s Commands – Part IV

Context

[Tree] (config>system>security>snmp src-access-list)

Full Context

configure system security snmp src-access-list

Description

This command configures a list of source IP addresses used to validate SNMPv1 and SNMPv2c requests after the list is associated with one or more SNMPv1 and SNMPv2c communities.

A source access list referenced by one or more community instances is used to verify the source IP addresses of an SNMP request using the community, regardless of the VPRN/VRF interface (or "Base” interface) on which the request arrived. For example, if an SNMP request arrives on an interface in VPRN "100" but the request is referencing a community, the source IP address in the packet is validated against the source address list configured for the community. This occurs regardless of whether the request is destined to a VPRN interface address and the VPRN has SNMP access enabled, or the request is destined to the base system address via GRT leaking. If the source IP address of the request message does not match the IP address of any of the src-host entries contained in the list, the request is discarded and logged as an SNMP authentication failure.

A maximum of 16 source access lists can be configured. Each source access lists can contain a maximum of 16 source hosts.

The no form of this command removes the named source access list. Users cannot remove a source access list that is referenced by one or more community instances.

Parameters

list-name

Specifies the name or key of the source access list. This parameter must begin with a letter (a-z or A-Z).

Platforms

All

Context

[Tree] (config>app-assure>group>gtp>gtp-fltr>imsi-apn-fltr>entry src-gsn)

Full Context

configure application-assurance group gtp gtp-filter imsi-apn-filter entry src-gsn

Description

This command configures a matching condition for the GSN IP address. The IP address value is checked only against the source IP address of the GTP packets that contain an APN IE or an IMSI IE.

Parameters

ip address

Specifies a valid unicast address associated with the IMSI-APN filter entry.

Values

ipv4-address	a.b.c.d[/mask]
	mask - [1..32]
ipv6-address	x:x:x:x:x:x:x:x/prefix-length
	x:x:x:x:x:x:d.d.d.d
	x - [0..FFFF]H
	d - [0..255]D
	prefix-length [1..128]

ip-prefix-list-name

Specifies an IP address prefix list for the source IP address match criteria, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>system>security>snmp>src-access-list src-host)

Full Context

configure system security snmp src-access-list src-host

Description

This command configures a source IP address entry used to validate SNMPv1 and SNMPv2c requests.

The no form of this command removes the specified entry.

Parameters

host-name

Specifies a name for the entry, up to 32 characters.

ip-address

Specifies an allowed IPv4 or IPv6 source address for SNMP requests.

Values

ipv4-address —	a.b.c.d (host bits must be 0)
ipv6-address —	x:x:x:x:x:x:x:x (eight 16-bit pieces)
	x:x:x:x:x:x:d.d.d.d
	x — 0 to FFFF (hexadecimal)
	d — 0 to 255 (decimal)

Platforms

All

Context

[Tree] (config>subscr-mgmt>cat-map>category>exh-lvl>egr-ipv6>entry>match src-ip)

[Tree] (config>subscr-mgmt>cat-map>category>exh-lvl>egr-ip>entry>match src-ip)

Full Context

configure subscriber-mgmt category-map category exhausted-credit-service-level egress-ipv6-filter-entries entry match src-ip

configure subscriber-mgmt category-map category exhausted-credit-service-level egress-ip-filter-entries entry match src-ip

Description

This command configures the source IP match condition.

The no form of this command reverts to the default.

Parameters

ipv6-address

Specifies the IPv6 address (applies only to the 7750 SR).

Values

ipv6-address	x:x:x:x:x:x:x:x (where x is [0 to FFFF]H)
	x:x:x:x:x:x:d.d.d.d (where d is [0 to 255]D)

prefix-length

Specifies the prefix length (applies only to the 7750 SR).

Values

1 to 128

ip-address/mask

Specifies the IPv4 address and mask.

Values

ip-address a.b.c.d

mask 0 to 32

netmask

Specifies the mask, expressed as a dotted quad.

Values

a.b.c.d

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>redundancy>mc>peer>mcr>l3ring>node>cv src-ip)

Full Context

configure redundancy multi-chassis peer mc-ring l3-ring ring-node connectivity-verify src-ip

Description

This command specifies the source IP address used in ring-node connectivity verification of this ring node.

The no form of this command reverts to the default.

Parameters

ip-address

Specifies the source IP address used in ring-node connectivity verification of this ring node.

Platforms

All

Context

[Tree] (config>redundancy>mc>peer>mcr>node>cv src-ip)

Full Context

configure redundancy multi-chassis peer mc-ring ring ring-node connectivity-verify src-ip

Description

This command specifies the source IP address used in the ring-node connectivity verification of this ring node.

Default

no src-ip

Parameters

ip-address

Specifies the source IP address.

Values

a.b.c.d (no multicast address)

Platforms

All

Context

[Tree] (config>app-assure>group>policy>aqp>entry>match src-ip)

Full Context

configure application-assurance group policy app-qos-policy entry match src-ip

Description

This command specifies a source TCP/UDP address to use as match criteria.

Default

no src-ip

Parameters

eq

Specifies that a successful match occurs when the flow matches the specified address or prefix.

neq

Specifies that a successful match occurs when the flow does not match the specified address or prefix.

ip-address

Specifies a valid unicast address.

Values

ipv4-address	a.b.c.d[/mask]
	mask - [1..32]
ipv6-address	x:x:x:x:x:x:x:x/prefix-length
	x:x:x:x:x:x:d.d.d.d
	x - [0..FFFF]H
	d - [0..255]D
	prefix-length [1..128]

ip-prefix-list-name

Specifies an IP prefix list name, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>app-assure>group>sess-fltr>entry>match src-ip)

Full Context

configure application-assurance group session-filter entry match src-ip

Description

This command specifies a source TCP/UDP address to use as match criteria.

Default

no src-ip

Parameters

ip-address

Specifies a valid unicast address.

Values

ipv4-address	a.b.c.d[/mask]
	mask - [1..32]
ipv6-address	x:x:x:x:x:x:x:x/prefix-length
	x:x:x:x:x:x:d.d.d.d
	x - [0..FFFF]H
	d - [0..255]D
	prefix-length [1..128]

ip-prefix-list-name

Specifies an IP prefix list name, up to 32 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (debug>app-assure>group>traffic-capture>match src-ip)

Full Context

debug application-assurance group traffic-capture match src-ip

Description

This command configures debugging on a source IP address.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>li>li-filter>li-ip-filter>entry>match src-ip)

Full Context

configure li li-filter li-ip-filter entry match src-ip

Description

This command configures source IP address LI filter match criterion.

The no form of this command removes any configured source IP. The match criterion is ignored.

Parameters

ip-address

Specifies an address specified as dotted quad.

Values

a.b.c.d

mask

Specifies eight 16-bit hexadecimal pieces representing bit match criteria.

Values

1 to 32

ipv4-address-mask

Any mask expressed in dotted quad notation.

Values

0.0.0.0 to 255.255.255.255

Platforms

All

Context

[Tree] (config>li>li-filter>li-ipv6-filter>entry>match src-ip)

Full Context

configure li li-filter li-ipv6-filter entry match src-ip

Description

This command configures source IPv6 address LI filter match criterion.

The no form of this command removes any configured source IPv6 address. The match criterion is ignored.

Parameters

ipv6-address

Specifies an IPv6 address entered as:.

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x - [0 to FFFF]H

d - [0 to 255]D

prefix-length

Specifies a length.

Values

1 to 128

ipv6-address-mask

Specifies an IPv6 address mask expressed as:

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x - [0 to FFFF]H

d - [0 to 255]D

Platforms

All

Context

[Tree] (config>qos>sap-egress>ip-criteria>entry>match src-ip)

[Tree] (config>qos>sap-ingress>ip-criteria>entry>match src-ip)

Full Context

configure qos sap-egress ip-criteria entry match src-ip

configure qos sap-ingress ip-criteria entry match src-ip

Description

This command configures a source IPv4 address range to be used as an SAP QoS policy match criterion.

To match on the source IPv4 or IPv6 address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used for IPv4.

The no form of this command removes the source IPv4 or IPv6 address match criterion.

Default

no src-ip

Parameters

ip-address

Specifies the source IPv4 address specified in dotted decimal notation.

Values

ip-address: a.b.c.d

mask

Specifies the length in bits of the subnet mask.

Values

1 to 32

ipv4-address-mask

Specifies the subnet mask in dotted decimal notation.

Values

a.b.c.d (dotted quad equivalent of mask length)

prefix-list-name

Specifies the IPv4 prefix list name, a string of up to 32 printable ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.

Platforms

All

Context

[Tree] (config>qos>sap-ingress>ipv6-criteria>entry>match src-ip)

[Tree] (config>qos>sap-egress>ipv6-criteria>entry>match src-ip)

Full Context

configure qos sap-ingress ipv6-criteria entry match src-ip

configure qos sap-egress ipv6-criteria entry match src-ip

Description

This command configures a source IPv6 address range to be used as an SAP QoS policy match criterion.

To match on the source IPv6 address, specify the address and its associated mask, for example, 2001:db8:1000::/64.

The no form of this command removes the source IPv6 address match criterion.

Default

no src-ip

Parameters

ipv6-address

Specifies the IPv6 address for the IP match criterion in hexadecimal digits.

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces) x:x:x:x:x:x:d.d.d.d x: [0 to FFFF]H d: [0 to 255]D

prefix-length

Specifies the IPv6 prefix length for the IPv6 address expressed as a decimal integer.

Values

1 to 128

ipv6-address-mask

Specifies the IPv6 address mask.

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x: [0 to FFFF]H

d: [0 to 255]D

ipv6-prefix-list-name

Specifies the IPv6 prefix list name, a string of up to 32 printable ASCII characters. If the string contains special characters (#, ?, space), the entire string must be enclosed within double quotes.

Platforms

All

Context

[Tree] (config>qos>network>egress>ip-criteria>entry>match src-ip)

[Tree] (config>qos>network>egress>ipv6-criteria>entry>match src-ip)

[Tree] (config>qos>network>ingress>ip-criteria>entry>match src-ip)

[Tree] (config>qos>network>ingress>ipv6-criteria>entry>match src-ip)

Full Context

configure qos network egress ip-criteria entry match src-ip

configure qos network egress ipv6-criteria entry match src-ip

configure qos network ingress ip-criteria entry match src-ip

configure qos network ingress ipv6-criteria entry match src-ip

Description

This command configures a source IPv4 or IPv6 address range to be used as a network QoS policy match criterion.

To match on the source IPv4 or IPv6 address, specify the address and its associated mask, for example, when specifying an IPv4 address, 10.1.0.0/16 or 10.1.0.0 255.255.0.0 can be used.

The no form of this command removes the source IPv4 or IPv6 address match criterion.

Parameters

ip-address

Specifies the source IPv4 address specified in dotted decimal notation.

Values

ip-address: a.b.c.d

mask

Specifies the length in bits of the subnet mask.

Values

1 to 32

ipv4-address-mask

Specifies the subnet mask in dotted decimal notation.

Values

a.b.c.d (dotted quad equivalent of mask length)

ip-prefix-list-name

Specifies an IPv4 prefix list which contains IPv4 address prefixes to be matched.

Values

A string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

ipv6-address

Specifies the IPv6 prefix for the IP match criterion in hex digits.

Values

ipv6-address:	x:x:x:x:x:x:x:x (eight 16-bit pieces)
	x:x:x:x:x:x:d.d.d.d
	x: [0 to FFFF]H
	d: [0 to 255]D

mask

Specifies the length of the ipv6-address expressed as a decimal integer.

Values

1 to 128

ipv6-address-mask

Specifies the eight 16-bit hexadecimal pieces representing bit match criteria.

Values

x:x:x:x:x:x:x (eight 16-bit pieces)

ipv6-prefix-list-name

Specifies an IPv6 prefix list which contains IPv6 address prefixes to be matched.

Values

A string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

Platforms

All

Context

[Tree] (config>filter>ipv6-exception>entry>match src-ip)

[Tree] (config>filter>ip-exception>entry>match src-ip)

[Tree] (config>filter>ipv6-filter>entry>match src-ip)

Full Context

configure filter ipv6-exception entry match src-ip

configure filter ip-exception entry match src-ip

configure filter ipv6-filter entry match src-ip

Description

This command configures a source IPv4 or IPv6 address range to be used as an IP filter or IP exception match criterion.

To match on the source IPv4 or IPv6 address, specify the address and its associated mask, for example, 10.1.0.0/16 for IPv4. The conventional notation of 10.1.0.0 255.255.0.0 may also be used for IPv4.

The no form of the command removes the source IP address match criterion.

Default

no src-ip

Parameters

ip-address

Specifies the destination IPv4 address specified in dotted decimal notation.

Values

a.b.c.d

mask

Specifies the length in bits of the subnet mask.

Values

1 to 32

ipv4-address-mask

Specifies the subnet mask in dotted decimal notation.

Values

a.b.c.d (dotted quad equivalent of mask length)

ip-prefix-listoripv6-prefix-list prefix-list-name

Specifies to use a list of IP prefixes, which is a string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

ipv6-address

Specifies an IPv6 prefix for the IP match criterion in hex digits.

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x: [0..FFFF]H

d: [0..255]D

prefix-length

Specifies whether a the IPv6 prefix length for the specified ipv6-address expressed as a decimal integer.

Values

1 to 128

ipv6-address-mask

Specifies eight 16-bit hexadecimal pieces representing bit match criteria.

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x: [0..FFFF]H

d: [0..255]D

Platforms

VSR

• configure filter ip-exception entry match src-ip
• configure filter ipv6-exception entry match src-ip

All

• configure filter ipv6-filter entry match src-ip

Context

[Tree] (config>system>security>mgmt-access-filter>ip-filter>entry src-ip)

Full Context

configure system security management-access-filter ip-filter entry src-ip

Description

This command configures a source IP address range or an IP prefix list to be used as a management access filter match criterion.

The no form of this command removes the source IP address match criterion.

Default

no src-ip

Parameters

ip-prefix

Specifies the IP prefix for the IP match criterion in dotted decimal notation.

mask

Specifies the subnet mask length expressed as a decimal integer.

Values

1 to 32 (mask length), 0.0.0.0 to 255.255.255.255 (dotted decimal)

netmask

Specifies the dotted quad equivalent of the mask length.

Values

0.0.0.0 to 255.255.255.255

ip-prefix-list-name

Specifies the IP prefix list used as a match criterion for the source IP address. It is a string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes .

Platforms

All

Context

[Tree] (config>system>security>mgmt-access-filter>ipv6-filter>entry src-ip)

Full Context

configure system security management-access-filter ipv6-filter entry src-ip

Description

This command configures a source IPv6 address range or an IPv6 prefix list to be used as a management access filter match criterion. This command only applies to the 7750 SR and 7950 XRS.

The no form of this command removes the source IPv6 address match criterion.

Default

no src-ip

Parameters

ipv6-address/prefix-length

Specifies the IPv6 address for the IPv6 match criterion in dotted decimal notation. An IPv6 IP address is written as eight 4-digit (16-bit) hexadecimal numbers separated by colons. One string of zeros per address can be left out, so that 2001:db8::0:217A is the same as 2001:db8:0:0:0:0:0:217A.

Values

ipv6-address	x:x:x:x:x:x:x:x (eight 16-bit pieces)
	x:x:x:x:x:x:d.d.d.d
	x: [0..FFFF]H
	d: [0..255]D
prefix-length	1 to 128

ipv6-prefix-list-name

Specifies the IPv6 prefix list used a match criterion for the source IP address. It is a string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes .

Platforms

All

Context

[Tree] (cfg>sys>sec>cpm>ip-filter>entry>match src-ip)

Full Context

configure system security cpm-filter ip-filter entry match src-ip

Description

This command specifies the IP address to match the source IP address of the packet.

To match on the source IP address, specify the address and its associated mask, such as 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The no form of this command removes the source IP address match criterion.

Default

no src-ip

Parameters

ipv6-address/prefix-length

Specifies the IP address for the match criterion in dotted decimal notation. An IP address is written as eight 4-digit (16-bit) hexadecimal numbers separated by colons. One string of zeros per address can be left out, so that 2001:db8::0:217A is the same as 2001:db8:0:0:0:0:0:217A.

