Cisco IOS IPv6 Command Reference

router-id (IPv6)

To use a fixed router ID, use the router-id command in router configuration mode. To force Open Shortest Path First (OSPF) for IPv6 to use the previous OSPF for IPv6 router ID behavior, use the no form of this command.

router-id {router-id}

no router-id {router-id}

Syntax Description

Command Default

The router ID is chosen automatically.

Command Modes

Router configuration

Command History

Usage Guidelines

OSPF for IPv6 (or OSPF version 3, or OSPFv3) is backward-compatible with OSPF version 2. In OSPFv3 and OSPF version 2, the router uses the 32-bit IPv4 address to select the router ID for an OSPF process. If an IPv4 address exists when OSPFv3 is enabled on an interface, then that IPv4 address is used for the router ID. If more than one IPv4 address is available, a router ID is chosen using the same rules as for OSPF version 2. If no IPv4 addresses are configured, the router selects a router ID automatically. Each router ID must be unique.

If this command is used on an OSPF for IPv6 router process that is already active (has neighbors), the new router ID is used at the next reload or at a manual OSPFv3 process restart. To manually restart the OSPFv3 process, use the clear ipv6 ospf process command.

Examples

The following example specifies a fixed router ID:

Router(config-rtr)# router-id 10.1.1.1

Related Commands

router-id (OSPFv3)

To use a fixed router ID, use the router-id command in Open Shortest Path First version 3 (OSPFv3) router configuration mode. To force OSPFv3 to use the previous OSPFv3 router ID behavior in IPv4, use the no form of this command.

router-id {router-id}

no router-id {router-id}

Syntax Description

Command Default

The router ID is chosen automatically.

Command Modes

OSPFv3 router configuration mode (config-router)

Command History

Usage Guidelines

OSPFv3 is backward-compatible with OSPF version 2. In OSPFv3 and OSPF version 2, the router uses the 32-bit IPv4 address to select the router ID for an OSPFv3 process. If an IPv4 address exists when OSPFv3 is enabled on an interface, then that IPv4 address is used for the router ID. If more than one IPv4 address is available, a router ID is chosen using the same rules as for OSPF version 2. If no IPv4 addresses are configured, the router selects a router ID automatically. Each router ID must be unique.

If this command is used on an OSPFv3 router process that is already active (has neighbors), the new router ID is used at the next reload or at a manual OSPFv3 process restart.

Examples

The following example specifies a fixed router ID:

Router(config-router)# router-id 10.1.1.1

Related Commands

router-preference maximum

To verify the advertised default router preference parameter value, use the router-preference maximum command in router advertisement (RA) guard policy configuration mode:

router-preference maximum {high | low | medium}

Syntax Description

Command Default

The router preference maximum value is not configured.

Command Modes

RA guard policy configuration (config-ra-guard)

Command History

Usage Guidelines

The router-preference maximum command enables verification that the advertised default router preference parameter value is lower than or equal to a specified limit. You can use this command to give a lower priority to default routers advertised on trunk ports, and to give precedence to default router advertised on access ports.

The router-preference maximum command limit are high, medium, or low. If, for example, this value is set to medium and the advertised default router preference is set to high in the received packet, then packet is dropped. If the command option is set to medium or low in the received packet, then packet is not dropped.

Examples

The following example defines an RA guard policy name as raguard1, places the router in RA guard policy configuration mode, and configures router-preference maximum verification to be high:

Router(config)# ipv6 nd raguard policy raguard1

Router(config-nd-inspection)# router-preference maximum high

Related Commands

route-target

To create a route-target extended community for a Virtual Private Network (VPN) routing and forwarding (VRF) instance, use the route-target command in VRF configuration or in VRF address family configuration mode. To disable the configuration of a route-target community option, use the no form of this command.

route-target [import | export | both] route-target-ext-community

no route-target [import | export | both] [route-target-ext-community]

Syntax Description

Command Default

A VRF has no route-target extended community attributes associated with it.

Command Modes

VRF address family configuration (config-vrf-af)
VRF configuration (config-vrf)

Command History

Usage Guidelines

The route-target command creates lists of import and export route-target extended communities for the specified VRF. Enter the command one time for each target community. Learned routes that carry a specific route-target extended community are imported into all VRFs configured with that extended community as an import route target. Routes learned from a VRF site (for example, by Border Gateway Protocol (BGP), Routing Information Protocol (RIP), or static route configuration) contain export route targets for extended communities configured for the VRF added as route attributes to control the VRFs into which the route is imported.

