. The command is used to correct for known asymmetry as part of time of day or phase recovery using PTP packets on both local and downstream PTP clocks.

Default

no ptp-asymmetry

Parameters

nanoseconds

Specifies the value, in nanoseconds, that the forward path delay varies from the mean path delay; the value can be a negative number.

Values: -2147483648 to 2147483647

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp-hw-assist

Syntax

[no] ptp-hw-assist

Context

[Tree] (config>service>ies>if ptp-hw-assist)

Full Context

configure service ies interface ptp-hw-assist

Description

This command configures the 1588 port based timestamping assist feature for the interface. This feature is supported on a specific set of hardware. The command may be blocked if not all hardware has the required level of support.

Only one interface per physical port can have ptp-hw-assist enabled.

The no form of this command disables the feature for the interface.

Default

no ptp-hw-assist

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp-hw-assist

Syntax

[no] ptp-hw-assist

Context

[Tree] (config>service>vprn>if ptp-hw-assist)

Full Context

configure service vprn interface ptp-hw-assist

Description

This command configures the 1588 port based timestamping assist feature for the interface. This feature is supported on a specific set of hardware. The command may be blocked if not all hardware has the required level of support.

If the SAP configuration of the interface is removed, the ptp-hw-assist configuration will be removed.

If the IPv4 address configuration of the interface is removed, the ptp-hw-assist configuration will be removed.

Only one interface per physical port can have ptp-hw-assist enabled.

The no form of this command disables the feature for the interface.

Default

no ptp-hw-assist

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp-hw-assist

Syntax

[no] ptp-hw-assist

Context

[Tree] (config>router>if ptp-hw-assist)

Full Context

configure router interface ptp-hw-assist

Description

This command configures the 1588 port based timestamping assist feature for the interface. Various checks are performed to ensure that this feature can be enabled. If a check fails:

The command is blocked/rejected with an appropriate error message.
If the SAP configuration of the interface is removed, the ptp-hw-assist configuration will be removed.
If the IPv4 address configuration of the interface is removed, the ptp-hw-assist configuration will be removed.

The port validates the destination IP address on received 1588 messages. If the 1588 messages are sent to a loopback address within the node rather than the address of the interface, the loopback address must be configured in the configure system security source-address application ptp context.

The no form of this command disables the feature for the interface.

Default

no ptp-hw-assist

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp-ip

Syntax

[no] ptp-ip

Context

[Tree] (config>system>sat>eth-sat ptp-ip)

Full Context

configure system satellite eth-sat ptp-ip

Description

Commands in this context configure the Precision Time Protocol over IP (PTP over IP) transparent clock functionality.

Enable the configure system satellite eth-sat feature ptp-tc command to allow PTP over IP to function.

The no form of this command disables the PTP over IP transparent clock functionality.

Default

no ptp-ip

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS

ptp-tc

Syntax

[no] ptp-tc

Context

[Tree] (config>system>satellite>eth-sat ptp-tc)

Full Context

configure system satellite eth-sat ptp-tc

Description

This command enables the ethernet satellite IEEE1588 transparent clock function. This function works with the SR OS host router configured as a PTP ordinary clock or boundary clock. This provides increased accuracy on the PTP event messages transiting the satellite. When a IEEE1588 event message transits the ethernet satellite, the correction field of the message is updated with the residence time of that message. This is used in PTP time calculations. All ports of the satellite are enabled for this capability with the one setting. This feature must be enabled to allow the assignment of one of the satellite’s client ports as a PTP port under config>system>ptp>port. This feature is only valid when using PTP over Ethernet encapsulation; it is not valid for PTP over IP encapsulation.

To enable this command, the satellite must have first been configured to support the feature using the config>system>satellite>eth-sat>feature transparent-clock-eth and must have been enabled for synchronous ethernet with config>system>satellite>eth-sat>sync-e.

All host ports connecting to this satellite must support 1588 port-based timestamping.

The no version of this command disables the specific satellite functionality.

Default

no ptp-tc

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp-timestamping

Syntax

[no] ptp-timestamping

Context

[Tree] (config>lag ptp-timestamping)

[Tree] (config>port>ethernet ptp-timestamping)

Full Context

configure lag ptp-timestamping

configure port ethernet ptp-timestamping

Description

Commands in this context configure the filtering for the ingress 1588 timestamping of PTP messages to match multiple PTP flows.

The no form of this command removes the filter.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS

ptsf

Syntax

ptsf

Context

[Tree] (config>system>ptp ptsf)

Full Context

configure system ptp ptsf

Description

Commands in this context configure PTSF-unusable configuration.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

public-key-authentication

Syntax

[no] public-key-authentication

Context

[Tree] (config>system>security>ldap public-key-authentication)

Full Context

configure system security ldap public-key-authentication

Description

This command enables public key retrieval from the LDAP server. If disabled (no public-key-authentication), password authentication is attempted via LDAP.

Default

no public-key-authentication

Platforms

All

public-key-min-bits

Syntax

public-key-min-bits bits

no public-key-min-bits

Context

[Tree] (config>service>ies>if>ipv6>secure-nd public-key-min-bits)

Full Context

configure service ies interface ipv6 secure-nd public-key-min-bits

Description

This command configures the minimum acceptable key length for public keys used in the generation of a Cryptographically Generated Address (CGA).

Parameters

bits

Specifies the number of bits.

Values: 512 to 1024

Platforms

All

public-key-min-bits

Syntax

public-key-min-bits bits

[no] public-key-min-bits

Context

[Tree] (config>service>vprn>if>send public-key-min-bits)

Full Context

configure service vprn interface ipv6 secure-nd public-key-min-bits

Description

This command configures the minimum acceptable key length for public keys used in the generation of a Cryptographically Generated Address (CGA).

Parameters

bits

Specifies the number of bits.

Values: 512 to 1024

Platforms

All

public-key-min-bits

Syntax

public-key-min-bits bits

no public-key-min-bits

Context

[Tree] (config>router>if>ipv6>secure-nd public-key-min-bits)

Full Context

configure router interface ipv6 secure-nd public-key-min-bits

Description

This command configures the minimum acceptable key length for public keys used in the generation of a Cryptographically Generated Address (CGA).