Values

ipv4-address	a.b.c.d (host bits must be 0)
	x:x:x:x:x:x:d.d.d.d[-interface]
	x: [0..FFFF]H
	d: [0..255]D
	interface: 32 characters maximum, mandatory for link local addresses
prefix-length	1 to 128

ip-prefix-list

Creates a list of IPv4 prefixes for match criteria in IPv4 ACL and CPM filter policies.

ip-prefix-list-name

Specifies a string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (cfg>sys>sec>cpm>ipv6-filter>entry>match src-ip)

Full Context

configure system security cpm-filter ipv6-filter entry match src-ip

Description

This command specifies the IPv6 address to match the source IPv6 address of the packet.

To match on the source IP address, specify the address and its associated mask, such as 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The no form of this command removes the source IP address match criterion.

This command only applies to the 7750 SR and 7950 XRS.

Default

no src-ip

Parameters

ip-address/mask

Specifies the IP address for the match criterion in dotted decimal notation. An IP address is written as eight 4-digit (16-bit) hexadecimal numbers separated by colons. One string of zeros per address can be left out, so that 2001:db8::0:217A is the same as 2001:db8:0:0:0:0:0:217A.

Values

ipv6-address	x:x:x:x:x:x:x:x[-interface]
	x:x:x:x:x:x:d.d.d.d[-interface]
	x: [0..FFFF]H
	d: [0..255]D
	interface: 32 characters maximum, mandatory for link local addresses
mask:	Specifies eight 16-bit hexadecimal pieces representing bit match criteria.
	Values	x:x:x:x:x:x:x (eight 16-bit pieces)

ipv6-prefix-list

Creates a list of IPv6 prefixes for match criteria in IPv6 ACL and CPM filter policies.

ipv6-prefix-list-name

Specifies a string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>saa>test>type-multi-line>lsp-ping src-ip-address)

[Tree] (config>saa>test>type-multi-line>lsp-trace>sr-policy src-ip-address)

[Tree] (config>saa>test>type-multi-line>lsp-ping>sr-policy src-ip-address)

Full Context

configure saa test type-multi-line lsp-ping src-ip-address

configure saa test type-multi-line lsp-trace sr-policy src-ip-address

configure saa test type-multi-line lsp-ping sr-policy src-ip-address

Description

This command configures the source IP address. This option is used when an OAM packet must be generated from a different address than the node’s system interface address. For example, when the OAM packet is sent over an LDP LSP and the LDP LSR-ID of the corresponding LDP session to the next hop is set to an address other than the system interface address.

The no form of this command removes the configuration.

Parameters

ip-address

Specifies the source IP address.

Values

ipv4-address: a.b.c.d
ipv6-address: x:x:x:x:x:x:x:x (eight 16-bit pieces)
		x:x:x:x:x:x:d.d.d.d
		x - [0 to FFFF]H
		d - [0 to 255]D

Platforms

All

Context

[Tree] (debug>oam>build-packet>packet>field-override>header>ipv4 src-ipv4-address)

[Tree] (config>test-oam>build-packet>header>ipv4 src-ipv4-address)

Full Context

debug oam build-packet packet field-override header ipv4 src-ipv4-address

configure test-oam build-packet header ipv4 src-ipv4-address

Description

This command defines the source IPv4 address to be used in the IPv4 header.

The no form of this command removes the source IPv4 address.

Default

src-ipv4-address 0.0.0.0

Parameters

a.b.c.d

Specifies the IPv4 source address to be used in the IPv4 header.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (debug>oam>build-packet>packet>field-override>header>ipv6 src-ipv6-address)

[Tree] (config>test-oam>build-packet>header>ipv6 src-ipv6-address)

Full Context

debug oam build-packet packet field-override header ipv6 src-ipv6-address

configure test-oam build-packet header ipv6 src-ipv6-address

Description

This command defines the source IPv6 address to be used in the IPv6 header.

The no form of the removes the source IPv6 address.

Parameters

ipv6-address

Specifies the IPv6 source address to be used in the IPv6 header.

Values

ipv6-address:	x:x:x:x:x:x:x:x (eight 16-bit pieces)
	x:x:x:x:x:x:d.d.d.d
	x:	0 to FFFF]H
	d:	[0 to 255]D

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>redundancy>mc>peer>mcr>l3ring>node>cv src-mac)

Full Context

configure redundancy multi-chassis peer mc-ring l3-ring ring-node connectivity-verify src-mac

Description

This command specifies the source MAC address used for the ring-node connectivity verification of this ring node.

If all zeros are specified, the MAC address of the system management processor (CPM) is used.

The no form of this command reverts to the default.

Parameters

ieee-address

Specifies the 48-bit MAC address for the static ARP in the form aa:bb:cc:dd:ee:ff or aa-bb-cc-dd-ee-ff where aa, bb, cc, dd, ee, and ff are hexadecimal numbers. Allowed values are any non-broadcast, non-multicast MAC and non-IEEE reserved MAC addresses.

Platforms

All

Context

[Tree] (config>redundancy>mc>peer>mcr>node>cv src-mac)

Full Context

configure redundancy multi-chassis peer mc-ring ring ring-node connectivity-verify src-mac

Description

This command specifies the source MAC address used for the Ring-Node Connectivity Verification of this ring node.

A value of all zeros (000000000000 H (0:0:0:0:0:0)) specifies that the MAC address of the system management processor (CPM) is used.

Default

no src-mac

Parameters

ieee-address

Specifies the source MAC address.

Values

xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx

Platforms

All

Context

[Tree] (config>li>li-filter>li-mac-filter>entry>match src-mac)

Full Context

configure li li-filter li-mac-filter entry match src-mac

Description

This command configures a source MAC address or range to be used as a MAC filter match criterion.

The no form of this command removes the source mac as the match criteria.

Parameters

ieee-address

Specifies the 48-bit IEEE mac address to be used as a match criterion.

Values

HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is a hexadecimal digit

ieee-address-mask

Specifies a 48-bit mask. The following table describes the format styles to configure the 48-bit mask.

Table 1. Format Styles to Configure Mask

Format Style	Format Syntax	Example
Decimal	DDDDDDDDDDDDDD	281474959933440
Hexadecimal	0xHHHHHHHHHHHH	0x0FFFFF000000
Binary	0bBBBBBBB...B	0b11110000...B

To configure so that all packets with a source MAC OUI value of 00-03-FA are subject to a match condition then the entry should be specified as: 003FA000000 0xFFFFFF000000

Default

0xFFFFFFFFFFFF (exact match)

Values

0x00000000000000 to 0xFFFFFFFFFFFF

Platforms

All

Context

[Tree] (config>qos>sap-ingress>mac-criteria>entry>match src-mac)

Full Context

configure qos sap-ingress mac-criteria entry match src-mac

Description

This command configures a source MAC address or range to be used as a service ingress QoS policy match criterion.

The no form of this command removes the source mac as the match criteria.

Default

no src-mac

Parameters

ieee-address

Enter the 48-bit IEEE MAC address to be used as a match criterion.

Values

HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is a hexadecimal digit

ieee-address-mask

This 48-bit mask can be configured using the following formats:

Table 2. Format Styles to Configure Mask

Format Style	Format Syntax	Example
Decimal	DDDDDDDDDDDDDD	281474959933440
Hexadecimal	0xHHHHHHHHHHHH	0x0FFFFF000000
Binary	0bBBBBBBB...B	0b11110000...B

To configure all packets with a source MAC OUI value of 00-03-FA to be subject to a match condition, the entry should be specified as: 003FA000000 0xFFFFFF000000

Values

0x00000000000000 to 0xFFFFFFFFFFFF (hex)

Default

0xFFFFFFFFFFFF (hex) (exact match)

Platforms

All

Context

[Tree] (config>filter>ip-filter>entry>match src-mac)

[Tree] (config>filter>ipv6-filter>entry>match src-mac)

[Tree] (config>filter>mac-filter>entry>match src-mac)

Full Context

configure filter ip-filter entry match src-mac

configure filter ipv6-filter entry match src-mac

configure filter mac-filter entry match src-mac

Description

Configures a source MAC address or range to be used as a MAC filter match criterion.

The no form of the command removes the source mac as the match criteria.

Default

no src-mac

Parameters

ieee-address

Specifies the 48-bit IEEE MAC address to be used as a match criterion.

Values

HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is a hexadecimal digit; both upper and lower case are supported.

ieee-address-mask

Specifies the 48-bit mask to match a range of MAC address values.

To configure so that all packets with a source MAC OUI value of 00:03:FA are subject to a match condition then the entry should be specified as: 00:03:FA:00:00:00 FF:FF:FF:00:00:00

Default

ff:ff:ff:ff:ff:ff (exact match)

Values

HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is an hexadecimal digit; both upper and lower case are supported.

Platforms

All

Context

[Tree] (config>system>security>mgmt-access-filter>mac-filter>entry>match src-mac)

Full Context

configure system security management-access-filter mac-filter entry match src-mac

Description

This command configures a source MAC address or range to be used as a MAC filter match criterion.

The no form of this command removes the source mac as the match criteria.

Default

no src-mac

Parameters

ieee-address

Specifies the 48-bit IEEE mac address to be used as a match criterion.

Values

HH:HH:HH:HH:HH:HH or HH-HH-HH-HH-HH-HH where H is a hexadecimal digit

ieee-address-mask

Specifies a 48-bit mask that can be configured using the formats listed in ieee-address-mask Formats:

Table 3. ieee-address-mask Formats

Format Style	Format Syntax	Example
Decimal	DDDDDDDDDDDDDD	281474959933440
Hexadecimal	0xHHHHHHHHHHHH	0x0FFFFF000000
Binary	0bBBBBBBB...B	0b11110000...B

To configure so that all packets with a source MAC OUI value of 00-03-FA are subject to a match condition then the entry should be specified as: 003FA000000 0xFFFFFF000000

Default

0xFFFFFFFFFFFF (exact match)

Values

0x00000000000000 to 0xFFFFFFFFFFFF

Platforms

All

Context

[Tree] (debug>oam>build-packet>packet>field-override>header>ethernet src-mac-address)

[Tree] (config>test-oam>build-packet>header>ethernet src-mac-address)

Full Context

debug oam build-packet packet field-override header ethernet src-mac-address

configure test-oam build-packet header ethernet src-mac-address

Description

This command defines the source MAC address for the Ethernet header.

The no form of this command deletes the configured MAC address.

Default

no override

Parameters

ieee-address

Specifies the source Ethernet MAC address to be used in the Ethernet header. Specifies the 48-bit MAC address.

Values

xx:xx:xx:xx:xx:xx

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>subscr-mgmt>cat-map>category>exh-lvl>ingr-ip>entry>match src-port)

[Tree] (config>subscr-mgmt>cat-map>category>exh-lvl>ingr-ipv6>entry>match src-port)

[Tree] (config>subscr-mgmt>cat-map>category>exh-lvl>egr-ipv6>entry>match src-port)

[Tree] (config>subscr-mgmt>cat-map>category>exh-lvl>egr-ip>entry>match src-port)

Full Context

configure subscriber-mgmt category-map category exhausted-credit-service-level ingress-ip-filter-entries entry match src-port

configure subscriber-mgmt category-map category exhausted-credit-service-level ingress-ipv6-filter-entries entry match src-port

configure subscriber-mgmt category-map category exhausted-credit-service-level egress-ipv6-filter-entries entry match src-port

configure subscriber-mgmt category-map category exhausted-credit-service-level egress-ip-filter-entries entry match src-port

Description

This command configures the source port match condition.

The no form of this command reverts to the default.

Parameters

lt | gt | eq

Specifies the operators.

src-port-number

Specifies the source port number as a decimal hex or binary.

Values

0 to 65535

dst-port-number

Specifies the destination port number as a decimal hex or binary.

Values

0 to 65535

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>app-assure>group>policy>aqp>entry>match src-port)

Full Context

configure application-assurance group policy app-qos-policy entry match src-port

Description

This command specifies a source IP port, source port list, or source range to use as match criteria.

The no form of this command removes the parameters from the configuration.

Default

no src-port

Parameters

eq

Specifies that a successful match occurs when the flow matches the specified port.

neq

Specifies that a successful match occurs when the flow does not match the specified port.

port-num

Specifies the source port number.

Values

0 to 65535

start-port-num end-port-num

Specifies the start or end source port number.

Values

0 to 65535

port-list-name

Specifies a named port-list, up to 32 characters, containing a set of ports or ranges of ports.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>app-assure>group>sess-fltr>entry>match src-port)

Full Context

configure application-assurance group session-filter entry match src-port

Description

This command specifies a source IP port, source port list, or source range to use as match criteria.

The no form of this command removes the parameters from the configuration.

Default

no src-port

Parameters

eq

Specifies that a successful match occurs when the flow matches the specified port.

gt

Specifies all port numbers greater than the port-number match.

lt

Specifies all port numbers less than the port-number match.

port-num

Specifies the source port number.

Values

0 to 65535

start-port-num end-port-num

Specifies the start or end source port number.

Values

0 to 65535

port-list-name

Specifies a named port-list, up to 32 characters, containing a set of ports or ranges of ports.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (debug>app-assure>group>traffic-capture>match src-port)

Full Context

debug application-assurance group traffic-capture match src-port

Description

This command configures debugging on a source port.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>li>li-filter>li-ip-filter>entry>match src-port)

[Tree] (config>li>li-filter>li-ipv6-filter>entry>match src-port)

Full Context

configure li li-filter li-ip-filter entry match src-port

configure li li-filter li-ipv6-filter entry match src-port

Description

This command configures a source TCP or UDP port number or port range for an IP LI filter match criterion. Note that an entry containing Layer 4 match criteria will not match non-initial (second, third, and so on) fragments of a fragmented packet since only the first fragment contains the Layer 4 information.

The no form of this command removes the source port match criterion.

Parameters

lt

Specifies all port numbers less than src-port-number match.

gt

Specifies all port numbers greater than src-port-number match.

eq

Specifies that src-port-number must be an exact match.

src-port-number

Specifies the source port number to be used as a match criteria expressed as a decimal integer.

Values

[0..65535]D

[0x0..0xFFFF]H

[0b0..0b1111111111111111]B

Platforms

All

Context

[Tree] (config>qos>sap-egress>ip-criteria>entry>match src-port)

[Tree] (config>qos>sap-ingress>ipv6-criteria>entry>match src-port)

[Tree] (config>qos>sap-egress>ipv6-criteria>entry>match src-port)

[Tree] (config>qos>sap-ingress>ip-criteria>entry>match src-port)

Full Context

configure qos sap-egress ip-criteria entry match src-port

configure qos sap-ingress ipv6-criteria entry match src-port

configure qos sap-egress ipv6-criteria entry match src-port

configure qos sap-ingress ip-criteria entry match src-port

Description

This command configures a source TCP or UDP port number or port range for a SAP QoS policy match criterion.

The no form of this command removes the source port match criterion.

Default

no src-port

Parameters

{lt | gt | eq} src-port-number

The TCP or UDP port numbers to match, specified as less than (lt), greater than (gt), or equal to (eq) to the source port value, specified as a decimal integer.

Values

1 to 65535 (decimal)

range startend

The range of TCP or UDP port values to match, specified as between the start and end source port values inclusive.

Values

1 to 65535 (decimal)

Platforms

All

Context

[Tree] (config>qos>network>ingress>ip-criteria>entry>match src-port)

[Tree] (config>qos>network>egress>ipv6-criteria>entry>match src-port)

[Tree] (config>qos>network>egress>ip-criteria>entry>match src-port)

[Tree] (config>qos>network>ingress>ipv6-criteria>entry>match src-port)

Full Context

configure qos network ingress ip-criteria entry match src-port

configure qos network egress ipv6-criteria entry match src-port

configure qos network egress ip-criteria entry match src-port

configure qos network ingress ipv6-criteria entry match src-port

Description

This command configures a source TCP or UDP port number, port range, or a port list for a network QoS policy match criterion.

The no form of this command removes the source port match criterion.