The route target specifies a target VPN extended community. Like a route distinguisher, an extended community is composed of either an autonomous system number and an arbitrary number or an IP address and an arbitrary number. You can enter the numbers in either of these formats:

•16-bit autonomous-system-number:your 32-bit number
For example, 101:3.

•32-bit IP address:your 16-bit number
For example, 192.168.122.15:1.

Note In Cisco IOS releases that include 4-byte ASN support, command accounting and command authorization that include a 4-byte ASN number are sent in the asplain notation irrespective of the format that is used on the command-line interface.

In Cisco IOS Release 12.0(32)SY8, 12.0(33)S3, 12.2(33)SRE, 12.2(33)XNE, 12.2(33)SXI1, Cisco IOS XE Release 2.4, and later releases, the Cisco implementation of 4-byte autonomous system numbers uses asplain—65538, for example—as the default regular expression match and output display format for autonomous system numbers, but you can configure 4-byte autonomous system numbers in both the asplain format and the asdot format as described in RFC 5396. To change the default regular expression match and output display of 4-byte autonomous system numbers to asdot format, use the bgp asnotation dot command followed by the clear ip bgp * command to perform a hard reset of all current BGP sessions.

In Cisco IOS Release 12.0(32)S12, 12.4(24)T, and Cisco IOS XE Release 2.3, the Cisco implementation of 4-byte autonomous system numbers uses asdot—1.2, for example—as the only configuration format, regular expression match, and output display, with no asplain support.

Examples

The following example shows how to configure route-target extended community attributes for a VRF in IPv4. The result of the command sequence is that VRF named vrf1 has two export extended communities (1000:1 and 1000:2) and two import extended communities (1000:1 and 10.27.0.130:200):

ip vrf vrf1

 route-target both 1000:1

 route-target export 1000:2

 route-target import 10.27.0.130:200

The following example shows how to configure route-target extended community attributes for a VRF that includes IPv4 and IPv6 address families:

vrf definition site1 

rd 1000:1

address-family ipv4

 route-target export 100:1

 route-target import 100:1

address-family ipv6

 route-target export 200:1

 route-target import 200:1

The following example available in Cisco IOS Release 12.0(32)SY8, 12.0(33)S3, 12.2(33)SRE, 12.2(33)XNE, 12.2(33)SXI1, Cisco IOS XE Release 2.4, and later releases shows how to create a VRF with a route target that uses a 4-byte autonomous system number in asplain format—65537—and how to set the route target to extended community value 65537:100 for routes that are permitted by the route map:

ip vrf vrf1

 rd 64500:100

 route-target both 65537:100 

 exit

route-map vrf1 permit 10

 set extcommunity rt 65537:100

 end

After the configuration is completed, use the show route-map command to verify that the extended community is set to the route target containing the 4-byte autonomous system number of 65537:

Router# show route-map vrf1

route-map vrf1, permit, sequence 10

  Match clauses:

  Set clauses:

    extended community RT:65537:100

  Policy routing matches: 0 packets, 0 bytes

The following example available in Cisco IOS Release 12.0(32)SY8, 12.0(32)S12, 12.2(33)SRE, 12.2(33)XNE, 12.2(33)SXI1, 12.4(24)T, Cisco IOS XE Release 2.3, and later releases, shows how to create a VRF with a route target that uses a 4-byte autonomous system number in asdot format—1.1—and how to set the route target to extended community value 1.1:100 for routes that are permitted by the route map:

ip vrf vrf1

 rd 64500:100

 route-target both 1.1:100 

 exit

route-map vrf1 permit 10

 set extcommunity rt 1.1:100

 end

Related Commands

rsakeypair

To specify which Rivest, Shamir, and Adelman (RSA) key pair to associate with the certificate, use the rsakeypair command in ca-trustpoint configuration mode.

rsakeypair key-label [key-size [encryption-key-size]]

Syntax Description

Defaults

The fully qualified domain name (FQDN) key is used.

Command Modes

Ca-trustpoint configuration

Command History

Usage Guidelines

When you regenerate a key pair, you are responsible for reenrolling the identities associated with the key pair. Use the rsakeypair command to refer back to the named key pair.