Parameters

bits

Specifies the number of bits.

Values: 512 to 1024

Platforms

All

public-key-only

Syntax

[no] public-key-only

Context

[Tree] (config>system>security>ssh>auth-method>server public-key-only)

Full Context

configure system security ssh authentication-method server public-key-only

Description

This command configures the SSH server to accept only the public-key authentication method.

The no form of this command configures the SSH server to accept public-key or password client authentication. If interactive-authentication is enabled in the configure system security aaa remote-servers radius or configure system security aaa remote-servers tacplus contexts, the SSH server also accepts interactive keyboard authentication.

Default

no public-key-only

Platforms

All

public-key-only

Syntax

public-key-only {false|true|system}

Context

[Tree] (config>system>security>user>ssh-auth-method>server public-key-only)

Full Context

configure system security user ssh-authentication-method server public-key-only

Description

This command configures the accepted SSH authentication method for the user connection.

Default

system

Parameters

false: Specifies the use of public-key only, or public-key and password for client authentication. If interactive-authentication is enabled in the configure system security aaa remote-servers radius or configure system security aaa remote-servers tacplus contexts, the SSH server also accepts interactive keyboard authentication.

true: Specifies the use of public-key authentication only.

system: Specifies the use of the SSH authentication method configured at the system level.

Platforms

All

public-keys

Syntax

public-keys

Context

[Tree] (config>system>security>user public-keys)

Full Context

configure system security user public-keys

Description

This command allows the user to enter the context to configure public keys for SSH.

Platforms

All

public-tcp-mss-adjust

Syntax

public-tcp-mss-adjust octets

public-tcp-mss-adjust default

no public-tcp-mss-adjust

Context

[Tree] (config>router>l2tp>group>l2tpv3 public-tcp-mss-adjust)

[Tree] (config>service>vprn>l2tp>l2tpv3 public-tcp-mss-adjust)

[Tree] (config>service>vprn>l2tp>group>tunnel>l2tpv3 public-tcp-mss-adjust)

[Tree] (config>service>vprn>l2tp>group>l2tpv3 public-tcp-mss-adjust)

Full Context

configure router l2tp group l2tpv3 public-tcp-mss-adjust

configure service vprn l2tp l2tpv3 public-tcp-mss-adjust

configure service vprn l2tp group tunnel l2tpv3 public-tcp-mss-adjust

configure service vprn l2tp group l2tpv3 public-tcp-mss-adjust

Description

This command enables TCP MSS adjust for L2TPv3 tunnels on the public side on the group or tunnel level. When the command is configured, the system updates the TCP MSS option value of the received TCP SYN packet on the public side that is encapsulated in the L2TPv3 tunnel.

Note that this command can be overridden by the corresponding configuration on the group or tunnel level.

With the default parameter, the system uses the upper level configuration. With the non-default parameter, the system uses this configuration instead of the upper level configuration.

The no form of this command disables TCP MSS adjust on the public side.

Default

no public-tcp-mss-adjust

Parameters

octets

Specifies the new TCP MSS value in octets

Values: 512 to 9000

default: Specifies to use the upper-level configuration

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

public-tcp-mss-adjust

Syntax

public-tcp-mss-adjust bytes

public-tcp-mss-adjust octets

public-tcp-mss-adjust auto

no public-tcp-mss-adjust

Context

[Tree] (config>service>ies>if>sap>ip-tunnel public-tcp-mss-adjust)

[Tree] (config>service>vprn>if>sap>ipsec-tun public-tcp-mss-adjust)

[Tree] (config>ipsec>tnl-temp public-tcp-mss-adjust)

[Tree] (config>service>vprn>if>ip-tunnel public-tcp-mss-adjust)

[Tree] (config>service>ies>if>ipsec>ipsec-tunnel public-tcp-mss-adjust)

[Tree] (config>router>if>ipsec>ipsec-tunnel public-tcp-mss-adjust)

[Tree] (config>service>vprn>if>ipsec>ipsec-tunnel public-tcp-mss-adjust)

Full Context

configure service ies interface sap ip-tunnel public-tcp-mss-adjust

configure service vprn interface sap ipsec-tunnel public-tcp-mss-adjust

configure ipsec tunnel-template public-tcp-mss-adjust

configure service vprn interface ip-tunnel public-tcp-mss-adjust

configure service ies interface ipsec ipsec-tunnel public-tcp-mss-adjust

configure router interface ipsec ipsec-tunnel public-tcp-mss-adjust

configure service vprn interface ipsec ipsec-tunnel public-tcp-mss-adjust

Description

This command enables the Maximum Segment Size (MSS) for the TCP traffic in an IPsec tunnel which is sent from the public network to the private network. The system may use this value to adjust or insert the MSS option in TCP SYN packet.

If the auto parameter is specified, the system derives the new MSS value based on the public MTU and IPsec overhead.

The no form of this command disables TCP MSS adjust on the public side.

Default

no public-tcp-mss-adjust

Parameters

auto: Derive the new MSS value based on the public MTU and IPsec overhead.

bytes

Specifies the new TCP MSS value in bytes.

Values: 512 to 9000

octets

Specifies the new TCP MSS value in octets

Values: 512 to 9000

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

configure service vprn interface sap ipsec-tunnel public-tcp-mss-adjust
configure service ies interface sap ip-tunnel public-tcp-mss-adjust
configure ipsec tunnel-template public-tcp-mss-adjust

VSR

configure service ies interface ipsec ipsec-tunnel public-tcp-mss-adjust
configure router interface ipsec ipsec-tunnel public-tcp-mss-adjust
configure service vprn interface ipsec ipsec-tunnel public-tcp-mss-adjust

purge-timeout

Syntax

purge-timeout seconds

no purge-timeout

Context

[Tree] (config>system>grpc>rib-api purge-timeout)

Full Context

configure system grpc rib-api purge-timeout

Description

This command configures the purge timeout associated with the RibApi gRPC service.