Default

no src-port

Parameters

lt

Keyword used to specify TCP or UDP port numbers to match that are less than the source port value.

gt

Keyword used to specify TCP or UDP port numbers to match that are greater than the source port value.

eq

Keyword used to specify TCP or UDP port numbers to match that are equal to the source port value.

src-port-number

The source port value, specified as a decimal integer.

Values

1 to 65535

port-list-name

Specifies a port list name, up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

start

Specifies the starting range of TCP or UDP source port values to match.

Values

1 to 65535

end

Specifies the end range of TCP or UDP source port values to match.

Values

1 to 65535

Platforms

All

Context

[Tree] (config>filter>ip-exception>entry>match src-port)

[Tree] (config>filter>ipv6-filter>entry>match src-port)

[Tree] (config>filter>ip-filter>entry>match src-port)

[Tree] (config>filter>ipv6-exception>entry>match src-port)

Full Context

configure filter ip-exception entry match src-port

configure filter ipv6-filter entry match src-port

configure filter ip-filter entry match src-port

configure filter ipv6-exception entry match src-port

Description

This command configures a source TCP, UDP, or SCTP port number, port range, or port match list for an IP filter or IP exception match criterion. An entry containing Layer 4 non-zero match criteria will not match non-initial (2nd, 3rd, and so on) fragments of a fragmented packet since only the first fragment contains the Layer 4 information. Similarly an entry containing "src-port eq 0" match criterion, may match non-initial fragments when the source port value is not present in a packet fragment and other match criteria are also met.

The no form of the command removes the source port match criterion.

Default

no src-port

Parameters

lt | gt | eq

Specifies the operator to use relative to src-port-number for specifying the port number match criteria.

lt specifies that all port numbers less than src-port-number match.

gt specifies that all port numbers greater than src-port-number match.

eq specifies that src-port-number must be an exact match.

src-port-number

Specifies the source port number to be used as a match criteria expressed as a decimal integer, and in hexadecimal or binary format. Below shows decimal integer only.

Values

0 to 65535

port-list-name

Specifies to use a list of ports referred to by port-list-name, which is a string of up to 32 characters of printable ASCII characters. If special characters are used, the string must be enclosed within double quotes.

src-port-number src-port-number

Specifies inclusive port range between two src-port-number values.

Platforms

VSR

• configure filter ipv6-exception entry match src-port
• configure filter ip-exception entry match src-port

All

• configure filter ip-filter entry match src-port
• configure filter ipv6-filter entry match src-port

Context

[Tree] (config>system>security>mgmt-access-filter>ipv6-filter>entry src-port)

[Tree] (config>system>security>mgmt-access-filter>ip-filter>entry src-port)

Full Context

configure system security management-access-filter ipv6-filter entry src-port

configure system security management-access-filter ip-filter entry src-port

Description

This command restricts ingress management traffic to either the CPM/CCM Ethernet port or any other logical port (for example LAG) on the device.

When the source interface is configured, only management traffic arriving on those ports satisfy the match criteria.

The no form of this command reverts to the default value.

Default

no src-port

Parameters

port-id

Specifies the port ID in formats shown below.

Values

slot/mda/port[.channel]
	aps	keyword
	group-id	1 to 128
ccag-id	ccag-id. path-id[cc-type]
	ccag	keyword
	id	1 to 8
	path-id	a, b
	cc-type	.sap-net, .net-sap

cpm

Matches any traffic received on any Ethernet port.

lag-id

Specifies the LAG identifier.

Values

1 to 800

Platforms

All

Context

[Tree] (cfg>sys>sec>cpm>ip-filter>entry>match src-port)

[Tree] (cfg>sys>sec>cpm>ipv6-filter>entry>match src-port)

Full Context

configure system security cpm-filter ip-filter entry match src-port

configure system security cpm-filter ipv6-filter entry match src-port

Description

This command specifies the TCP/UDP port to match the source port of the packet.

Default

no src-port

Parameters

tcp/udp port-number

Specifies the source port number to be used as a match criteria expressed as a decimal integer.

Values

0 to 65535

port-list-name

Specifies the port list name to be used as a match criteria for the destination port.

mask

Specifies the 16 bit mask to be applied when matching the destination port.

Values

[0x0000..0xFFFF] | [0..65535] | [0b0000000000000000..0b1111111111111111]

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>service>vprn>mvpn>red-source-list src-prefix)

Full Context

configure service vprn mvpn red-source-list src-prefix

Description

This command configures multicast source IPv4 prefixes for preferred source selection. Single or multi-line inputs are allowed.

The no form of this command deletes specified prefix from the list.

Default

No prefixes are specified.

Parameters

ip-address/mask

IPv4 address prefix with mask. Up to 8 maximum.

Platforms

All

Context

[Tree] (config>service>vprn>mvpn>red-source-list>ipv6 src-prefix)

Full Context

configure service vprn mvpn red-source-list ipv6 src-prefix

Description

This command configures multicast source IPv6 prefixes for preferred source selection. Single or multi-line inputs are allowed.

The no form of this command deletes specified prefix from the list

Default

No prefixes are specified.

Parameters

ipv6-ip-address/mask

IPv6 address prefix with prefix-length. Up to 8 maximum.

Platforms

All

Context

[Tree] (config>filter>ip-filter>entry>match src-route-option)

Full Context

configure filter ip-filter entry match src-route-option

Description

This command enables source route option match conditions. When enabled, this filter should match if a (strict or loose) source route option is present/not present at any location within the IP header, as per the value of this object. The no form of the command removes the criterion from the match entry.

Default

no src-route-option

Parameters

true

Enables source route option match conditions.

false

Disables source route option match conditions.

Platforms

All

Context

[Tree] (config>test-oam>build-packet>header>tcp src-tcp-port)

Full Context

configure test-oam build-packet header tcp src-tcp-port

Description

This command defines the source TCP port to be used in the test TCP header.

The no form of this command reverts to the default.

Default

src-tcp-port 0

Parameters

tcp-port

Specifies the source TCP port to be used in the test TCP header.

Values

0 to 65535

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (debug>oam>build-packet>packet>field-override>header>tcp src-tcp-port)

Full Context

debug oam build-packet packet field-override header tcp src-tcp-port

Description

This command defines the source TCP port to be used in the TCP header.

The no form of this command reverts to the default.

Default

no override

Parameters

tcp-port

Specifies the source TCP port to be used in the test TCP header.

Values

0 to 65535

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>test-oam>build-packet>header>udp src-udp-port)

Full Context

configure test-oam build-packet header udp src-udp-port

Description

This command defines the source UDP port to be used in the test UDP header.

The no form of this command reverts to the default.

Default

src-udp-port 0

Parameters

udp-port

Specifies the source UDP port to be used in the test UDP header.

Values

0 to 65535

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (debug>oam>build-packet>packet>field-override>header>udp src-udp-port)

Full Context

debug oam build-packet packet field-override header udp src-udp-port

Description

This command defines the source UDP port to be used in the UDP header.

The no form of this command reverts to the default.

Default

no override

Parameters

udp-port

Specifies the source UDP port to be used in the UDP header.

Values

0 to 65535

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>test-oam>link-meas>template>twl src-udp-port)

Full Context

configure test-oam link-measurement measurement-template twamp-light src-udp-port

Description

This command configures a source UDP port to be used by the link measurement tests linked to this template.

Unless required, Nokia suggests that the link measurement dynamically select an available source UDP port from the dynamic range. Before a UDP port in the configurable range can be configured as a source it must be owned by the application. Use the config>test-oam>twamp>twamp-light> source-udp-port-pools>port>pool-type command to map the port range to the application.

To use a source port in this range for link-measurement, the selected port number must have a pool-type link-measurement configured. The source UDP port must be owned by the application prior to the configuration under the application. A configured source-udp-port cannot be used when multiple tests are configured between the same source IP, destination IP and destination UDP port. A conflict may occur when non-unique addressing is used between two peers. A conflicting situation may occur when tests between peers are using IPv6 discovery and the link-local addresses on both nodes are the same. Other conflicts exist, such as, multiple tests between peers using the same source and destination IP system address instead of an interface address. When this condition exists, the operational state of the link-measurement test is operationally down with a failure condition UdpPortUnavailable.

The no form of the command removes the port number from the link measurement template.

Default

no src-udp-port

Parameters

port-number

Specifies the source UDP port number.

Values

64374 to 64383

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>test-oam>lag-meas>template>twl src-udp-port)

Full Context

configure test-oam lag-ip-measurement lag-ip-measurement-template twamp-light src-udp-port

Description

This command configures the source UDP port for the test packets. When a port is not specified using this command, the system dynamically allocates the UDP port from the dynamic range. This command should only be specified when required for interoperability. Otherwise, the default allocation from the dynamic range should be used.

The no form of this command allocates the source UDP port from the dynamic range.

Default

no src-udp-port

Parameters

port-number

Specifies the source UDP port number.

Values

64374 to 64383

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (debug>router>rsvp>packet srefresh)

Full Context

debug router rsvp packet srefresh

Description

This command debugs srefresh packets.

The no form of the command disables the debugging.

Parameters

detail

Displays detailed information about srefresh packets.

Platforms

All

Context

[Tree] (conf>router>segment-routing>srv6>ms-locator>un srh-mode)

[Tree] (config>router>segment-routing>srv6>inst>loc>func>end srh-mode)

[Tree] (config>router>segment-routing>srv6>inst>loc>func>end-x srh-mode)

[Tree] (config>router>segment-routing>srv6>inst>ms-loc>func>ua srh-mode)

Full Context

configure router segment-routing segment-routing-v6 micro-segment-locator un srh-mode

configure router segment-routing segment-routing-v6 base-routing-instance locator function end srh-mode

configure router segment-routing segment-routing-v6 base-routing-instance locator function end-x srh-mode

configure router segment-routing segment-routing-v6 base-routing-instance micro-segment-locator function ua srh-mode

Description

This command configures the SRH penultimate or ultimate pop mode, as well as the ultimate decapsulation mode, for the SID.

The no form of this command reverts to the default value.

Default

srh-mode psp

Parameters

srh-mode

Specifies the SRH mode for the SID.

Values

psp — Penultimate Segment Pop (PSP) of the SRH

usp — Ultimate Segment Pop (USP) of the SRH

psp-usd — Supports both PSP of the SRH and Ultimate Segment Decapsulation (USD) on the same SID

usp-usd — Supports both USP of the SRH and USD on the same SID

psp-usp-usd — Supports PSP and USP of the SRH with USD on the same SID

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>router>isis>segm-rtng srlb)

[Tree] (config>router>ospf>segm-rtng srlb)

Full Context

configure router isis segment-routing srlb

configure router ospf segment-routing srlb

Description

This command specifies the reserved label block to use for the Segment Routing Local Block (SRLB) for the specified IS-IS or OSPF instance. The named reserved label block must already have been configured under config>router>mpls>mpls-labels.

The no form of this command removes an SRLB.

Parameters

reserved-label-block-name

Specifies the name of the reserved label block, up to 64 characters.

Platforms

All

Context

[Tree] (config>router>mpls>lsp>secondary srlg)

Full Context

configure router mpls lsp secondary srlg

Description

This command enables the use of the SRLG constraint in the computation of a secondary path for an LSP at the head-end LER. The command is configurable for both RSVP-TE and SR-TE LSPs.

When SRLG is enabled, CSPF includes the SRLG constraint in the computation of the secondary LSP path if path-computation-method local-cspf is configured on the LSP. CSPF returns the list of SRLG groups along with the ERO during primary path CSPF computation. At a subsequent establishment of a secondary path with the SRLG constraint, the MPLS task again queries CSPF by providing the list of SRLG group numbers to be avoided. CSPF prunes all links with interfaces that belong to the same SRLGs as the interfaces included in the ERO of the primary path. If CSPF finds a path, the secondary path is set up. If a path is not found, MPLS keeps retrying the requests to CSPF.

An SRLG enabled secondary or standby path of the LSP configured with a value of the path-computation-method command other than local-cspf remains operationally down with a failure code of srlgPrimaryCspfDisabled(25).

When an LSP is administratively enabled, the SRLG-enabled secondary path is not tried if the first attempt to bring up the primary path is in progress. The SRLG enabled secondary path is kept down temporarily with failure code srlgPrimaryPathDown(26). After this first attempt, MPLS begins setting up the SRLG-enabled standby paths. If primary path computation fails or primary path was not configured, MPLS requests CSPF to compute the secondary path using an empty primary SRLG list. The SRLG disjoint state field shows True in this scenario.

If the primary path is re-optimized, has undergone MBB, or has come back up after being down, the MPLS task check determines if any SRLG secondary paths should be re-signaled. If MPLS finds that a secondary path is no longer SRLG disjointed, and therefore becomes ineligible, MPLS puts it on a delayed MBB immediately after the expiry of the retry timer. If MBB fails at the first try, the secondary path is torn down and the path is put on retry if not active. If the secondary path is active, then it is only torn down and resignaled when the primary path is activated. The secondary path can remain active even when ineligible while the revert timer to activate the primary path is still running.

If the primary goes down while active, the LSP uses the path of an eligible SRLG secondary path if it is up. If all secondary eligible SRLG paths are down, MPLS uses a non-SRLG secondary path, if configured and up. While the LSP is using a non-SRLG secondary path, if an eligible SRLG secondary path comes back up, MPLS switches the path of the LSP to the eligible SRLG secondary path. As soon as a path for the primary is successfully computed by CSPF, MPLS schedules the delay retry MBB for the secondary path using the new SRLG list.

If the primary path goes down while inactive, for example it is waiting for the revert timer to expire, MPLS resets the SRLG list of the primary to empty and changes the state of all secondary paths, including the currently active one, to the Disjointed state. A delay retry MBB is still performed but results in no change to the active secondary path.

A secondary path that becomes ineligible as a result of an update to the SRLG membership list of the primary path has the ineligibility status removed on any of the following events:

• a successful delay retry MBB of the secondary SRLG path that makes it eligible again

• the secondary path goes down. MPLS puts the standby on retry at the expiry of the retry timer. If successful, it becomes eligible. If not successful after the retry-timer expires or the number of retries reached the number configured under the retry-limit parameter, it is left down.

Once the primary path of the LSP is set up and is operationally up, any subsequent changes to the SRLG group membership of an interface that the primary path is using is not considered until the next opportunity the primary path is re-signaled. The primary path may be re-signaled due to a failure or to a make-before-break operation. Make-before-break occurs as a result of a global revertive operation, a timer based or manual re-optimization of the LSP path, or an operator change to any of the path constraints.

Once an SRLG secondary path is set up and is operationally up, any subsequent changes to the SRLG group membership of an interface the secondary path is using is not considered until the next opportunity when the secondary path is re-signaled. The secondary path is re-signaled due to a failure, to a re-signaling of the primary path, or to a make before break operation. Make-before-break occurs as a result of a timer based or manual re-optimization of the secondary path, or an operator change to any of the path constraints of the secondary path, except for enabling or disabling the srlg command itself. Enabling or disabling the srlg command on an active secondary or on an active or inactive secondary standby path causes the path to be torn down and re-signaled.

In addition, the user-configured include or exclude admin group statements for a secondary path are also checked together with the SRLG constraints by CSPF.

The following behavior of the feature is specific to the SR-TE LSP.

• An SRLG-enabled SR-TE LSP secondary path with SID label hops remains operational with failure code srlgPathWithSidHops(59).

• An SR-TE LSP uses IGP advertised link SRLG information in the TE database. It does not support the use of SRLG information in the static user SRLG database (configure router mpls srlg-database).

• Delay Retry MBB for making a non-disjointed path a disjointed one is not supported with an SR-TE LSP. Instead, the system performs a break-before-make (that is, teardown and retry) operation. If a non-disjointed path is the active path of the LSP, that path is torn down and retried after the router switches to another path (for example, after revert-timer expires). If the non-disjointed path is not an active path, it is torn down and retried immediately.

The no form of this command reverts to the default value.

Default

no srlg

Platforms

All

Context

[Tree] (config>router>mpls srlg-database)

Full Context

configure router mpls srlg-database

Description

Commands in this context configure the link members of SRLG groups for the entire network at any node that needs to signal LSP paths (for example, a head-end node).

The no form of this command deletes the entire SRLG database. CSPF assumes all interfaces have no SRLG membership association if the database was not disabled with the command config>router>mpls>user-srlg-db disable.

Platforms

All

Context

[Tree] (config>router>route-next-hop-policy>template srlg-enable)

Full Context

configure router route-next-hop-policy template srlg-enable

Description

This command configures the SRLG constraint into the route next-hop policy template.

When this command is applied to a prefix, the LFA SPF will attempt to select an LFA next-hop, among the computed ones, which uses an outgoing interface that does not participate in any of the SLRGs of the outgoing interface used by the primary next-hop.

The SRLG criterion is applied before running the LFA next-hop selection algorithm.

The no form deletes the SRLG constraint from the route next-hop policy template.

Default

no srlg-enable

Platforms

All

Context

[Tree] (config>router>mpls srlg-frr)

Full Context

configure router mpls srlg-frr

Description

This command enables the use of the SRLG constraint in the computation of FRR bypass or detour to be associated with any primary LSP path on this system.

When this option is enabled, CSPF includes the SRLG constraint in the computation of a FRR detour or bypass for protecting the primary LSP path.

CSPF prunes all links with interfaces that belong to the same SRLG as the interface that is being protected, that is, the outgoing interface at the PLR the primary path is using. If one or more paths are found, the MPLS task will select one based on best cost and will signal the bypass/detour. If not found and the user has included the strict option, the bypass/detour is not setup and the MPLS task will keep retrying the request to CSPF. Otherwise, if a path exists that meets the other TE constraints, other than the SRLG one, the bypass/detour is setup.

A bypass or a detour LSP path is not intended to be SRLG disjoint from the entire primary path. Only the SRLGs of the outgoing interface at the PLR that the primary path is using are avoided.

When the MPLS task is searching for an SRLG bypass tunnel to associate with the primary path of the protected LSP, it will first check if any configured manual bypass LSP with CSPF enabled satisfies the SRLG constraints. The search skips any non-CSPF manual bypass LSP because there is no ERO returned to check the SRLG constraint. If no path is found, the task will check if an existing dynamic bypass LSP satisfies the SRLG and other primary path constraints. If not found, it will make a request to CSPF.

Once the primary path of the LSP is configured and is operationally up, subsequent changes to the SRLG group membership of an interface the primary path is using are not considered by the MPLS task at the PLR for bypass/detour association until the next opportunity the bypass LSP path or the primary path is resignaled. The path may be resignaled due to a failure or a Make-Before-Break (MBB) operation. MBB occurs as a result of a global revertive operation, a timer based or manual re-optimization of the bypass LSP or LSP primary path, or a user update of the primary path constraints.

Once the bypass or detour path is set up and is operationally up, subsequent changes to the SRLG group membership of an interface the bypass/detour path is using are not considered by the MPLS task at the PLR until the next opportunity when the association with the primary LSP path is rechecked. The association is rechecked if the bypass path is re-optimized using the timer or manual resignal MBB. Detour paths cannot be re-optimized separately from the primary path.

Enabling or disabling srlg-frr command only takes effect when the LSP primary path or the bypass path is resignaled. The user can either wait for the resignal timer to expire or cause the paths to be resignaled immediately by executing, at the ingress LER, the manual resignal command for the LSP primary path or for the bypass LSP path.

A MPLS interface can belong to a maximum of 64 SRLG groups. The SRLG groups are configured using the config>router>if-attribute>srlg-group command. The SRLG groups that an RSVP interface belong to are configured using the srlg-group command in the config>router>mpls>interface context.

The no form of this command reverts to the default value.

Default

no srlg-frr

Parameters

strict

Specifies the name of the SRLG group within a virtual router instance.

Values

no srlg-frr (default) srlg-frr (non-strict) srlg-frr strict (strict)

Platforms

All

Context

[Tree] (config>service>ies>if>if-attribute srlg-group)

[Tree] (config>router>if>if-attribute srlg-group)

[Tree] (config>router>mpls>if srlg-group)

[Tree] (config>service>vprn>if>if-attribute srlg-group)

Full Context

configure service ies interface if-attribute srlg-group

configure router interface if-attribute srlg-group

configure router mpls interface srlg-group

configure service vprn interface if-attribute srlg-group

Description

This command configures the SRLG membership of an interface. The user can apply SRLGs to an IES, VPRN, network IP, or MPLS interface.

An interface can belong to up to 64 SRLG groups. However, each single operation of the srlg-group command allows a maximum of five (5) groups to be specified at a time. Once an SRLG group is bound to one or more interface, its value cannot be changed until all bindings are removed.

The configured SRLG membership is applied in all levels/areas the interface is participating in. The same interface cannot have different memberships in different levels/areas.

Only the SRLGs bound to an MPLS interface are advertised area-wide in TE link TLVs and sub-TLVs when the traffic-engineering option is enabled in IS-IS or OSPF. IES and VPRN interfaces do not have their attributes advertised in TE TLVs.

The no form of this command deletes one or more of the SRLG memberships of an interface. The user can also delete all memberships of an interface by not specifying a group name.

Parameters

group-name

Specifies the name of the group, up to 32 characters. The association of group name and value should be unique within an IP/MPLS domain. Each single operation of the srlg-group command allows a maximum of 5 groups to be specified at a time.

Platforms

All

Context

[Tree] (config>router>if-attribute srlg-group)

Full Context

configure router if-attribute srlg-group

Description

This command defines a Shared Risk Link Group (SRLG) which can be associated with an IP or MPLS interface.

SRLG is used to tag IP or MPLS interfaces which share a specific fate with the same identifier. For example, an SRLG group identifier could represent all links which use separate fibers but are carried in the same fiber conduit. If the conduit is accidentally cut, all the fiber links are cut which means all interfaces using these fiber links will fail.

The user first configures locally on each router the name and identifier of each SRLG group. A maximum of 1024 SRLGs can be configured per system.

The user then configures the SRLG membership of an interface. The user can apply SRLGs to an IES, VPRN, network IP, or MPLS interface. A maximum of 64 SRLGs can be applied to a given interface.

When SRLGs are applied to MPLS interfaces, CSPF at an LER will exclude the SRLGs of interfaces used by the LSP primary path when computing the path of the secondary path. CSPF at an LER or LSR will also exclude the SRLGs of the outgoing interface of the primary LSP path in the computation of the path of the FRR backup LSP. This provides path disjointness between the primary path and the secondary path or FRR backup path of an LSP.

When SRLGs applied to IES, VPRN, or network IP interfaces, they are evaluated in the route next-hop selection by adding the srlg-enable option in a route next-hop policy template applied to an interface or a set of prefixes. For instance, the user can enable the SRLG constraint to select a LFA next-hop for a prefix which avoids all interfaces that share fate with the primary next-hop.

The following provisioning rules are applied to SRLG configuration. The system will reject the creation of a SRLG if it re-uses the same name but with a different group value than an existing group. The system will also reject the creation of an SRLG if it re-uses the same group value but with a different name than an existing group.

Only the SRLGs bound to an MPLS interface are advertised area-wide in TE link TLVs and sub-TLVs when the traffic-engineering option is enabled in IS-IS or OSPF. IES and VPRN interfaces do not have their attributes advertised in TE TLVs.

A user may specify a penalty weight (penalty-weight) associated with an SRLG. This controls the likelihood of paths with links sharing SRLG values with a primary path being used by a bypass or detour LSP. The higher the penalty weight, the less desirable it is to use the link with a given SRLG.

Parameters

group-name

Specifies the name of the group, up to 32 characters. The association of group name and value should be unique within an IP/MPLS domain.

group-value

Specifies the integer value associated with the group. The association of group name and value should be unique within an IP/MPLS domain.

Values

0 to 4294967295

penalty-weight

Specifies the integer value of the penalty weight that is assigned to the SRLG group

Values

0 to 65535

Default

0

Platforms

All

Context

[Tree] (config>service>ies>sub-if>grp-if srrp)

[Tree] (config>service>vprn>sub-if>grp-if srrp)

Full Context

configure service ies subscriber-interface group-interface srrp

configure service vprn subscriber-interface group-interface srrp

Description

This command creates a Subscriber Router Redundancy Protocol (SRRP) instance on a group IP interface. An SRRP instance manages all subscriber subnets within the group interfaces subscriber IP interface or other subscriber IP interfaces that are associated through a wholesale/retail relationship. Only one unique SRRP instance can be configured per group interface.

The no form of this command removes an SRRP instance from a group IP interface. Once removed, the group interface ignores ARP requests for the SRRP gateway IP addresses that may exist on subscriber subnets associated with the group IP interface. Then the group interface stops routing using the redundant IP interface associated with the group IP interface and will stop routing with the SRRP gateway MAC address. Ingress packets destined to the SRRP gateway MAC will also be silently discarded. This is the same behavior as a group IP interface that is disabled (shutdown).

The no form of this command removes the SRRP ID from the configuration.

Default

no srrp

Parameters

srrp-id

Specifies a 32 bit instance ID that must be unique to the system. The instance ID must also match the instance ID used by the remote router that is participating in the same SRRP context. SRRP is intended to perform a function similar to VRRP where adjacent IP hosts within local subnets use a default gateway to access IP hosts on other subnets.

Values

1 to 4294967295

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (debug>router srrp)

Full Context

debug router srrp

Description

This command enables debugging for SRRP packets.

The no form of this command disables debugging.

Platforms

All

Context

[Tree] (config>redundancy>multi-chassis>peer>sync srrp)

Full Context

configure redundancy multi-chassis peer sync srrp

Description

This command specifies whether subscriber routed redundancy protocol (SRRP) information should be synchronized with the multi-chassis peer.

Default

no srrp

Platforms

All

Context

[Tree] (config>redundancy srrp)

Full Context

configure redundancy srrp

Description

Commands in this context configure SSRP system parameters for BNG CUPS inter-BNG-UP resiliency.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>service>ies>sub-if>grp-if srrp-enabled-routing)

[Tree] (config>service>vprn>sub-if>grp-if srrp-enabled-routing)

Full Context

configure service ies subscriber-interface group-interface srrp-enabled-routing

configure service vprn subscriber-interface group-interface srrp-enabled-routing

Description

This command configures SRRP-enabled routing.

The no form of this command reverts to the default.

Parameters

hold-time hold-time

Specifies the hold time, in deci-seconds.

Values

1 to 50

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>redundancy>mc>peer>mcr>l3ring srrp-instance)

Full Context

configure redundancy multi-chassis peer mc-ring l3-ring srrp-instance

Description

This command configures an SRRP instance for a Layer 3 ring.

The no form of this command reverts to the default.

Parameters

srrp-id

Specifies the SRRP ID of this SRRP instance.

Values

1 to 4294967295

Platforms

All

Context

[Tree] (config>fwd-path-ext>fpe srv6)

Full Context

configure fwd-path-ext fpe srv6

Description

This command configures if the SRv6 FPE application type is used for the origination or termination of SRv6 tunnels.

The origination or termination of SRv6 on services requires the configuration of a dedicated SRv6 FPE and cannot share the same FPE. A single FPE can be configured for SRv6 origination. One or more FPEs can be configured for SRv6 termination, where a termination SRv6 FPE is assigned one or more configured locators. Transit SRv6 routers do not need SRv6 FPEs.

The no form of this command disables SRv6 on an FPE.

Parameters

origination

Keyword used to specify the origination FPE application type.

termination

Keyword used to specify the termination FPE application type.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>service>vprn>bgp-ipvpn>srv6 srv6-instance)

[Tree] (config>service>vprn>bgp-evpn>srv6 srv6-instance)

Full Context

configure service vprn bgp-ipvpn segment-routing-v6 srv6-instance

configure service vprn bgp-evpn segment-routing-v6 srv6-instance

Description

This command configures an SRv6 instance.

The no form of this command removes the SRv6 instance from the BGP IP-VPN or BGP EVPN control plane for the service.

Parameters

id

Specifies the SRv6 instance ID that exists in the service and is associated to a IP-VPN or EVPN control plane.

Values

1, 2

name

Specifies a default regular or micro-segment locator name, up to 64 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>router>policy-options>policy-statement>default-action srv6-locator)

[Tree] (config>router>policy-options>policy-statement>entry>action srv6-locator)

Full Context

configure router policy-options policy-statement default-action srv6-locator

configure router policy-options policy-statement entry action srv6-locator

Description

This command configures either a string encoding a midstring parameter delimited by at signs (@), or a reference to a named locator for the SRv6 TLV to use.

For a VRF export policy, the referenced locator must already be configured using the commands in the configure service vprn segment-routing-v6 locator context.

For a BGP export policy, the referenced locator must already be configured using the commands in the configure router segment-routing segment-routing-v6 base-routing-instance locator context.

The no form of this command specifies not to use a locator for the SRv6 TLV.

Default

no srv6-locator

Parameters

name

Specifies either a string encoding a midstring parameter delimited by at signs (@) or a reference to a named locator for the SRv6 TLV to use, up to 64 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>router>policy-options>policy-statement>entry>action srv6-micro-segment-locator)

[Tree] (config>router>policy-options>policy-statement>default-action srv6-micro-segment-locator)

Full Context

configure router policy-options policy-statement entry action srv6-micro-segment-locator

configure router policy-options policy-statement default-action srv6-micro-segment-locator

Description

This command configures either a string encoding a midstring parameter delimited by at signs (@), or a reference to a named micro-segment (uSID) locator for the SRv6 TLV to use.

For a VRF export policy, the referenced uSID locator must already be configured using the commands in the configure service vprn segment-routing-v6 micro-segment-locator context.

For a BGP export policy, the referenced uSID locator must already be configured using the commands in the configure router segment-routing segment-routing-v6 base-routing-instance micro-segment-locator context.

The no form of this command specifies not to use a uSID locator for the SRv6 TLV.

Default

no srv6-micro-segment-locator

Parameters

name

Specifies either a string encoding a midstring parameter delimited by at signs (@) or a reference to a named uSID locator for the SRv6 TLV to use, up to 64 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>router>policy-options>policy-statement>entry>action srv6-return-path-bfd-sid)

[Tree] (config>router>policy-options>policy-statement>default-action srv6-return-path-bfd-sid)

Full Context

configure router policy-options policy-statement entry action srv6-return-path-bfd-sid

configure router policy-options policy-statement default-action srv6-return-path-bfd-sid

Description

This command applies to the initiator of Seamless Bidirectional Forwarding Detection sessions. This command configures the S-BFD session to echo mode and pushes an additional SRv6 SID in the SRH for S-BFD packets only when it is sent on the imported SRv6 policy.

The return-path SID refers to a binding SID on a SRv6 policy configured on the far-end router. Instead of being routed through the IGP path, the S-BFD packet returns to the initiator through this SRv6 return path. The no form of this command disables the controlled return-path SID and echo mode for S-BFD.

Parameters

ipv6-address

Specifies the IPv6 address.

Values

• x:x:x:x:x:x:x:x (eight 16-bit pieces)

• x:x:x:x:x:x:d.d.d.d

• x: [0 to FFFF]H

• d: [0 to 255]D

param-name

Specifies the parameter variable name, up to 32 characters. Policy parameters must start and end with an at-sign (@).

Platforms

All

Context

[Tree] (conf>router>segment-routing>sr-policies>policy>seg-list>segment srv6-sid)

Full Context

configure router segment-routing sr-policies static-policy segment-list segment srv6-sid

Description

This command defines the 128-bit SRv6 SID for the segment. The policy can only be administratively enabled if its type (defined with the configure router segment-routing sr-policies static-policy type command) and all its segments (defined with the configure router segment-routing sr-policies static-policy segment-list segment command) are SRv6.

Parameters

ipv6-address

Specifies the SID, up to 72 characters.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>router>policy-options>policy-statement>entry>from srv6-sid-prefix)

Full Context

configure router policy-options policy-statement entry from srv6-sid-prefix

Description

This command configures either the name of a prefix policy variable or an IPv6 prefix and prefix length, as match criterion for a BGP route.