If a gRPC client used the RibApi gRPC service to program RIB entries into the router, and then the TCP connection drops for any reason, the associated RIB entries are immediately marked as stale and a timer with the purge-timeout value is started. Upon timer expiration, all of the stale entries are removed. While the timer is running, the stale entries remain valid and usable for forwarding but are less preferred than any non-stale entry. The purge-timeout gives an opportunity for the disconnected client, or some other client, to re-program the necessary RIB entries so that forwarding can continue uninterrupted.

The no form of this command resets to the default value of 0. Entries are immediately deleted when the TCP connection drops.

Default

no purge-timeout

Parameters

seconds

Specifies the number of seconds until the stale entries are purged.

Values: 1 to 100 000

Default: 0

Platforms

All

purge-timer

Syntax

purge-timer minutes

no purge-timer

Context

[Tree] (config>router>bgp purge-timer)

Full Context

configure router bgp purge-timer

Description

When the system sends a VPN-IP Route-Refresh to a peer it sets all the VPN-IP routes received from that peer (in the RIB-IN) to stale and starts the purge-timer. If the routes are not updated (refreshed) before the purge-timer has expired then the routes are removed.

The BGP purge timer configures the time before stale routes are purged.

The no form of this command reverts to the default.

Default

purge-timer 10

Parameters

minutes

Specifies the maximum time before stale routes are purged.

Values: 1 to 60

Platforms

All

push

Syntax

push {label | implicit-null-label} nexthop ip-address

no push {out-label | implicit-null-label}

Context

[Tree] (config>router>mpls>static-lsp push)

Full Context

configure router mpls static-lsp push

Description

This command specifies the label to be pushed on the label stack and the next hop IP address for the static LSP.

The no form of this command removes the association of the label to push for the static LSP.

Parameters

implicit-null-label: Specifies the use of the implicit label value for the push operation.

label

The label to push on the label stack. Label values 16 through 1,048,575 are defined as follows:

label values 16 through 31 are reserved
label values 32 through 1,023 are available for static assignment
label values 1,024 through 2,047 are reserved for future use
label values 2,048 through 18,431 are statically assigned for services
label values 28,672 through 131,071 are dynamically assigned for both MPLS and services
label values 131,072 through 1,048,575 are reserved for future use

Values: 16 to 1048575

nexthop ip-address: Specifies the IP address of the next hop towards the LSP egress router. If an ARP entry for the next hop exists, then the static LSP is marked operational. If ARP entry does not exist, software sets the operational status of the static LSP to down and continues to ARP for the configured nexthop. Software continuously tries to ARP for the configured nexthop at a fixed interval.

Platforms

All

pushed-labels

Syntax

pushed-labels label [label]

no pushed-labels

Context

[Tree] (config>router>mpls>fwd-policies>fwd-policy>nh-grp>pri pushed-labels)

[Tree] (config>router>mpls>fwd-policies>fwd-policy>nh-grp>bkup pushed-labels)

Full Context

configure router mpls forwarding-policies forwarding-policy next-hop-group primary-next-hop pushed-labels

configure router mpls forwarding-policies forwarding-policy next-hop-group backup-next-hop pushed-labels

Description

This command configures the pushed label stack for the primary or backup next hop of a next-hop group of an MPLS forwarding policy.

The no form of this command removes the pushed label stack.

Parameters

label

Specifies the label value; up to a maximum of 10 labels.

Values: 0 to 1048575

Platforms

All

pw-cap-list

Syntax

pw-cap-list {ethernet | ethernet-vlan} [{ ethernet | ethernet-vlan}]

no pw-cap-list

Context

[Tree] (config>service>vprn>l2tp>group>l2tpv3 pw-cap-list)

Full Context

configure service vprn l2tp group l2tpv3 pw-cap-list

Description

This command configures the allowable pseudowire capability list that is advertised to the far end. An empty list results in both pseudowire capabilities being advertised. Up to two capabilities are allowed to be advertised.

The no form of this command removes the list and advertises both pseudowire capabilities to the far end.

Default

no pw-cap-list

Parameters

ethernet: Specifies that the Ethernet pseudo-wire type is advertised.

ethernet-vlan: Specifies that the Ethernet-VLAN pseudo-wire type is advertised.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

pw-path-id

Syntax

[no] pw-path-id

Context

[Tree] (config>service>vprn>red-if>spoke-sdp pw-path-id)

[Tree] (config>service>vpls>spoke-sdp pw-path-id)

[Tree] (config>service>ies>if>spoke-sdp pw-path-id)

[Tree] (config>service>vprn>if>spoke-sdp pw-path-id)

[Tree] (config>service>cpipe>spoke-sdp pw-path-id)

[Tree] (config>service>epipe>spoke-sdp pw-path-id)

Full Context

configure service vprn redundant-interface spoke-sdp pw-path-id

configure service vpls spoke-sdp pw-path-id

configure service ies interface spoke-sdp pw-path-id

configure service vprn interface spoke-sdp pw-path-id

configure service cpipe spoke-sdp pw-path-id

configure service epipe spoke-sdp pw-path-id

Description

Commands in this context configure an MPLS-TP Pseudowire Path Identifier for a spoke-sdp. All elements of the PW path ID must be configured in order to enable a spoke-sdp with a PW path ID.

For an IES or VPRN spoke-sdp, the pw-path-id is only valid for ethernet spoke-sdps.

The pw-path-id is only configurable if all of the following is true:

SDP signaling is off
control-word is enabled (control-word is disabled by default)
the service type is Epipe, VPLS, Cpipe, or IES/VPRN interface
mate SDP signaling is off for vc-switched services

The no form of this command deletes the PW path ID.

Default

no pw-path-id

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s

configure service vprn redundant-interface spoke-sdp pw-path-id

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

configure service cpipe spoke-sdp pw-path-id
configure service vpls spoke-sdp pw-path-id
configure service epipe spoke-sdp pw-path-id
configure service ies interface spoke-sdp pw-path-id
configure service vprn interface spoke-sdp pw-path-id

pw-path-id

Syntax

[no] pw-path-id

Context

[Tree] (config>mirror>mirror-dest>remote-src>spoke-sdp pw-path-id)

[Tree] (config>mirror>mirror-dest>spoke-sdp pw-path-id)

Full Context

configure mirror mirror-dest remote-source spoke-sdp pw-path-id

configure mirror mirror-dest spoke-sdp pw-path-id

Description

Commands in this context configure an MPLS-TP Pseudowire Path Identifier for a spoke SDP. All elements of the PW path ID must be configured in order to enable a spoke SDP with a PW path ID.

For an IES or VPRN spoke SDP, the pw-path-id is only valid for Ethernet spoke SDPs.

The pw-path-id is only configurable if all of the following is true:

SDP signaling is off
control-word is enabled (control-word is disabled by default)
the service type is Epipe, Cpipe, Apipe, IES, VPLS, or VPRN interface
mate SDP signaling is off for VC-switched services

The no form of this command deletes the PW path ID.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

pw-port

Syntax

pw-port pw-port-id [pw-headend]

no pw-port

Context

[Tree] (config>service>system>bgp-evpn>eth-seg pw-port)

Full Context

configure service system bgp-evpn ethernet-segment pw-port

Description

This command configures a PW port associated to the Ethernet Segment. When the Ethernet Segment is configured as all-active, only a LAG or a PW port can be associated to the Ethernet Segment. When the Ethernet Segment is configured as single-active, then a LAG, port or SDP can be associated to the Ethernet Segment, but not a PW port unless the pw-headend parameter is configured. In either case, only one of the four objects can be configured in the Ethernet Segment. A specified PW port can be part of only one Ethernet Segment.

The no version of this command removes the PW port from the Ethernet Segment.

Default

no pw-port

Parameters

pw-port-id

Specifies the PW port identifier.

Values: 1 to 32767

pw-headend: Keyword used to specify multihoming procedures are run in the PW port stitching Epipe and the routes advertised in the context of the stitching Epipe contain the ESI of the Ethernet Segment.

Platforms

All

pw-port

Syntax

pw-port id [create]

no pw-port id

Context

[Tree] (config pw-port)

Full Context

configure pw-port

Description

This command creates a PW port that can be bound to a physical port or associated with an FPE (anchored PW port). A PW port's purpose is to provide, through a PW SAP, access level (or SAP level) capability to customer traffic that is tunneled to the SR OS node through an IP/MPLS network.

The no form of this command removes the pw-port ID.

Default

no pw-port

Parameters

id

Specifies the ID of the PW port.

Values: 1 to 32767

create: Keyword required to create the configuration context.

Platforms

All

pw-port

Syntax

pw-port pw-port-id [vc-id vc-id] [ create]

no pw-port pw-port-id

Context

[Tree] (config>service>sdp>binding pw-port)

Full Context

configure service sdp binding pw-port

Description

This command creates a pseudowire port.

The no form of the command removes the pseudowire port ID from the configuration.

Parameters

pw-port-id

Specifies a unique identifier of the pseudowire port.

Values: 1 to 10239

vc-id

Specifies a virtual circuit identifier signaled to the peer.

Values: 1 to 4294967295

create: This keyword is required when a new pseudowire is being created.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

pw-port

Syntax

pw-port pw-port-id [fpe fpe-id] [ create]

no pw-port

Context

[Tree] (config>service>epipe pw-port)

Full Context

configure service epipe pw-port

Description

This command is used to associate the PW-port with the PXC ports or PXC based LAGs referenced in the FPE. That is, the PW-port becomes anchored by the PXC. This enables an external PW that is mapped to the anchored PW-port to be seamlessly rerouted between the I/O ports without interruption of service on the PW-port. This mapping between the external PW (spoke SDP) and the PXC based PXC-port is performed via an Epipe operating in vc-switching mode (creation time parameter).

Default

no pw-port

Parameters

pw-port-id

Specifies the PW-port associated with this service.

Values: 1 to 10239

fpe fpe-id

Specifies the FPE object which contains the PXC-based ports or PXC-based LAGs.

Values: 1 to 64

Platforms

All

pw-port

Syntax

pw-port pw-port-id [fpe fpe-id] [create]

no pw-port

Context

[Tree] (config>service>epipe pw-port)

Full Context

configure service epipe pw-port

Description

This command is only applicable for VSR configurations. This command associates a Flex PW port with any of the following constructs:

an MPLS-based spoke SDP (PW)
L2oGRE tunnel using IPv4 or IPv6 transport

With this configuration, a PW that is terminated on a Flex PW port can be seamlessly rerouted between I/O ports.

The payload from the PW is extracted from the Flex PW port and processed in accordance with the configured application (a capture SAP in ESM, a PW SAP for business services, and so on). The Epipe that associates the Flex PW port with the spoke SDP or with the tunnel is a regular Epipe service (not of type vc-switching).

This command must be configured before a spoke SDP is added to the Epipe.

The no form of this command removes the pw-port-id from the configuration.

Parameters

pw-port-id

Specifies the PW port associated with the PW.

Values: 1 to 32767

fpe-id

Specifies the FPE object.

Values: 1 to 64

create: Keyword required to create the configuration context.

Platforms

All

pw-port-extension

Syntax

[no] pw-port-extension

Context

[Tree] (config>fwd-path-ext>fpe pw-port-extension)

Full Context

configure fwd-path-ext fpe pw-port-extension

Description

Commands in this context configure the type of the cross-connect required to terminate an external tunnel to an anchored PW port. The system automatically builds the internal infrastructure required to perform the tunnel termination on a PW port.

PW ports support the following types of tunnels:

GRE/MPLS PW with SDP of type MPLS or GRE
L2oGRE bridged Ethernet over GRE, where GRE protocol number is 0x6558

The no form of this command removes the cross-connect type from the configuration.

Default

no pw-port-extension

Platforms

All

pw-port-list

Syntax

pw-port-list

Context

[Tree] (config>service>system pw-port-list)

Full Context

configure service system pw-port-list

Description

Commands in this context configure a port list to bind to Flex PW ports.