A BGP route matches this criterion if it has an SRv6 TLV, and the SID or micro-segment (uSID) value in that TLV is matched by the bits of the IPv6 prefix (up to the specified prefix length).

This match criterion is supported in BGP import policies, BGP export policies, and VRF or VSI import policies.

Default

no srv6-sid-prefix

Parameters

ipv6-prefix/prefix-length

Specifies the IPv6 address and prefix length.

Values

ipv6-prefix:	x:x:x:x:x:x:x:x (host bits must be 0)
	x:x:x:x:x:x:d.d.d.d
	x - [0..FFFF]H
	d - [0..255]D
prefix-length:	0 to 128

param-name

Specifies the name of a prefix policy variable, which can be up to 32 characters and must start and end with an at sign (@)

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>router>policy-options>policy-statement>entry>from srv6-tlv)

Full Context

configure router policy-options policy-statement entry from srv6-tlv

Description

This command configures whether the entry matches a BGP route with a prefix SID attribute containing an SRv6 TLV. This match criterion is supported in BGP import policies, BGP export policies, and VRF or VSI import policies.

The no form of this command disables the router from taking whether a BGP route has a prefix SID attribute containing an SRv6 TLV into consideration when matching a BGP route with the entry.

Default

no srv6-tlv

Parameters

present

Specifies that a BGP route only matches this entry if it has a prefix SID attribute containing an SRv6 TLV.

not-present

Specifies that a BGP route only matches this entry if it does not have a prefix SID attribute containing an SRv6 TLV.

Platforms

7450 ESS, 7750 SR, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>qos>sap-ingress>mac-criteria>entry>match ssap)

Full Context

configure qos sap-ingress mac-criteria entry match ssap

Description

This command configures an Ethernet 802.2 LLC SSAP value or range for an ingress SAP QoS policy match criterion.

This is a 1-byte field that is part of the 802.2 LLC header of the IEEE 802.3 Ethernet Frame.

The snap-pid field, etype field, ssap, and dsap fields are mutually exclusive and cannot be part of the same match criteria.

The no form of this command removes the ssap match criterion.

Default

no ssap

Parameters

ssap-value

The 8-bit ssap match criteria value in hex.

Values

0x00 to 0xFF (hex)

ssap-mask

This is optional and can be used when specifying a range of ssap values to use as the match criteria.

This 8-bit mask can be configured using the following formats.

Table 4. Format Styles to Configure Mask

Format Style	Format Syntax	Example
Decimal	DDD	240
Hexadecimal	0xHH	0xF0
Binary	0bBBBBBBBB	0b11110000

Values

0x00 to 0xFF

Platforms

All

Context

[Tree] (config>filter>mac-filter>entry>match ssap)

Full Context

configure filter mac-filter entry match ssap

Description

This command configures an Ethernet 802.2 LLC SSAP value or range for a MAC filter match criterion.

This is a one-byte field that is part of the 802.2 LLC header of the IEEE 802.3 Ethernet Frame.

The snap-pid field, etype field, ssap and dsap fields are mutually exclusive and may not be part of the same match criteria.

The no form of the command removes the ssap match criterion.

Default

no ssap

Parameters

ssap-value

Specifies the 8-bit ssap match criteria value in decimal, hexadecimal or binary.

Values

0 to 255

ssap-mask

Specifies an optional parameter that may be used when specifying a range of ssap values to use as the match criteria.

This 8 bit mask and the ssap value can be configured as described in 8-bit Mask Syntax.

Table 5. 8-bit Mask Syntax

Format Style	Format Syntax	Example
Decimal	DDD	240
Hexadecimal	0xHH	0xF0
Binary	0bBBBBBBBB	0b11110000

Values

0 to 255

Platforms

All

Context

[Tree] (config>system>security>mgmt-access-filter>mac-filter>entry>match ssap)

Full Context

configure system security management-access-filter mac-filter entry match ssap

Description

This command configures an Ethernet 802.2 LLC SSAP value or range for a MAC filter match criterion.

This is a one-byte field that is part of the 802.2 LLC header of the IEEE 802.3 Ethernet Frame.

The snap-pid field, etype field, ssap and dsap fields are mutually exclusive and may not be part of the same match criteria. Refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Router Configuration Guide for information about MAC Match Criteria Exclusivity Rules fields that are exclusive based on the frame format.

The no form of this command removes the SSAP match criterion.

Default

no ssap

Parameters

ssap-value

Specifies the 8-bit SSAP match criteria value in hex.

Values

0x00 to 0xFF

ssap-mask

Specifies a range of SSAP values to use as the match criteria.

Platforms

All

Context

[Tree] (ssh)

Full Context

ssh

Description

This command initiates a client SSH session with the remote host and is independent from the administrative or operational state of the SSH server. However, to be the target of an SSH session, the SSH server must be operational. This command also allows the user to initiate an SSH session, with a key reexchange, based on maximum megabytes or minutes, whichever occurs first. If the reexchange options are not set, the default behavior does not perform a key reexchange.

Quitting SSH while in the process of authentication is accomplished by either executing a ctrl-c or "~." (tilde and dot), assuming the "~” is the default escape character for the SSH session.

Parameters

host

Specifies the remote host for the SSH session.

Values

host: user@hostname - [up to 255 characters]
user	up to 32 characters
hostname	[dns-name | ipv4-address | ipv6-address]
ipv4-address	a.b.c.d
ipv6-address	x:x:x:x:x:x:x:x[-interface]
	x:x:x:x:x:x:d.d.d.d[-interface]
	x - [0 to FFFF]H
	d - [0 to 255]D
	interface: up to 32 characters, mandatory for link local addresses
dns-name	up to128 characters

username

Specifies the user name to use when opening the SSH session, up to 32 characters.

router-instance

Specifies the router name or service ID.

Values

router-instance: router-name or vprn-svc-id
	router-name	"Base”, "management”, "vpls-management”
	vprn-svc-id	1 to 2147483647

Default

Base

service-name

Specifies the service name, up to 64 characters.

minutes

Specifies the time interval after which the SSH client will initiate the key reexchange.

Values

1 to 1440 minutes

megabytes

Specifies the number of megabytes, on a SSH session, after which the SSH client will initiate the key reexchange.

Values

1 to 64000 MB

private-key-filename

Specifies the name of the file containing the private key for public-key authentication on the SR OS SSH client, up to 255 characters. (The public key must be provided to the SSH server.) When using the private-key-filename option, if the file containing the private key is encrypted, the system asks for the password to decrypt the file.

port

Specifies the listening port for the SR OS SSH client to establish the SSH session with the SSH server.

Values

1 to 65535

Platforms

All

Context

[Tree] (config>system>security ssh)

[Tree] (config>system>login-control ssh)

Full Context

configure system security ssh

configure system login-control ssh

Description

Commands in this context configure the SSH parameters.

Platforms

All

Context

[Tree] (config>system>security>user ssh-authentication-method)

Full Context

configure system security user ssh-authentication-method

Description

Commands in this context configure, at the user level, the authentication method accepted by the SSH server. The user-level configuration overrides the system-level configuration.

Platforms

All

Context

[Tree] (config>system>security>profile ssh-max-sessions)

[Tree] (config>system>security>cli-session-group ssh-max-sessions)

Full Context

configure system security profile ssh-max-sessions

configure system security cli-session-group ssh-max-sessions

Description

This command is used to limit the number of SSH-based sessions available to all users that are part of a particular profile, or to all users of all profiles that are part of the same cli-session-group.

The no form of this command disables the command and the profile or group limit is not applied on the number of sessions.

Default

no ssh-max-sessions

Parameters

number-of-sessions

Specifies the maximum number of allowed SSH-based sessions.

Values

0 to 50

Platforms

All

Context

[Tree] (config>service>ies>if>vrrp ssh-reply)

Full Context

configure service ies interface vrrp ssh-reply

Description

This command enables the non-owner master to reply to SSH Requests directed at the virtual router instances IP addresses. The SSH request can be received on any routed interface. SSH must not have been disabled at the management security level (either on the parental IP interface or based on the SSH source host address). Proper login and CLI command authentication is still enforced.

When ssh-reply is not enabled, SSH packets to non-owner master virtual IP addresses are silently discarded.

Non-owner backup virtual routers never respond to SSH regardless of the ssh-reply configuration.

The ssh-reply command is only available in non-owner vrrp virtual-router-id nodal context. If the ssh-reply command is not executed, SSH packets to the virtual router instance IP addresses is silently discarded.

The no form of this command restores the default operation of discarding all SSH packets destined to the non-owner virtual router instance IP addresses.

Default

no ssh-reply

Platforms

All

Context

[Tree] (config>service>vprn>if>vrrp ssh-reply)

Full Context

configure service vprn interface vrrp ssh-reply

Description

This command enables the non-owner master to reply to SSH Requests directed at the virtual router instance’s IP addresses. The SSH request can be received on any routed interface. SSH must not have been disabled at the management security level (either on the parental IP interface or based on the SSH source host address). Proper login and CLI command authentication is still enforced.

When ssh-reply is not enabled, SSH packets to non-owner master virtual IP addresses are silently discarded. Non-owner backup virtual routers never respond to SSH regardless of the ssh-reply configuration.

The ssh-reply command is only available in non-owner vrrp virtual-router-id nodal context. If the ssh-reply command is not executed, SSH packets to the virtual router instance IP addresses is silently discarded.

The no form of this command restores the default operation of discarding all SSH packets destined to the non-owner virtual router instance IP addresses.

Default

no ssh-reply

Platforms

All

Context

[Tree] (config>router>if>vrrp ssh-reply)

Full Context

configure router interface vrrp ssh-reply

Description

This command enables the non-owner master to reply to SSH requests directed at the virtual router instance IP addresses. This command is only applicable to IPv4.

Non-owner virtual router instances are limited by the VRRP specifications to responding to ARP requests destined to the virtual router IP addresses and routing IP packets not addressed to the virtual router IP addresses.

This limitation can be disregarded for certain applications. Ping, Telnet and SSH can be individually enabled or disabled on a per-virtual-router-instance basis.

The ssh-reply command enables the non-owner master to reply to SSH requests directed at the virtual router instances IP addresses. The SSH request can be received on any routed interface. SSH must not have been disabled at the management security level (either on the parental IP interface or based on the SSH source host address). Correct login and CLI command authentication is still enforced.

When ssh-reply is not enabled, SSH requests to non-owner master virtual IP addresses are silently discarded.

Non-owner backup virtual routers never respond to SSH requests regardless of the ssh-reply setting.

The ssh-reply command is only available in non-owner vrrp nodal context.

By default, SSH requests to the virtual router instance IP addresses are silently discarded.

The no form of the command discards all SSH request messages destined to the non-owner virtual router instance IP addresses.

Default

no ssh-reply — SSH requests to the virtual router instance IP addresses are discarded.

Platforms

All

Context

[Tree] (config>port>ethernet ssm)

Full Context

configure port ethernet ssm

Description

This command enables the Ethernet Synchronization Messaging Channel (ESMC) for the Ethernet port. ESMC carries the Synchronization Status Message (SSM) code representing the quality level of the source of frequency of the central clock of the node.

Platforms

All

Context

[Tree] (config>service>vprn>pim ssm-assert-compatible-mode)

Full Context

configure service vprn pim ssm-assert-compatible-mode

Description

This command specifies whether SSM assert is enabled in compatibility mode for this PIM protocol instance. When enabled, for SSM groups, PIM will consider the SPT bit to be implicitly set to compute the value of CouldAssert (S,G,I) as defined in RFC 4601, Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised). When disabled, for SSM groups, PIM will not assume the SPT bit to be set. The SPT bit is set by Update_SPTbit(S,G,iif) macro defined in RFC 4601.

Default

ssm-assert-compatible-mode disable

Parameters

enable

enables SSM assert in compatibility mode for this PIM protocol instance

disable

disabled SSM assert in compatibility mode for this PIM protocol instance

Platforms

All

Context

[Tree] (config>system>sync-if-timing>bits ssm-bit)

Full Context

configure system sync-if-timing bits ssm-bit

Description

This command configures which sa-bit to use for conveying SSM information when the interface-type is E1.

Default

ssm-bit 8

Parameters

sa-bit

Specifies the sa-bit value.

Values

4 to 8

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>service>vprn>pim ssm-default-range-disable)

Full Context

configure service vprn pim ssm-default-range-disable

Description

This command specifies whether to disable the use of default range (232/8) for SSM so that it can be used by ASM to process (*,G). When enabled, the use of default range is disabled for SSM and it can be used by ASM. When disabled, the SSM default range is enabled.

Default

ssm-default-range-disable

Platforms

All

Context

[Tree] (config>service>vprn ssm-groups)

Full Context

configure service vprn ssm-groups

Description

This command enables access to the context to enable a source-specific multicast (SSM) configuration instance.

Platforms

All

Context

[Tree] (config>router>pim ssm-groups)

Full Context

configure router pim ssm-groups

Description

Commands in this context enable an ssm-group configuration instance.

Platforms

All

Context

[Tree] (config>service>vprn>igmp>if ssm-translate)

[Tree] (config>service>vprn>igmp ssm-translate)

Full Context

configure service vprn igmp interface ssm-translate

configure service vprn igmp ssm-translate

Description

Commands in this context configure group ranges which are translated to SSM (S,G) entries. If the static entry needs to be created, it has to be translated from a IGMPv1 IGMPv2 request to a Source Specific Multicast (SSM) join. An SSM translate source can only be added if the starg command is not enabled. An error message is generated if you try to configure the source command with starg command enabled.

Platforms

All

Context

[Tree] (config>service>vprn>mld ssm-translate)

Full Context

configure service vprn mld ssm-translate

Description

Commands in this context configure group ranges which are translated to SSM (S,G) entries. If the static entry needs to be created, it has to be translated from a IGMPv1 IGMPv2 request to a Source Specific Multicast (SSM) join. An SSM translate source can only be added if the starg command is not enabled. An error message is generated if you try to configure the source command with starg command enabled.

Platforms

All

Context

[Tree] (config>router>igmp ssm-translate)

[Tree] (config>router>igmp>if ssm-translate)

Full Context

configure router igmp ssm-translate

configure router igmp interface ssm-translate

Description

Commands in this context configure group ranges which are translated to SSM (S,G) entries. If the static entry needs to be created, it has to be translated from a IGMPv1 IGMPv2 request to a Source Specific Multicast (SSM) join. An SSM translate source can only be added if the starg command is not enabled. An error message is generated if you try to configure the source command with starg command enabled.

Platforms

All

Context

[Tree] (config>router>mld>if ssm-translate)

[Tree] (config>router>mld ssm-translate)

Full Context

configure router mld interface ssm-translate

configure router mld ssm-translate

Description

Commands in this context configure group ranges which are translated to SSM (S,G) entries. If the static entry needs to be created, it has to be translated from a IGMPv1 IGMPv2 request to a Source Specific Multicast (SSM) join. An SSM translate source can only be added if the starg command is not enabled. An error message is generated if you try to configure the source command with starg command enabled.

Platforms

All

Context

[Tree] (config>card>fp stable-pool-sizing)

Full Context

configure card fp stable-pool-sizing

Description

This command provides a stable buffer pool allocation environment for all default port buffer pools on a forwarding plane. This stable environment is provided at the expense of optimal buffer allocation between the various port buffer pools. Normally, port pools are sized according to a ports relative bandwidth with other ports and the ability of a port to use pool buffers. As an example, on a forwarding plane with two potential MDAs and only one equipped, the normal behavior is to provide all available default pool buffers to the ports on the currently equipped MDA. If a second MDA is equipped in the future, buffers are freed from the existing MDA and provided to the ports on the new MDA. Stable pool sizing alters this behavior by reserving buffers for both MDAs whether they are equipped or not thus preventing a resizing event when an MDA is equipped. In addition, existing ports on a module always receive their maximum bandwidth share of buffers independent on any sub-rate condition that may currently exist. This provides a stable amount of buffers to other ports on the module independent of link or configuration events that may occur on the port.

Stable pool sizing preserves the ability to modify the effective bandwidth used to determine a port’s relative share of the available buffers through the use of the ing-percentage-of-rate and egr-percentage-of-rate commands under the port configuration. Changing the values associated with these commands will cause a reevaluation of buffer distribution and thus a possible resizing of pools on each port within the module. These commands have no effect on ports associated with other modules on the forwarding plane.

Stable pool sizing may be enabled or disabled at any time on a forwarding plane. The system will dynamically change the pool sizes according to the stable pool sizing state.

When a port connector breakout is configured, its ports is included in the stable pool sizing calculation. Consequently, adding or removing a port connector breakout to or from the configuration will cause the buffer pool allocation to be recalculated even when stable pool sizing is enabled.

The no form of this command disables stable pool sizing on a forwarding plane. Existing buffer pools are resized according to normal pool sizing behavior.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>subscr-mgmt>pppoe-client-policy stack)

Full Context

configure subscriber-mgmt pppoe-client-policy stack

Description

This command defines which NCP session is started in the PPPoE client and how addresses are retrieved within that NCP session.

Default

stack ipv4

Parameters

ipv4

Indicates that IPCP should be started and used to retrieve an IPv4 address.

ipv6-slaac

Indicates that IPv6CP should be started and that SLAAC is used to retrieve an IPv6 prefix.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>service>ipipe stack-capability-signaling)

Full Context

configure service ipipe stack-capability-signaling

Description

This command enables stack-capability signaling in the initial label mapping message of the Ipipe PW to indicate that IPv6 is supported.

When enabled, the 7750 SR includes the stack-capability TLV with the IPv6 stack bit set according to the ce-address-discovery ipv6 keyword, and also checks the value of the stack-capability TLV received from the far end.

This command must be blocked if no ce-address-discovery is specified, or the ipv6 keyword is not included with the ce-address-discovery command.

This command if only applicable to the Ipipe service and must be blocked for all other services.

This command has no effect if both SAPs on the Ipipe service are local to the node.

Default

no stack-capability-signaling

Platforms

All

Context

[Tree] (config>service>vprn>bgp>group>graceful-restart stale-routes-time)

[Tree] (config>service>vprn>bgp>group>neighbor>graceful-restart stale-routes-time)

[Tree] (config>service>vprn>bgp>graceful-restart stale-routes-time)

Full Context

configure service vprn bgp group graceful-restart stale-routes-time

configure service vprn bgp group neighbor graceful-restart stale-routes-time

configure service vprn bgp graceful-restart stale-routes-time

Description

This command configures the time period to keep stale routes before the END-OF-RIB message is received from the restarting router.

Default

360 seconds

Parameters

time

1 to 3600 seconds

Platforms

All

Context

[Tree] (config>router>bgp>group>neighbor>graceful-restart stale-routes-time)

[Tree] (config>router>bgp>graceful-restart stale-routes-time)

[Tree] (config>router>bgp>group>graceful-restart stale-routes-time)

Full Context

configure router bgp group neighbor graceful-restart stale-routes-time

configure router bgp graceful-restart stale-routes-time

configure router bgp group graceful-restart stale-routes-time

Description

This command configures the maximum amount of time in seconds that stale routes should be maintained after a graceful restart is initiated.

The no form of this command resets the stale routes time back to the default of 360 seconds.

Default

no stale-routes-time

Parameters

time

Specifies the amount of time that stale routes should be maintained after a graceful restart is initiated.

Values

1 to 3600 seconds

Platforms

All

Context

[Tree] (config>service>ies>if>ipv6 stale-time)

[Tree] (config>service>ies>ipv6 stale-time)

[Tree] (config>service>vprn>if>ipv6 stale-time)

[Tree] (config>service>vprn>ipv6 stale-time)

Full Context

configure service ies interface ipv6 stale-time

configure service ies ipv6 stale-time

configure service vprn interface ipv6 stale-time

configure service vprn ipv6 stale-time

Description

This command configures the time a neighbor discovery cache entry can remain stale before being removed.

The no form of this command removes the stale-time value.

Default

no stale-time

Parameters

seconds

The allowed stale time (in seconds) before a neighbor discovery cache entry is removed.

Values

60 to 65535

Platforms

All

Context

[Tree] (config>router>ipv6 stale-time)

Full Context

configure router ipv6 stale-time

Description

This command configures the time a neighbor discovery cache entry can remain stale before being removed.

The no form of this command removes the stale-time value.

Default

stale-time 14400

Parameters

seconds

Specifies the allowed stale time (in seconds) before a neighbor discovery cache entry is removed.

Values

60 to 65535

Platforms

All

Context

[Tree] (config>router>origin-validation>rpki-session stale-time)

Full Context

configure router origin-validation rpki-session stale-time

Description

This command configures the maximum length of time that prefix origin validation records learned from the cache server remain usable after the RPKI-Router session goes down. The default stale-time is 3600 seconds (1 hour). When the timer expires all remaining stale entries associated with the session are deleted.

Default

no stale-time

Parameters

seconds

Specifies a time, in seconds.

Values

60 to 3600

Platforms

All

Context

[Tree] (config>router>if>ipv6 stale-time)

Full Context

configure router interface ipv6 stale-time

Description

This command configures the time a neighbor discovery cache entry can remain stale before being removed.

The no form of this command removes the stale-time value.

Default

no stale-time

Parameters

seconds

The allowed stale time (in seconds) before a neighbor discovery cache entry is removed.

Values

60 to 65535

Platforms

All

Context

[Tree] (config>service>vprn>isis standard-multi-instance)

Full Context

configure service vprn isis standard-multi-instance

Description

This command enables IS-IS multi-instance (MI) as described in draft-ginsberg-isis-mi-bis-01. Multiple instances allow instance-specific adjacencies to be formed that support multiple network topologies on the same physical interfaces. Each instance has an LSDB, and each PDU contains a TLV identifying the instance and the topology to which the PDU belongs. A single topology is supported in each instance, so the instance-specific topology identifier (ITID) is set to 0 and cannot be changed.

The standard-multi-instance (based on draft-ginsberg-isis-mi-bis-01) and iid-tlv-enable (based on draft-ietf-isis-mi-02) commands cannot be configured in the same instance, because the MAC addresses and PDUs from the two standards are incompatible.

The no form of this command removes the standard-multi-instance configuration.

Default

no standard-multi-instance

Platforms

All

Context

[Tree] (config>router>isis standard-multi-instance)

Full Context

configure router isis standard-multi-instance

Description

This command enables IS-IS multi-instance (MI) as described in draft-ginsberg-isis-mi-bis-01. Multiple instances allow instance-specific adjacencies to be formed that support multiple network topologies on the same physical interfaces. Each instance has an LSDB, and each PDU contains a TLV identifying the instance and the topology to which the PDU belongs. A single topology is supported in each instance, so the instance-specific topology identifier (ITID) is set to 0 and cannot be changed.

The standard-multi-instance (based on draft-ginsberg-isis-mi-bis-01) and iid-tlv-enable (based on draft-ietf-isis-mi-02) commands cannot be configured in the same instance, because the MAC addresses and PDUs from the two standards are incompatible.

The no form of this command removes the standard-multi-instance configuration.

Default

no standard-multi-instance

Platforms

All

Context

[Tree] (config>router>mpls>lsp>secondary standby)

Full Context

configure router mpls lsp secondary standby

Description

The secondary path LSP is normally signaled once the primary path LSP fails. The standby keyword ensures that the secondary path LSP is signaled and maintained indefinitely in a hot standby state. Standby paths are selected in preference to non-standby secondary paths. When multiple standby secondary paths exist, then the path-preference is used to determine the order in which the paths are selected. If multiple standby secondary paths have the same, lowest, path-preference value then the system will select the path with the lowest up-time. When the primary path is re-established then the traffic is switched back to the primary path LSP.

The no form of this command specifies that the secondary LSP is signaled when the primary path LSP fails.

Platforms

All

Context

[Tree] (config>service>ies>if>ipv6>vrrp standby-forwarding)

Full Context

configure service ies interface ipv6 vrrp standby-forwarding

Description

This command allows the forwarding of packets by a standby router.

The no form of this command specifies that a standby router should not forward traffic sent to virtual router's MAC address. However, the standby router should forward traffic sent to the standby router’s real MAC address.

Default

no standby-forwarding

Platforms

All

Context

[Tree] (config>service>ies>if>vrrp standby-forwarding)

Full Context

configure service ies interface vrrp standby-forwarding

Description

This command allows the forwarding of packets by a standby router.

The no form of this command specifies that a standby router should not forward traffic sent to virtual router's MAC address. However, the standby router should forward traffic sent to the standby router’s real MAC address.

Default

no standby-forwarding

Platforms

All

Context

[Tree] (config>service>vprn>if>ipv6>vrrp standby-forwarding)

[Tree] (config>service>vprn>if>vrrp standby-forwarding)

Full Context

configure service vprn interface ipv6 vrrp standby-forwarding

configure service vprn interface vrrp standby-forwarding

Description

This command allows the forwarding of packets by a standby router.

The no form of this command specifies that a standby router should not forward traffic sent to virtual router's MAC address. However, the standby router should forward traffic sent to the standby router’s real MAC address.

Default

no standby-forwarding

Platforms

All

Context

[Tree] (config>router>if>ipv6>vrrp standby-forwarding)

[Tree] (config>router>if>vrrp standby-forwarding)

Full Context

configure router interface ipv6 vrrp standby-forwarding

configure router interface vrrp standby-forwarding

Description

This command specifies whether this VRRP instance allows forwarding packets to a standby router. When disabled, a standby router should not forward traffic sent to virtual router's MAC address. However, the standby router should forward traffic sent to the standby router’s real MAC address. When enabled, a standby router should forward all traffic.

Default

no standby-forwarding

Platforms

All

Context

[Tree] (config>subscr-mgmt>vrgw>brg>brg-profile>dhcp-pool standby-ip-lifetime)

Full Context

configure subscriber-mgmt vrgw brg brg-profile dhcp-pool standby-ip-lifetime

Description

This command defines how long these addresses are kept aside when standby addresses are signaled to the pool. During this time these addresses can only be used by devices explicitly requesting the IP (for example, datatrigger or DHCP renew/rebind). When the timer expires the addresses will again become available for dynamic allocation.

Default

standby-ip-lifetime hrs 6

Parameters

days

Specifies the standby IP lifetime in days.

Values

1 to 3650

hrs

Specifies the standby IP lifetime in hours.

Values

1 to 23

min

Specifies the standby IP lifetime in minutes.

Values

1 to 59

sec

Specifies the standby IP lifetime in seconds.

Values

1 to 59

seconds

Specifies the lifetime of the standby IP addresses

Values

300 to 315446399

seconds

Specifies the lifetime in seconds.

Values

300 to 315446399

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>eth-cfm>redundancy>mc-lag standby-mep-shutdown)

Full Context

configure eth-cfm redundancy mc-lag standby-mep-shutdown

Description

This system wide command enables MEPs to track the state of MC-LAG. This allows MEPs on the standby MC-LAG to act administratively down.

The no form of command disables the MEP tracking.

Default

no standby-mep-shutdown

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

Context

[Tree] (config>lag standby-signaling)

Full Context

configure lag standby-signaling

Description

This command specifies how the state of a member port is signaled to the remote side when the status corresponding to this member port has the standby value.

Default

standby-signaling lacp

Platforms

All

Context

[Tree] (config>service>epipe>endpoint standby-signaling-master)

[Tree] (config>service>ipipe>endpoint standby-signaling-master)

Full Context

configure service epipe endpoint standby-signaling-master

configure service ipipe endpoint standby-signaling-master

Description

When this command is enabled, the pseudowire standby bit (value 0x00000020) is sent to T-LDP peer for each spoke SDP of the endpoint that is selected as a standby.

This command is mutually exclusive with a VLL mate SAP created on a mc-lag/mc-aps or ICB. It is also mutually exclusive with vc-switching.

Default

standby-signaling-master

Platforms

All

Context

[Tree] (config>service>epipe>spoke-sdp-fec standby-signaling-slave)

Full Context

configure service epipe spoke-sdp-fec standby-signaling-slave

Description

This command enables standby-signaling-slave for an Epipe.

Platforms

All

Context

[Tree] (config>service>epipe>endpoint standby-signaling-slave)

[Tree] (config>service>epipe>spoke-sdp standby-signaling-slave)

Full Context

configure service epipe endpoint standby-signaling-slave

configure service epipe spoke-sdp standby-signaling-slave

Description

When this command is enabled, the node will block the transmit forwarding direction of a spoke SDP based on the pseudowire standby bit received from a T-LDP peer.

This command is present at the endpoint level as well as the spoke SDP level. If the spoke SDP is part of an explicit-endpoint, it will not be possible to change this setting at the spoke SDP level. An existing spoke SDP can be made part of the explicit endpoint only if the settings do not conflict. A newly created spoke SDP, which is part of a specific explicit-endpoint, will inherit this setting from the endpoint configuration.

This command is mutually exclusive with an endpoint that is part of an mc-lag, mc-aps or an ICB.

If the command is disabled, the node assumes the existing independent mode of behavior for the forwarding on the spoke SDP.

Default

no standby-signaling-slave

Platforms

All

Context

[Tree] (config>subscr-mgmt>mld-policy>static>group starg)

[Tree] (config>subscr-mgmt>igmp-policy starg)

[Tree] (config>subscr-mgmt>igmp-policy>static>group starg)

Full Context

configure subscriber-mgmt mld-policy static group starg

configure subscriber-mgmt igmp-policy starg

configure subscriber-mgmt igmp-policy static group starg

Description

This command adds a static (*,G) entry. This command can only be enabled if no existing source addresses for this group are specified.

The no form of this command removes the starg entry from the configuration.

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>service>vpls>spoke-sdp>mld-snooping>static>group starg)

[Tree] (config>service>vpls>spoke-sdp>igmp-snooping>static>group starg)

[Tree] (config>service>vpls>sap>igmp-snooping>static>group starg)

[Tree] (config>service>vpls>mesh-sdp>mld-snooping>static>group starg)

[Tree] (config>service>vpls>sap>mld-snooping>static>group starg)

[Tree] (config>service>vpls>mesh-sdp>igmp-snooping>static>group starg)

Full Context

configure service vpls spoke-sdp mld-snooping static group starg

configure service vpls spoke-sdp igmp-snooping static group starg

configure service vpls sap igmp-snooping static group starg

configure service vpls mesh-sdp mld-snooping static group starg

configure service vpls sap mld-snooping static group starg

configure service vpls mesh-sdp igmp-snooping static group starg

Description

This command adds a static (*,g) entry to allow multicast traffic for the corresponding multicast group from any source. This command can only be enabled if no existing source addresses for this group are specified.

The no form of this command removes the starg entry from the configuration.

Default

no starg

Platforms

All

Context

[Tree] (config>service>vprn>igmp>if>static>group starg)

Full Context

configure service vprn igmp interface static group starg

Description

This command adds a static (*,G) entry. This command can only be enabled if no existing source addresses for this group are specified.

Use the no form of this command to remove the starg entry from the configuration.

Platforms

All

Context

[Tree] (config>service>vprn>mld>if>static>group starg)

Full Context

configure service vprn mld interface static group starg

Description

This command adds a static (*,G) entry. This command can only be enabled if no existing source addresses for this group are specified.

Use the no form of this command to remove the starg entry from the configuration.

Platforms

All

Context

[Tree] (config>router>igmp>if>static>group starg)

Full Context

configure router igmp interface static group starg

Description

This command adds a static (*,G) entry. This command can only be enabled if no existing source addresses for this group are specified.

Use the no form of the command to remove the (*,G) entry from the configuration.

Platforms

All

Context

[Tree] (config>router>igmp>tunnel-interface>static>group starg)

Full Context

configure router igmp tunnel-interface static group starg

Description

This command adds a static (*,G) group entry in a static group join on a tunnel interface associated with a P2MP RSVP LSP.

This command can only be enabled if no existing source addresses for this group are specified.

The no form of the command removes the (*,G) entry from the configuration.

Platforms

All

Context

[Tree] (config>router>mld>if>static>group starg)

Full Context

configure router mld interface static group starg

Description

This command adds a static (*,G) entry. This command can only be enabled if no existing source addresses for this group are specified.