Platforms

VSR

pw-routing

Syntax

pw-routing

Context

[Tree] (config>service pw-routing)

Full Context

configure service pw-routing

Description

Commands in this context configure dynamic multi-segment pseudowire (MS-PW) routing. Pseudowire routing must be configured on each node that will be a T-PE or an S-PE.

Platforms

All

pw-sap-secondary-shaper

Syntax

pw-sap-secondary-shaper pw-sap-sec-shaper-name

no pw-sap-secondary-shaper

Context

[Tree] (config>service>sdp>binding>pw-port>egress>shaper pw-sap-secondary-shaper)

Full Context

configure service sdp binding pw-port egress shaper pw-sap-secondary-shaper

Description

This command configures a default secondary shaper applicable to pw-saps under normal interfaces.

The no form of the command removes the shaper name from the configuration.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

pw-status-signaling

Syntax

[no] pw-status-signaling

Context

[Tree] (config>service>epipe>spoke-sdp pw-status-signaling)

Full Context

configure service epipe spoke-sdp pw-status-signaling

Description

This command enables pseudowire status signaling for this spoke SDP binding.

The no form of this command disables the status signaling.

Default

pw-status-signaling

Platforms

All

pw-status-signaling

Syntax

[no] pw-status-signaling

Context

[Tree] (config>service>vpls>spoke-sdp pw-status-signaling)

Full Context

configure service vpls spoke-sdp pw-status-signaling

Description

This command specifies the type of signaling used by this multi-segment pseudowire provider-edge for this service.

When no pw-status-signaling is enabled, a 7450 ESS, 7750 SR, and 7950 XRS will not include the pseudowire status TLV in the initial label mapping message of the pseudowire used for a spoke-SDP. This will force both 7450 ESS, 7750 SR, and 7950 XRS PEs to use the pseudowire label withdrawal method for signaling pseudowire status.

If pw-status-signaling is configured, the node will include the use of the pseudowire status TLV in the initial label mapping message for the pseudowire.

Platforms

All

pw-template

Syntax

pw-template policy-id[use-provisioned-sdp | [ prefer-provisioned-sdp] [auto-gre-sdp] ][create] [ name name]

no pw-template policy-id

Context

[Tree] (config>service pw-template)

Full Context

configure service pw-template

Description

This command configures an SDP template.

Parameters

policy-id

Specifies a number that uniquely identifies a template for the creation of an SDP.

Values: policy-id: 1 to 2147483647

use-provisioned-sdp: Specifies whether to use an already provisioned SDP. When specified, the tunnel manager is consulted for an existing active SDP (with a matching far-end address), and the SDP with the lowest metric is chosen. If there are multiple SDPs with the same metric, then the highest SDP identifier that is oper-up is chosen. The choice of SDP can be configured by applying sdp-include/exclude in the PW template together with an sdp-group in the provisioned SDPs. This option, and the auto-gre-sdp option, are mutually exclusive.

prefer-provisioned-sdp: Specifies that if an existing matching SDP that conforms to any restrictions defined in the pw-template is found (for example, sdp-include/exclude group), then it will be used, following the same logic as for the use-provisioned-sdp parameter. Otherwise, the command will automatically create an SDP in the same manner as if the user did not specify any option. This option and the use-provisioned-sdp option are mutually exclusive.

auto-gre-sdp: Specifies that an SDP should automatically be created using a GRE tunnel. This option and the use-provisioned-sdp option are mutually exclusive. The PW template parameters hash-label, entropy-label and sdp-include/exclude are ignored when an GRE SDP is auto-created.

auto-mpls-sdp: Specifies that an SDP should automatically be created using an MPLS tunnel. This is the default.

create: This keyword is required when first creating the configuration context. Once the context is created, it is possible to navigate into the context without the create keyword.

name name

A name of the operator’s choice, up to 64 characters. The name is saved as part of the configuration.

If a name is not specified at creation time, then SR OS assigns a string version of the policy-id as the name.

Values: name: 64 characters maximum

Platforms

All

pw-template-bind

Syntax

pw-template-bind policy-id

no pw-template-bind

Context

[Tree] (config>service>epipe>spoke-sdp-fec pw-template-bind)

Full Context

configure service epipe spoke-sdp-fec pw-template-bind

Description

This command binds includes the parameters included in a specific PW template to a spoke SDP.

The no form of this command removes the values from the configuration.

Parameters

policy-id

Specifies the existing policy ID.

Values: 1 to 2147483647

Platforms

All

pw-template-binding

Syntax

pw-template-binding policy-id [import-rt { ext-community [ext-community]}] [endpoint endpoint-name]

no pw-template-binding policy-id

Context

[Tree] (config>service>epipe>bgp pw-template-binding)

Full Context

configure service epipe bgp pw-template-binding

Description

This command binds the advertisements received with the route targets (RT) that match the configured list (either the generic or the specified import) to a specific pw-template. If the RT list is not present, or if multiple matches are found, the numerically lowest pw-template is used.

The pw-template-binding applies to BGP-VPWS when enabled in the Epipe.

For BGP VPWS, the following additional rules govern the use of pseudowire-template:

On transmission, the settings for the L2-Info extended community in the BGP updates are derived from the pseudowire template attributes. If multiple pseudowire template bindings (with or without import-rt) are specified for the same VPWS instance the first pw-template entry will be used for the information in the BGP update sent.
On reception, the values of the parameters in the L2-Info extended community of the BGP updates are compared with the settings from the corresponding pseudowire template bindings. The following steps are used to determine the local pw-template:
- The RT values are matched to determine the pw-template. The route targets configured for each pw-template-binding are compared to the route targets within the BGP update. The PW template corresponding to pw-template-binding with the first matching route target is used to for the SDP. The matching is performed from the lowest PW template binding identifier to the highest.
- If no pw-template-binding matches are found from the previous step, the first (numerically lowest) configured pw-template entry without any route-target configured will be used.

If the value used for Layer 2 MTU (unless the value zero is received), or control word does not match, the pseudowire is created but with the operationally down state.