The no form of this command removes the starg entry from the configuration.

Platforms

All

Context

[Tree] (debug>app-assure>group>traffic-capture>record start)

Full Context

debug application-assurance group traffic-capture record start

Description

This command records limit conditions.

Parameters

immediate

Start recording immediately for new or existing flows or sessions.

on-new-session

Only start recording record for new flows or sessions.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>system>time>dst-zone start)

Full Context

configure system time dst-zone start

Description

This command configures start of summer time settings.

Default

start first sunday january 00:00

Parameters

start-week

Specifies the starting week of the month when the summer time takes effect.

Values

first, second, third, fourth, last

Default

first

start-day

Specifies the starting day of the week when the summer time takes effect.

Values

sunday, monday, tuesday, wednesday, thursday, friday, saturday

Default

sunday

start-month

Specifies the starting month of the year when the summer time takes effect.

Values

january, february, march, april, may, june, july, august, september, october, november, december

Default

january

hours-minutes

Specifies the time at which the summer time takes effect, in hh:mm format.

Values

hours: 00 to 23

minutes: 00 to 59

Default

00:00

Platforms

All

Context

[Tree] (config>qos>slope-policy>exceed-slope start-avg)

[Tree] (config>qos>slope-policy>high-slope start-avg)

[Tree] (config>qos>slope-policy>highplus-slope start-avg)

[Tree] (config>qos>slope-policy>low-slope start-avg)

Full Context

configure qos slope-policy exceed-slope start-avg

configure qos slope-policy high-slope start-avg

configure qos slope-policy highplus-slope start-avg

configure qos slope-policy low-slope start-avg

Description

This command sets the exceed, low, high, or highplus Random Early Detection (RED) slope position for the shared buffer average utilization value where the packet discard probability starts to increase above zero. The percent parameter is expressed as a percentage of the shared buffer size.

The no form of this command restores the start-avg value to the default setting. If the max-avg setting is smaller than the default, an error will occur and the start-avg setting will not be changed to the default.

Default

start-avg 85 - Highplus slope default is 85% buffer utilization before discard probability starts to increase above zero.

start-avg 70 — High slope default is 70% buffer utilization before discard probability starts to increase above zero.

start-avg 50 — Low slope default is 50% buffer utilization before discard probability starts to increase above zero.

start-avg 30 — Exceed slope default is 30% buffer utilization before discard probability starts to increase above zero.

Parameters

percent

The percentage of the shared buffer space for the buffer pool at which point the drop probability starts to increase above zero. The value entered must be less than or equal to the current setting of max-avg. If the entered value is greater than the current value of max-avg, an error will occur and no change will take place.

Values

0 to 100

Platforms

All

Context

[Tree] (config>li>li-filter-block-reservation>li-reserved-block start-entry)

Full Context

configure li li-filter-block-reservation li-reserved-block start-entry

Description

This command defines a block of reserved filter entries that are used to insert LI filter entries into a normal filter.

The no form of this command removes the entry ID and count from the configuration.

Parameters

entry-id

Specifies an entry identification to start a block of reserved filter entries.

Values

1 to 65536

count

Specifies the number of entries in the block.

Values

1 to 8192

Platforms

All

Context

[Tree] (config>router>mpls-labels>reserved-label-block start-label)

Full Context

configure router mpls-labels reserved-label-block start-label

Description

This command configures start and end labels for a reserved label block. This command must be configured for a reserved label block to be created.

Default

start-label 0, end-label 0

Parameters

start-value

Specifies a starting value.

Values

18432 to 524287 within dynamic label range | 1048575 (FP4 or FP5 only)

end-value

Specifies an ending value.

Values

18432 to 524287 within dynamic label range | 1048575 (FP4 or FP5 only)

Platforms

All

Context

[Tree] (config>router>dhcp>server>failover startup-wait-time)

[Tree] (config>router>dhcp6>server>failover startup-wait-time)

[Tree] (config>router>dhcp>server>pool>failover startup-wait-time)

[Tree] (config>router>dhcp6>server>pool>failover startup-wait-time)

Full Context

configure router dhcp local-dhcp-server failover startup-wait-time

configure router dhcp6 local-dhcp-server failover startup-wait-time

configure router dhcp server pool failover startup-wait-time

configure router dhcp6 server pool failover startup-wait-time

Description

This command enables the startup wait time during which each peer waits after the initialization process before assuming the active role for the prefix designated as local or access-driven. This is to avoid transient issues during the initialization process.

The startup-wait-time should be configured to an interval in which, after boot, both nodes can set up an MCS TCP link and start MCS. The timer is restarted each time the server downloads a lease from the MCS database and stops when the last state record from the peer is synchronized. The next state is (PRE-)NORMAL, unless the timer times out or is forced to stop via the tools command (tools>perform>router>dhcp or dhcp6>local-dhcp-server server-name>pool/failover>abort-startup-wait), in which case the local DHCP server transitions immediately to the COMMUNICATIONS-INTERRUPTED state.

Default

startup-wait-time min 2

Parameters

minutes

Specifies the startup wait time, in minutes.

Values

1 to 59

seconds

Specifies the startup wait time, in seconds.

Values

1 to 59

hours

Specifies the startup wait time, in hours.

Values

1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

Context

[Tree] (config>subscr-mgmt>sla-prof>ingress>qos>policer stat-mode)

[Tree] (config>subscr-mgmt>sla-prof>ingress>qos>queue stat-mode)

[Tree] (config>subscr-mgmt>sla-prof>egress>qos>policer stat-mode)

[Tree] (config>subscr-mgmt>sla-prof>egress>qos>queue stat-mode)

Full Context

configure subscriber-mgmt sla-profile ingress qos policer stat-mode

configure subscriber-mgmt sla-profile ingress qos queue stat-mode

configure subscriber-mgmt sla-profile egress qos policer stat-mode

configure subscriber-mgmt sla-profile egress qos queue stat-mode

Description

This command is used to configure the forwarding plane octet and packet counters of a policer or queue to count packets of a specific type or state. For example separate counters for IPv4/IPv6 or separate counters for offered high and low priority policed traffic.

For policers, this command overrides the policer stat-mode configuration as defined in the sap-ingress or sap-egress qos policy. For details on sap-ingress and sap-egress policer stat-mode, refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide. For use in Enhanced Subscriber Management (ESM) context only, an additional stat-mode enables separate counters for IPv4 and IPv6 packets.

When a policer’s stat-mode is changed while the sla profile is in use, any previous counter values are lost and any new counters are set to zero.

For queues, this command sets the stat-mode. Queue stat-mode is only available for use in Enhanced Subscriber Management (ESM) context to enable separate IPv4/IPv6 counters.

A queue’s stat-mode cannot be changed while the SLA profile is in use.

The no form of this command reverts to the default.

Default

For policers, the default is no stat-mode override. The sap-ingress or sap-egress stat-mode is used instead.

For queues, the default is to count in-/out-of-profile octets and packets.

Parameters

stat-mode

Specifies the stat mode for the policer.

For ingress and egress qos queue stat-mode overrides.

For ingress and egress qos policer stat-mode overrides, refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide for details on the sap-ingress and sap-egress policer stat-mode parameters.

For use in Enhanced Subscriber Management (ESM) context only:

Values

no-stats, minimal, offered-profile-no-cir, offered-priority-no-cir, offered-profile-cir, offered-priority-cir, offered-total-cir, offered-limited-profile-cir, offered-profile-capped-cir, offered-limited-capped-cir, v4-v6 (count IPv4 and IPv6 forwarded/dropped octets and packets separately)

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

• configure subscriber-mgmt sla-profile ingress qos policer stat-mode
• configure subscriber-mgmt sla-profile egress qos policer stat-mode

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

• configure subscriber-mgmt sla-profile egress qos queue stat-mode
• configure subscriber-mgmt sla-profile ingress qos queue stat-mode

Context

[Tree] (config>card>fp>ingress>access>qgrp>policer-over>plcr stat-mode)

[Tree] (config>card>fp>ingress>network>qgrp>policer-over>plcr stat-mode)

Full Context

configure card fp ingress access queue-group policer-override policer stat-mode

configure card fp ingress network queue-group policer-override policer stat-mode

Description

This command configures the forwarding plane counters that allow offered, output and discard accounting to occur for the policer. An ingress policer has multiple types of offered packets (explicit in-profile, explicit out-of-profile, high priority or low priority) and each of these offered types is interacting with the policer’s metering and profiling functions resulting in colored output packets (green, yellow and red). Due to the large number of policers, it is not economical to allocate counters in the forwarding plane for all possible offered packet types and output conditions. Many policers will not be configured with a CIR profiling rate and not all policers will receive explicitly profiled offered packets. The stat-mode command allows provisioning of the number of counters each policer requires and how the offered packet types and output conditions should be mapped to the counters.

While a no-stats mode is supported which prevents any packet accounting, the use of the policer’s parent command requires at the policer's stat-mode to be set at least to the minimal setting so that offered stats are available for the policer's Fair Information Rate (FIR) to be calculated. Once a policer has been made a child to a parent policer, the stat-mode cannot be changed to no-stats unless the policer parenting is first removed.

Each time the policer’s stat-mode is changed, any previous counter values are lost and any new counters are set to zero.

Each mode uses a certain number of counters per policer instance that are allocated from the forwarding plane’s policer counter resources. You can view the total/allocated/free stats by using the tools dump resource-usage command. If insufficient counters exist to implement a mode on any policer instance, the stat-mode change will fail and the previous mode will continue unaffected for all instances of the policer.

The default stat-mode when a policer is created within the policy is minimal.

The stat-mode setting defined for the policer in the QoS policy may be overridden on an sla-profile or SAP where the policy is applied. If insufficient policer counter resources exist to implement the override, the stat-mode override command will fail. The previous stat-mode setting active for the policer will continue to be used by the policer.

The no form of this command attempts to return the policer’s stat-mode setting to minimal. The command will fail if insufficient policer counter resources exist to implement minimal where the QoS policer is currently applied and has a forwarding class mapping.

Parameters

See the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide for details on the policer stat-mode parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>service>cpipe>sap>ingress>policer-over>plcr stat-mode)

[Tree] (config>service>epipe>sap>egress>policer-over>plcr stat-mode)

[Tree] (config>service>epipe>sap>ingress>policer-over>plcr stat-mode)

[Tree] (config>service>ipipe>sap>ingress>policer-over>plcr stat-mode)

[Tree] (config>service>ipipe>sap>egress>policer-over>plcr stat-mode)

[Tree] (config>service>cpipe>sap>egress>policer-over>plcr stat-mode)

Full Context

configure service cpipe sap ingress policer-override policer stat-mode

configure service epipe sap egress policer-override policer stat-mode

configure service epipe sap ingress policer-override policer stat-mode

configure service ipipe sap ingress policer-override policer stat-mode

configure service ipipe sap egress policer-override policer stat-mode

configure service cpipe sap egress policer-override policer stat-mode

Description

The SAP QoS policy’s policer stat-mode command is used to configure the forwarding plane counters that allow offered, output, and discard accounting to occur for the policer. A policer has multiple types of offered packets (for example, soft in-profile and out-of-profile from ingress and hard in-profile and out-of-profile due to egress profile overrides) and each of these offered types is interacting with the policers metering and profiling functions resulting in colored output packets (green, yellow, and red). Due to the potentially large number of egress policers, it is not economical to allocate counters in the forwarding plane for all possible offered packet types and output conditions. Many policers will not be configured with a CIR profiling rate and not all policers will receive explicitly re-profiled offered packets. The stat-mode command allows provisioning of the number of counters each policer requires and indicates how the offered packet types and output conditions should be mapped to the counters.

While a no-stats mode is supported that prevents any packet accounting, the use of the policer’s parent command requires that the policer’s stat-mode to be set at least to the minimal setting so that offered statistics are available for the policer’s Fair Information Rate (FIR) to be calculated.

Each time the policer’s stat mode is changed, any previous counter values are lost and any new counters are set to zero.

Each mode uses a certain number of counters per policer instance that are allocated from the forwarding plane’s policer counter resources. The total/allocated/free statistics can be viewed by using the tools dump resource-usage card slot-num fp fp-number command. If insufficient counters exist to implement a mode on any policer instance, the stat-mode change will fail and the previous mode will continue unaffected for all instances of the policer.

The stat-mode setting defined for the policer in the QoS policy may be overridden on a SAP where the policy is applied. If insufficient policer counter resources exist to implement the override, the stat-mode override command will fail. The current active stat mode setting will continue to be used by the policer.

The command will fail if insufficient policer counter resources exist to implement minimal where the QoS policer is currently applied and has a forwarding class mapping.

The no form of this command attempts to return the policer’s stat-mode setting to minimal.

Refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide for detailed information about the supported parameters for the policer stat-mode command.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS

• configure service cpipe sap ingress policer-override policer stat-mode
• configure service cpipe sap egress policer-override policer stat-mode

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

• configure service ipipe sap ingress policer-override policer stat-mode
• configure service epipe sap egress policer-override policer stat-mode
• configure service ipipe sap egress policer-override policer stat-mode
• configure service epipe sap ingress policer-override policer stat-mode

Context

[Tree] (config>service>vpls>sap>egress>policer-override>plcr stat-mode)

[Tree] (config>service>vpls>sap>ingress>policer-override>plcr stat-mode)

Full Context

configure service vpls sap egress policer-override policer stat-mode

configure service vpls sap ingress policer-override policer stat-mode

Description

The SAP-egress QoS policy’s policer stat-mode command is used to configure the forwarding plane counters that allow offered, output and discard accounting to occur for the policer. A policer has multiple types of offered packets (for example, soft in-profile and out-of-profile from ingress and hard in-profile and out-of-profile due to egress profile overrides) and each of these offered types is interacting with the policers metering and profiling functions resulting in colored output packets (green, yellow and red). Due to the potential large number of egress policers, it is not economical to allocate counters in the forwarding plane for all possible offered packet types and output conditions. Many policers will not be configured with a CIR profiling rate and not all policers will receive explicitly re-profiled offered packets. The stat-mode command allows provisioning of the number of counters each policer requires and how the offered packet types and output conditions should be mapped to the counters.

While a no-stats mode is supported which prevents any packet accounting, the use of the policer’s parent command requires that the policer’s stat-mode to be set at least to the minimal setting so that offered stats are available for the policer’s Fair Information Rate (FIR) to be calculated.

Each time the policer’s stat-mode is changed, any previous counter values are lost and any new counters are set to zero.

Each mode uses a certain number of counters per policer instance that are allocated from the forwarding plane’s policer counter resources. You can view the total/allocated/free stats by using the tools dump resource-usage card slot-num fp fp-number command. If insufficient counters exist to implement a mode on any policer instance, the stat-mode change will fail and the previous mode will continue unaffected for all instances of the policer.

The default stat-mode when a policer is created within the policy is minimal.

The stat-mode setting defined for the policer in the QoS policy may be overridden on a SAP where the policy is applied. If insufficient policer counter resources exist to implement the override, the stat-mode override command will fail. The previous stat-mode setting active for the policer will continue to be used by the policer.

The no form of the command returns the policer’s stat-mode setting to minimal.

Refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide for detailed information about the policer stat-mode command parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>service>ies>if>sap>egress>policer-override>plcr stat-mode)

[Tree] (config>service>ies>if>sap>ingress>policer-override>plcr stat-mode)

Full Context

configure service ies interface sap egress policer-override policer stat-mode

configure service ies interface sap ingress policer-override policer stat-mode

Description

The SAP-egress QoS policy’s policer stat-mode command is used to configure the forwarding plane counters that allow offered, output and discard accounting to occur for the policer. A policer has multiple types of offered packets (for example, soft in-profile and out-of-profile from ingress and hard in-profile and out-of-profile due to egress profile overrides) and each of these offered types is interacting with the policers metering and profiling functions resulting in colored output packets (green, yellow and red). Due to the potential large number of egress policers, it is not economical to allocate counters in the forwarding plane for all possible offered packet types and output conditions. Many policers will not be configured with a CIR profiling rate and not all policers will receive explicitly re-profiled offered packets. The stat-mode command allows provisioning of the number of counters each policer requires and how the offered packet types and output conditions should be mapped to the counters.

While a no-stats mode is supported which prevents any packet accounting, the use of the policer’s parent command requires that the policer’s stat-mode to be set at least to the minimal setting so that offered stats are available for the policer’s Fair Information Rate (FIR) to be calculated.

Each time the policer’s stat-mode is changed, any previous counter values are lost and any new counters are set to zero.

Each mode uses a certain number of counters per policer instance that are allocated from the forwarding plane’s policer counter resources. You can view the total/allocated/free stats by using the tools dump resource-usage card slot-num fp fp-number command. If insufficient counters exist to implement a mode on any policer instance, the stat-mode change will fail and the previous mode will continue unaffected for all instances of the policer.

The default stat-mode when a policer is created within the policy is minimal.

The stat-mode setting defined for the policer in the QoS policy may be overridden on a SAP where the policy is applied. If insufficient policer counter resources exist to implement the override, the stat-mode override command will fail. The previous stat-mode setting active for the policer will continue to be used by the policer.

The no form of this command returns the policer’s stat-mode setting to minimal.

Refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide for detailed information about the policer stat-mode command parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>service>vprn>if>sap>ingress>policer-override>plcr stat-mode)

[Tree] (config>service>vprn>if>sap>egress>policer-override>plcr stat-mode)

Full Context

configure service vprn interface sap ingress policer-override policer stat-mode

configure service vprn interface sap egress policer-override policer stat-mode

Description

The SAP-egress QoS policy’s policer stat-mode command is used to configure the forwarding plane counters that allow offered, output and discard accounting to occur for the policer. A policer has multiple types of offered packets (for example, soft in-profile and out-of-profile from ingress and hard in-profile and out-of-profile due to egress profile overrides) and each of these offered types is interacting with the policers metering and profiling functions resulting in colored output packets (green, yellow and red). Due to the potential large number of egress policers, it is not economical to allocate counters in the forwarding plane for all possible offered packet types and output conditions. Many policers will not be configured with a CIR profiling rate and not all policers will receive explicitly re-profiled offered packets. The stat-mode command allows provisioning of the number of counters each policer requires and how the offered packet types and output conditions should be mapped to the counters.

While a no-stats mode is supported which prevents any packet accounting, the use of the policer’s parent command requires that the policer’s stat-mode to be set at least to the minimal setting so that offered stats are available for the policer’s Fair Information Rate (FIR) to be calculated.

Each time the policer’s stat-mode is changed, any previous counter values are lost and any new counters are set to zero.

Each mode uses a certain number of counters per policer instance that are allocated from the forwarding plane’s policer counter resources. You can view the total/allocated/free stats by using the tools dump resource-usage card slot-num fp fp-number command. If insufficient counters exist to implement a mode on any policer instance, the stat-mode change will fail and the previous mode will continue unaffected for all instances of the policer.

The default stat-mode when a policer is created within the policy is minimal.

The stat-mode setting defined for the policer in the QoS policy may be overridden on a SAP where the policy is applied. If insufficient policer counter resources exist to implement the override, the stat-mode override command will fail. The previous stat-mode setting active for the policer will continue to be used by the policer.

The no form of this command returns the policer’s stat-mode setting to minimal.

Refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR Quality of Service Guide for detailed information about the policer stat-mode command parameters.

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS, VSR

Context

[Tree] (config>qos>sap-ingress>dyn-policer stat-mode)

[Tree] (config>qos>sap-ingress>policer stat-mode)

Full Context

configure qos sap-ingress dynamic-policer stat-mode

configure qos sap-ingress policer stat-mode

Description

This command is used to configure the forwarding plane counters that allow offered, forwarded, and dropped accounting to occur for the policer. An ingress policer has multiple types of offered packets (explicit in-profile, explicit out-of-profile, uncolored, high-priority, or low priority) and each of these offered types is interacting with the policer’s metering and profiling functions resulting in colored output packets (green, yellow, and red). Due to the large number of policers, it is not economical to allocate counters in the forwarding plane for all possible offered packet types and output conditions. Many policers, for example, will not be configured with a CIR profiling rate and not all policers will receive explicitly profiled offered packets. The stat-mode command allows provisioning of the number of counters each policer requires and how the offered packet types and output conditions should be mapped to the counters.

While a no-stats mode is supported that prevents any packet accounting, the use of the policer’s parent command requires that the policer's stat-mode be set at least to the minimal setting so that offered stats are available for the policer's Fair Information Rate (FIR) to be calculated. When a policer has been made a child to a parent policer, the stat-mode cannot be changed to no-stats unless the policer parenting is first removed.

Each time the policer’s stat-mode is changed, any previous counter values are lost and any new counters are set to zero.

Each mode uses a certain number of counters per policer instance that are allocated from the forwarding plane’s policer counter resources. The total/allocated/free stats can be viewed by using the tools dump resource-usage card fp command. If insufficient counters exist to implement a mode on any policer instance, the stat-mode change will fail and the previous mode will continue unaffected for all instances of the policer.

The ingress policer stat-modes are described in Ingress Policer Stat Mode Summary .

The default stat-mode when a policer is created within the policy is minimal.

The stat-mode setting defined for the policer in the QoS policy may be overridden on an sla-profile or SAP where the policy is applied. If insufficient policer counter resources exist to implement the override, the stat-mode override command will fail. The previous stat-mode setting active for the policer will continue to be used by the policer.

The no form of this command attempts to return the policer’s stat-mode setting to minimal. The command will fail if insufficient policer counter resources exist to implement minimal where the QoS policer is currently applied and has a forwarding class mapping.

Parameters

no-stats

Counter resource allocation: 0

The policer does not have any forwarding plane counters allocated and cannot provide offered, dropped, and forwarded statistics. A policer using no-stats cannot be a child to a parent policer and the policer’s parent command will fail.

When collect-stats is enabled, no statistics are generated.

minimal

Counter resource allocation: 1

This stat-mode provides the minimal accounting resource usage and counter information, and includes the total offered, dropped and forwarded packet and octet counters for traffic entering (offered) and exiting (dropped/forwarded) the policer.

The default stat-mode for a policer is minimal. The minimal mode allocates 1 forwarding plane offered counter and one traffic manager discard counter. The forwarding counter is derived by subtracting the discard counter from the offered counter. The counters do not differentiate possible offered types (profile or priority) and do not count in-profile or out-of-profile output. This does not prevent the policer from supporting different offered packet types and does not prevent the policer from supporting a CIR rate.

This counter mode is useful when only the most basic accounting information is required.

The counters displayed in the show output and those collected when collect-stats is enabled (the actual fields collected depends on the record configured in the applied accounting policy) are described in Ingress Accounting Statistics Collected in minimal stat-mode .

Table 7. Ingress Accounting Statistics Collected in minimal stat-mode

Show Output	Accounting Statistics Collected
	Field	Field Description
Off. All	apo	AllPacketsOffered
	aoo	AllOctetsOffered
Dro. All	apd	AllPacketsDropped
	aod	AllOctetsDropped
For. All	apf	AllPacketsForwarded
	aof	AllOctetsForwarded

offered-profile-no-cir

Counter resource allocation: 2

This stat-mode provides offered, dropped and forwarded packet and octet counters corresponding to the profile of traffic entering the policer.

The offered-profile-no-cir mode allocates two forwarding plane offered counters and two traffic manager discard counters.

The offered-profile-no-cir mode is most useful when the policer is receiving only in-profile and out-of-profile premarked (and trusted) packets. It is expected that, in this instance, a CIR rate will not be defined since all packets are already premarked. This mode does not prevent the policer from receiving untrusted (color undefined) traffic nor does it prevent the policer from being configured with a CIR rate.

This mode is intended to be used without profile-capped configured within the policer as it could cause the traffic profile to be modified by the policer.

The counters displayed in the show output and those collected when collect-stats is enabled (the actual fields collected depends on the record configured in the applied accounting policy) are described in Ingress Accounting Statistics Collected in offered-profile-no-cir stat-mode .

Table 8. Ingress Accounting Statistics Collected in offered-profile-no-cir stat-mode

Show Output	Accounting Statistics Collected
	Field	Field Description
Off. InProf	ipo	InProfilePacketsOffered
	ioo	InProfileOctetsOffered
Off. OutProf	opo	OutOfProfilePacketsOffered
	ooo	OutOfProfileOctetsOffered
Dro. InProf	ipd	InProfilePacketsDropped
	iod	InProfileOctetsDropped
Dro. OutProf	opd	OutOfProfilePacketsDropped
	ood	OutOfProfileOctetsDropped
For. InProf	ipf	InProfilePacketsForwarded
	iof	InProfileOctetsForwarded
For. OutProf	opf	OutOfProfilePacketsForwarded
	oof	OutOfProfileOctetsForwarded

offered-priority-no-cir

Counter resource allocation: 2

This stat-mode provides offered, dropped and forwarded packet and octet counters corresponding to the packet priority of traffic entering the policer.

The offered-priority-no-cir mode allocates two forwarding plane offered counters and two traffic manager discard counters.

The offered-priority-no-cir mode is most useful when the policer is receiving only untrusted packets and the ingress priority high and priority low classification options are being used without a CIR profiling rate defined. This mode does not prevent the policer from receiving trusted packets that are premarked in-profile or out-of-profile nor does it prevent the policer from being configured with a CIR rate.

This mode is intended to be used without profile-capped configured within the policer as it could cause the traffic profile to be modified by the policer.

The counters displayed in the show output and those collected when collect-stats is enabled (the actual fields collected depends on the record configured in the applied accounting policy) are described in Ingress Accounting Statistics Collected in offered-priority-no-cir stat-mode .

Table 9. Ingress Accounting Statistics Collected in offered-priority-no-cir stat-mode

Show Output	Accounting Statistics Collected
	Field	Field Description
Off. HiPrio	hpo	HighPriorityPacketsOffered
	hoo	HighPriorityOctetsOffered
Off. LowPrio	lpo	LowPriorityPacketsOffered
	loo	LowPriorityOctetsOffered
Dro. HiPrio	hpd	HighPriorityPacketsDropped
	hod	HighPriorityOctetsDropped
Dro. LowPrio	lpd	LowPriorityPacketsDropped
	lod	LowPriorityOctetsDropped
For. HiPrio	hpf	HighPriorityPacketsForwarded
	hof	HighPriorityOctetsForwarded
For. LowPrio	lpf	LowPriorityPacketsForwarded
	lof	LowPriorityOctetsForwarded

offered-profile-cir

Counter resource allocation: 4

This stat-mode provides offered, dropped and forwarded packet and octet counters corresponding to the profile of traffic entering (offered) and exiting (dropped/forwarded) the policer when ingress reclassification is performed so that the traffic entering the policer comprises hard in/out and uncolored traffic. The offered counters cover traffic explicitly profiled to in-profile, traffic explicitly profiled to out-of-profile, and traffic that has not been explicitly profiled at ingress (uncolored).

The offered-profile-cir mode allocates four forwarding plane offered counters and four traffic manager discard counters.

The offered-profile-cir mode is most useful when the policer is receiving trusted out-of-profile and in-profile traffic and is also receiving untrusted packets that are being applied to a defined CIR profiling rate. This mode differs from offered-limited-profile-cir mode in that it expects both trusted in-profile and out-of-profile packets while still performing CIR profiling on packets with untrusted markings. If trusted in-profile packets are not being received, the offered-limited-profile-cir stat-mode could be used instead, which has the benefit of using a reduced number of stat resources.

This mode is intended to be used without profile-capped configured within the policer as this could cause the traffic profile to be modified by the policer in a way that is not accounted for in the statistics.

The counters displayed in the show output and those collected when collect-stats is enabled (the actual fields collected depends on the record configured in the applied accounting policy) are described in Ingress Accounting Statistics Collected in offered-profile-cir stat-mode .

Table 10. Ingress Accounting Statistics Collected in offered-profile-cir stat-mode

Show Output	Accounting Stats Collected
	Field	Field Description
Off. InProf	ipo	InProfilePacketsOffered
	ioo	InProfileOctetsOffered
Off. OutProf	opo	OutOfProfilePacketsOffered
	ooo	OutOfProfileOctetsOffered
Off. Uncolor	ucp	UncoloredPacketsOffered
	uco	UncoloredOctetsOffered
Dro. InProf	ipd	InProfilePacketsDropped
	iod	InProfileOctetsDropped
Dro. OutProf	opd	OutOfProfilePacketsDropped
	ood	OutOfProfileOctetsDropped
For. InProf	ipf	InProfilePacketsForwarded
	iof	InProfileOctetsForwarded
For. OutProf	opf	OutOfProfilePacketsForwarded
	oof	OutOfProfileOctetsForwarded

offered-priority-cir

Counter resource allocation: 4

This stat-mode provides offered, dropped and forwarded packet and octet counters corresponding to the priority of traffic entering the policer and the profile exiting the policer.

The offered-priority-cir mode allocates four forwarding plane offered counters and four traffic manager discard counters.

The offered-priority-cir mode is most useful when the policer is receiving only untrusted packets that are being classified as high priority or low priority and are being applied to a defined CIR profiling rate. This mode differs from offered-profile-cir mode in that it does not expect trusted in-profile and out-of-profile packets but does not exclude the ability of the policer to receive them.

This mode is intended to be used without profile-capped configured within the policer as it could cause the traffic profile to be modified by the policer in a way that is not accounted for in the statistics.

The counters displayed in the show output and those collected when collect-stats is enabled (the actual fields collected depends on the record configured in the applied accounting policy) are described in Ingress Accounting Statistics Collected in offered-priority-cir stat-mode .

Table 11. Ingress Accounting Statistics Collected in offered-priority-cir stat-mode

Show Output	Accounting Stats Collected
	Field	Field Description
Off. HiPrio	hpo	HighPriorityPacketsOffered
	hoo	HighPriorityOctetsOffered
Off. LowPrio	lpo	LowPriorityPacketsOffered
	loo	LowPriorityOctetsOffered
Dro. InProf	ipd	InProfilePacketsDropped
	iod	InProfileOctetsDropped
Dro. OutProf	opd	OutOfProfilePacketsDropped
	ood	OutOfProfileOctetsDropped
For. InProf	ipf	InProfilePacketsForwarded
	iof	InProfileOctetsForwarded
For. OutProf	opf	OutOfProfilePacketsForwarded
	oof	OutOfProfileOctetsForwarded

offered-total-cir

Counter resource allocation: 2

This stat-mode provides offered, dropped and forwarded packet and octet counters corresponding to the profile of traffic entering (offered) and exiting (dropped/forwarded) the policer. All offered traffic is provided in a single counter.

The offered-total-cir mode allocates two forwarding plane offered counters and two traffic manager discard counters.

The offered-total-cir mode is most useful when the policer is not receiving trusted in-profile or out-of-profile traffic and both high- and low-priority classifications are not being used on the untrusted packets and the offered packets are being applied to a defined CIR profiling rate. This mode does not prevent the policer from receiving trusted in-profile or out-of-profile packets and does not prevent the use of priority high or low classifications on the untrusted packets.

This mode is intended to be used without profile-capped configured within the policer as it could cause the traffic profile to be modified by the policer in a way that is not accounted for in the statistics.

The counters displayed in the show output and those collected when collect-stats is enabled (the actual fields collected depends on the record configured in the applied accounting policy) are described in Ingress Accounting Statistics Collected in offered-total-cir stat-mode .

Table 12. Ingress Accounting Statistics Collected in offered-total-cir stat-mode

Show Output	Accounting Stats Collected
	Field	Field Description
Off. All	apo	AllPacketsOffered
	aoo	AllOctetsOffered
Dro. InProf	ipd	InProfilePacketsDropped
	iod	InProfileOctetsDropped
Dro. OutProf	opd	OutOfProfilePacketsDropped
	ood	OutOfProfileOctetsDropped
For. InProf	ipf	InProfilePacketsForwarded
	iof	InProfileOctetsForwarded
For. OutProf	opf	OutOfProfilePacketsForwarded
	oof	OutOfProfileOctetsForwarded