If the value used for the S (sequenced delivery) flags is not zero the pseudowire is not created.

The tools perform commands can be used to control the application of changes in pw-template for BGP-VPWS.

The no form of this command removes the values from the configuration.

Parameters

policy-id

Specifies an existing policy ID.

Values: 1 to 2147483647

import-rt ext-comm

Specifies the communities, up to five, allowed to be accepted from remote PE neighbors. An extended BGP community in the type:x:y format. The value x can be an integer or IP address. The type can be the target or origin.

Values


target:{ip-addr:comm-val \| 2byte-asnumber:ext-comm-val\| 4byte-snumber: comm-val}
	ip-addr	a.b.c.d
	comm-val	0 to 65535
	2byte-asnumber	0 to 65535
	ext-comm-val	0 to 4294967295
	4byte-asnumber	0 to 4294967295

endpoint-name: Specifies the name of the endpoint the BGP PW template is associated with, up to 32 characters. When the configured endpoint is associated to the pw-template-binding of a BGP VPWS service, EVPN MPLS can also be configured and associated to the same endpoint in the same Epipe service. Modifying this element causes the parent element to be recreated automatically in order for the new value to take effect.

Platforms

All

pw-template-binding

Syntax

pw-template-binding policy-id [split-horizon-group group-name] [import-rt {ext-community}]

no pw-template-bind policy-id

Context

[Tree] (config>service>vpls>bgp-ad pw-template-binding)

[Tree] (config>service>vpls>bgp pw-template-binding)

Full Context

configure service vpls bgp-ad pw-template-binding

configure service vpls bgp pw-template-binding

Description

This command binds the advertisements received with the route target (RT) that matches the configured list (either the generic or the specified import) to a specific PW template. If the RT list is not present the pw-template is used for all of them.

The pw-template-binding applies to both BGP-AD and BGP-VPLS if these features are enabled in the VPLS.

For BGP VPLS the following additional rules govern the use of pseudowire-template.

On transmission, the settings for the L2-Info extended community in the BGP update are derived from the pseudowire template attributes. If multiple pseudowire template bindings (with or without import-rt) are specified, the first pw-template entry will be used for the information in the BGP update sent.
On reception, the values of the parameters in the L2-Info extended community of the BGP update are compared with the settings from the corresponding pw-template. The following steps are used to determine the local pw-template.
- The RT values are matched to determine the pw-template. The route targets configured for each pw-template-binding are compared to the route targets within the BGP update. The PW template corresponding to pw-template-binding with the first matching route target is used to for the SDP. The matching is performed from the lowest PW template binding identifier to the highest
- If no pw-templates matches are found from the previous step, the first (numerically lowest) configured pw-template entry without any route-target configured will be used.

If the values used for Layer 2 MTU (unless the value zero is received) or control word flag do not match, the pseudowire is created but with the operationally down state.

If the value used for the S (sequenced delivery) flags is not zero, the pseudowire is not created.

The tools perform commands can be used to control the application of changes in pw-template for both BGP-AD and BGP-VPLS.

The no form of this command removes the values from the configuration.

Parameters

policy-id

Specifies an existing policy ID

Values: 1 to 2147483647

group-name: The specified group-name overrides the split horizon group template settings

import-rt ext-comm

Specifies communities allowed to be accepted from remote PE neighbors. An extended BGP community in the type:x:y format. The value x can be an integer or IP address. The type can be the target or origin. x and y are 16-bit integers. A maximum of five import-rt ext-com can be specified.

Values

target:{ip-addr:comm-val| 2byte-asnumber:ext-comm-val| 4byte-asnumber:comm-val}

ip-addr: a.b.c.d

comm-val: [0 to 65535]

2byte-as-number: [0 to 65535]

ext-comm-val: [0 to 4294967295]

4byte-asnumber: [0 to 4294967295]

Platforms

All

pw-template-id-range

Syntax

pw-template-id-range start pw-template-id end pw-template-id

no pw-template-id-range

Context

[Tree] (config>service>md-auto-id pw-template-id-range)

Full Context

configure service md-auto-id pw-template-id-range

Description

This command specifies the range of IDs used by SR OS to automatically assign an ID to PW templates that are created in model-driven interfaces without an ID explicitly specified by the user or client.

A PW template created with an explicitly-specified ID cannot use an ID in this range. In the classic CLI and SNMP, the ID range cannot be changed while objects exist inside the previous or new range. In MD-CLI interfaces, the range can be changed, which causes any previously existing objects in the previous ID range to be deleted and re-created using a new ID in the new range.

The no form of this command removes the range values.

See the config>service md-auto-id command for further details.

Default

no pw-template-id-range

Parameters

start pw-template-id

Specifies the lower value of the ID range. The value must be less than or equal to the end value.

Values: 1 to 2147483647

end pw-template-id

Specifies the upper value of the ID range. The value must be greater than or equal to the start value.

Values: 1 to 2147483647

Platforms

All

pw-type

Syntax

pw-type ethernet-vlan vlan-id

pw-type ethernet

no pw-type

Context

[Tree] (config>service>epipe>sap>l2tpv3-session pw-type)

[Tree] (config>service>vpls>sap>l2tpv3-session pw-type)

Full Context

configure service epipe sap l2tpv3-session pw-type

configure service vpls sap l2tpv3-session pw-type

Description

This command specifies the PW-type for the associated L2TPv3 session.

The support types are either Ethernet or Ethernet-VLAN. If Ethernet-VLAN is configured, a VLAN value must be specified as well.

The no form of this command deletes the PW-type configuration.

Parameters

vlan-id: Specifies the VLAN-ID.

Platforms

All

pwc

Syntax

pwc [previous]

Context

[Tree] (pwc)

Full Context

pwc

Description

This command displays the present or previous working context of the CLI session. The pwc command provides a user who is in the process of dynamically configuring a chassis a way to display the current or previous working context of the CLI session. The pwc command displays a list of the CLI nodes that hierarchically define the current context of the CLI instance of the user.

The following example is from a 7750 SR:

A:ALA-1>config>router>bgp>group# pwc
-----------------------------------------------
Present Working Context :
-----------------------------------------------
<root>
  configure
  router Base
  bgp
  group test
  ospf
  area 1
-----------------------------------------------
A:ALA-1>config>router>bgp>group#

When the previous keyword is specified, the previous context displays. This is the context entered by the CLI parser upon execution of the exit command. The current context of the CLI is not affected by the pwc command.

The following example is from a 7450 ESS:

*A:ALA-1>config>router>ospf>area>if# pwc previous
---------------------------------------------------------
Previous Working Context :
---------------------------------------------------------
 <root>
  configure
  router "Base"
  ospf
  area "0.0.0.0"
---------------------------------------------------------
*A:ALA-1config>router>ospf>area>if#

Parameters

previous: Displays the previous present working context.

Platforms

All

pxc

Syntax

pxc pxc-id [create]

no pxc pxc-id

Context

[Tree] (config>port-xc pxc)

Full Context

configure port-xc pxc

Description

This command creates a port cross-connect (PXC) object. Referencing an Ethernet port within the PXC object will automatically configure this Ethernet port as a loopback port. The node will automatically create two PXC sub-ports under this Ethernet port. The configuration of PXC sub-ports can be accessed through the CLI.

Parameters

pxc-id

Specifies the port cross-connect identifier.

Values: 1 to 64

Platforms

All

pxc-pxc-id.sub-port-id

Syntax

pxc-pxc-id.sub-port-id

Context

[Tree] (config>port pxc-pxc-id.sub-port-id)

Full Context

configure port pxc-pxc-id.sub-port-id

Description

This command enables access to PXC sub-port level parameters. The PXC sub-ports are automatically created once the external Ethernet port is configured inside of an PXC object. The PXC sub-ports are by default administratively disabled (shutdown). In order for PXC sub-ports to became operational, both, the underlying external Ethernet port and the PXC object must be operationally up.

Parameters

pxc-id

Specifies the unique identifier of this PXC.

Values: 1 to 64

sub-port-id

When this the pxc-id is configured, two logical sub-ports are automatically created. These logical sub-ports are used to create two paths within the loop; one upstream path, and one downstream path. These sub-ports are destroyed when either this PXC row is destroyed, this object is de-provisioned.

Values: a, b

Platforms

All

python

Syntax

python

Context

[Tree] (config python)

Full Context

configure python

Description

Commands in this context configure Python parameters.

Platforms

All

python

Syntax

[no] python

Context

[Tree] (config>redundancy>multi-chassis>peer>sync python)

Full Context

configure redundancy multi-chassis peer sync python

Description

This command enables syncing of python-policy cached entries to the peer.

Use the mcs-peer command in the Python policy to enable syncing for a specific Python policy.

The no form of this command reverts to the default.

Default

no python

Platforms

All

python-policy

Syntax

python-policy python-name

no python-policy

Context

[Tree] (config>service>vprn>sub-if python-policy)

[Tree] (config>service>vprn>sub-if>dhcp python-policy)

[Tree] (config>service>ies>if>dhcp python-policy)

[Tree] (config>service>ies>sub-if>dhcp python-policy)

[Tree] (config>service>vprn>sub-if>grp-if>dhcp python-policy)

[Tree] (config>service>vprn>if>dhcp python-policy)

[Tree] (config>service>ies>sub-if>ipv6>dhcp6 python-policy)

[Tree] (config>service>vprn>if>ipv6>dhcp6-relay python-policy)

[Tree] (config>service>vprn>sub-if>ipv6>dhcp6 python-policy)

[Tree] (config>service>ies>if>ipv6>dhcp6-relay python-policy)

Full Context

configure service vprn subscriber-interface python-policy

configure service vprn subscriber-interface dhcp python-policy

configure service ies interface dhcp python-policy

configure service ies subscriber-interface dhcp python-policy

configure service vprn subscriber-interface group-interface dhcp python-policy

configure service vprn interface dhcp python-policy

configure service ies subscriber-interface ipv6 dhcp6 python-policy

configure service vprn interface ipv6 dhcp6-relay python-policy

configure service vprn subscriber-interface ipv6 dhcp6 python-policy

configure service ies interface ipv6 dhcp6-relay python-policy

Description

This command specifies the Python policy to be used for DHCPv6 relay.

The no form of this command reverts to the default.

Parameters

python-name: Specifies the name of an existing python script, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

configure service vprn subscriber-interface ipv6 dhcp6 python-policy
configure service vprn subscriber-interface group-interface dhcp python-policy
configure service ies subscriber-interface ipv6 dhcp6 python-policy
configure service ies subscriber-interface dhcp python-policy
configure service vprn subscriber-interface python-policy
configure service vprn subscriber-interface dhcp python-policy

All

configure service ies interface ipv6 dhcp6-relay python-policy
configure service vprn interface dhcp python-policy
configure service vprn interface ipv6 dhcp6-relay python-policy
configure service ies interface dhcp python-policy

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>service>vprn>sub-if>grp-if>dhcp python-policy)

[Tree] (config>service>ies>sub-if>grp-if>dhcp python-policy)

Full Context

configure service vprn subscriber-interface group-interface dhcp python-policy

configure service ies subscriber-interface group-interface dhcp python-policy

Description

This command specified the Python policy for DHCPv4 packets sent/received on the group interface.

The no form of this command removes the policy name from the configuration.

Parameters

name: Specifies an existing Python policy name, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy policy-name

no python-policy

Context

[Tree] (config>service>vprn>sub-if>grp-if>pppoe python-policy)

[Tree] (config>service>ies>sub-if>grp-if>pppoe python-policy)

Full Context

configure service vprn subscriber-interface group-interface pppoe python-policy

configure service ies subscriber-interface group-interface pppoe python-policy

Description

This command specifies the Python policy for PPPoE packets sent/received on the group interface.

The no form of this command removes the policy name from the configuration.

Parameters

policy-name: Specifies an existing Python policy name, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>subscr-mgmt>gtp>peer-profile python-policy)

Full Context

configure subscriber-mgmt gtp peer-profile python-policy

Description

This command specifies the Python policy for MGW profile packets sent/received on the group interface.

The no form of this command removes the policy name from the configuration.

Default

no python-policy

Parameters

name: Specifies an existing Python policy name up to 32 characters.

Platforms

7750 SR, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy [policy-name]

no python-policy

Context

[Tree] (config>aaa>diam>node python-policy)

Full Context

configure aaa diameter node python-policy

Description

This command specified the python-policy for Diameter messages received or transmitted.

The no form of this command reverts to the default.

Parameters

policy-name: Specifies the name of the Python policy, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy name [create] [wlan-gw-group wlan-gw-group-id] [nat-group nat-group-id]

no python-policy name

Context

[Tree] (config>python python-policy)

Full Context

configure python python-policy

Description

This command creates a new Python policy or enables an existing Python policy configuration context.

There are two types of Python policies: centralized and distributed. A centralized Python policy runs on a CPM, while a distributed Python policy runs on an ISA. With the distributed Python policy, a wlan-gw-group wlan-gw-group-id or a nat-group nat-group-id command must specified.

The no form of this command removes the Python policy from the configuration.

Parameters

name: Specifies the Python policy name up to 32 characters.

create: This keyword is required when first creating the Python policy. Once the context is created, it is possible to navigate into the context without the create keyword.

wlan-gw-group wlan-gw-group-id: Specifies the ID of the WLAN GW group that the distributed python-policy installs.

nat-group nat-group-id: Specifies the ID of the NAT group that the distributed python-policy installs.

Platforms

All

python-policy

Syntax

python-policy policy-name

no python-policy

Context

[Tree] (config>aaa>isa-radius-policy python-policy)

Full Context

configure aaa isa-radius-policy python-policy

Description

This command specifies the Python policy for the ISA RADIUS proxy server. This is the python policy for RADIUS packets to/from the client.

The no form of this command removes the Python policy from the configuration.

Parameters

name: Specifies the Python policy name, up to 32 characters

create: This keyword is required when first creating the Python policy. Once the context is created, it is possible to navigate into the context without the create keyword.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>service>vprn>sub-if>grp-if>ipv6>dhcp6 python-policy)

[Tree] (config>service>ies>sub-if>grp-if>ipv6>dhcp6 python-policy)

Full Context

configure service vprn subscriber-interface group-interface ipv6 dhcp6 python-policy

configure service ies subscriber-interface group-interface ipv6 dhcp6 python-policy

Description

This command specified the Python policy for DHCPv6 packets sent/received on the group interface.

The no form of this command removes the policy name from the configuration.

Parameters

name: Specifies an existing Python policy name, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>aaa>radius-srv-plcy python-policy)

Full Context

configure aaa radius-server-policy python-policy

Description

This command specifies the Python policy for RADIUS packets to/from the RADIUS servers defined in the specified radius-server-policy.

The no form of this command removes the policy name from the configuration.

Parameters

name: Specifies the name of the Python policy, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>service>vprn>radius-proxy>server python-policy)

[Tree] (config>router>radius-proxy>server python-policy)

Full Context

configure service vprn radius-proxy server python-policy

configure router radius-proxy server python-policy

Description

This command specifies the Python policy for RADIUS packets sent/received on the client side of the RADIUS proxy server.

This command supports RADIUS proxy on both CPMs and ISAs.

The no form of this command removes the policy name from the configuration.

Parameters

name: Specifies the name of the Python policy, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>subscr-mgmt>pppoe-client-policy python-policy)

Full Context

configure subscriber-mgmt pppoe-client-policy python-policy

Description

This command applies a Python policy to all messages sent and received by the PPPoE client.

The no form of this command removes the associated Python policy from the PPPoE client.

Parameters

name: The name of a preconfigured Python policy.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy

Syntax

python-policy name

no python-policy

Context

[Tree] (config>service>vprn>if>ipv6 python-policy)

Full Context

configure service vprn interface ipv6 python-policy

Description

This command specifies a python policy. Python policies are configured in the config>python> python-policy name context.

Parameters

name: Specifies the name of an existing python script, up to 32 characters in length.

Platforms

All

python-policy

Syntax

python-policy python-policy-name

no python-policy

Context

[Tree] (config>router>if>dhcp python-policy)

Full Context

configure router interface dhcp python-policy

Description

This command specifies a python policy. Python policies are configured in the config>python>python-policy name context.

Default

no python-policy

Parameters

python-policy-name: Specifies the name of an existing python script, up to 32 characters in length.

Platforms

All

python-policy

Syntax

python-policy policy-name

no python-policy

Context

[Tree] (config>log>log-id python-policy)

Full Context

configure log log-id python-policy

Description

This command associates the Python script with the events sent to this log ID. The Python policy can be associated with the log only if the destination in the log ID is set to syslog.

For information about Python policy configuration, refer to the Python Script Support for ESM in the 7450 ESS, 7750 SR, and VSR Triple Play Service Delivery Architecture Guide.

The no form of this command disables Python processing of the events in this log ID.

Default

no python-policy

Parameters

policy-name: Specifies a Python policy name, up to 32 characters.

Platforms

All

python-policy-cache

Syntax

python-policy-cache

Context

[Tree] (config>system>persistence python-policy-cache)

Full Context

configure system persistence python-policy-cache

Description

This command configures Python policy cache persistency parameters.

Platforms

All

python-script

Syntax

python-script name [create]

no python-script name

Context

[Tree] (config>python python-script)

Full Context

configure python python-script

Description

Commands in this context configure Python scripts to modify messages of different protocols.

The no form of this command removes the Python script name from the configuration.

Parameters

name: Specifies the name of this Python script policy.

create: This keyword is required when first creating the Python script. Once the context is created, it is possible to navigate into the context without the create keyword.

Platforms

All

python-script

Syntax

python-script script-name

Context

[Tree] (debug>python python-script)

Full Context

debug python python-script

Description

Commands in this context debug the specified Python script.

Parameters

policy-name: Specifies the Python script name, up to 32 characters.

Platforms

All