Examples

The following example is a sample trustpoint configuration that specifies the RSA key pair "exampleCAkeys":

crypto ca trustpoint exampleCAkeys

 enroll url http://exampleCAkeys/certsrv/mscep/mscep.dll

 rsakeypair exampleCAkeys 1024 1024

Related Commands

sccp ccm

To add a Cisco Unified Communications Manager server to the list of available servers and set various parameters—including IP address or Domain Name System (DNS) name, port number, and version number—use the sccp ccm command in global configuration mode. To remove a particular server from the list, use the no form of this command.

NM-HDV or NM-HDV-FARM Voice Network Modules

sccp ccm {ipv4-address | ipv6-address | dns} priority priority [port port-number] [version version-number] [trustpoint label]

no sccp ccm {ipv4-address | ipv6-address | dns}

NM-HDV2 or NM-HD-1V/2V/2VE Voice Network Modules

sccp ccm {ipv4-address | ipv6-address | dns} identifier identifier-number [priority priority] [port port-number] [version version-number] [trustpoint label]

no sccp ccm {ipv4-address | ipv6-address | dns}

Syntax Description

Command Default

The default port number is 2000.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

You can configure up to four Cisco Unified Communications Manager servers—a primary and up to three backups—to support digital signal processor (DSP) farm services. To add the Cisco Unified Communications Manager server to a Cisco Unified Communications Manager group, use the associate ccm command.

IPv6 support is provided for registration with Cisco Unified CM version 7.0 and later.

To enable Ad Hoc or Meet-Me hardware conferencing in Cisco Unified CME, you must first set the version keyword to 4.0 or a later version.

Beginning with Cisco IOS Release 12.4(22)T users manually configuring the sccp ccm command must provide the version. Existing router configurations are not impacted because automatic upgrade and downgrade are supported.

Examples

The following example shows how to add the Cisco Unified Communications Manager server with IP address 10.0.0.0 to the list of available servers:

Router(config)# sccp ccm 10.0.0.0 identifier 3 port 1025 version 4.0

The following example shows how to add the Cisco Unified CallManager server whose IPv6 address is 2001:DB8:C18:1::102:

Router(config)# sccp ccm 2001:DB8:C18:1::102 identifier 2 version 7.0

Related Commands

sccp ccm group

To create a Cisco Unified Communications Manager group and enter SCCP Cisco CallManager configuration mode, use the sccp ccm group command in global configuration mode. To remove a particular Cisco Unified Communications Manager group, use the no form of this command.

sccp ccm group group-number

no sccp ccm group group-number

Syntax Description

Command Default

No groups are defined, so all servers are configured individually.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to group Cisco Unified Communications Manager servers that are defined using the sccp ccm command. You can associate designated DSP farm profiles using the associate profile command so that the DSP services are controlled by the Cisco Unified Communications Manager servers in the group.

Examples

The following example enters SCCP Cisco CallManager configuration mode and associates Cisco Unified Communications Manager 25 with Cisco Unified Communications Manager group 10:

Router(config)# sccp ccm group 10 

Router(config-sccp-ccm)# associate ccm 25 priority 2 

Related Commands

sec-level minimum

To specify the minimum security level parameter value when Cryptographically Generated Address (CGA) options are used, use the sec-level minimum command in Neighbor Discovery (ND) inspection policy configuration mode. To disable this function, use the no form of this command.

sec-level minimum value

no sec-level minimum value

Syntax Description

Command Default

The default security level is 1.

Command Modes

ND inspection policy configuration (config-nd-inspection)
RA guard policy configuration (config-ra-guard)

Command History

Usage Guidelines

The sec-level minimum command specifies the minimum security level parameter value when CGA options are used. Use the sec-level minimum command after enabling ND inspection policy configuration mode using the ipv6 nd inspection policy command.

Examples

The following example defines an ND policy name as policy1, places the router in ND inspection policy configuration mode, and enables the router to specify 2 as the minimum CGA security level:

Router(config)# ipv6 nd inspection policy policy1

Router(config-nd-inspection)# sec-level minimum 2

Related Commands

self-identity

To define the identity that the local Internet Key Exchange (IKE) uses to identify itself to the remote peer, use the self-identity command in ISAKMP profile configuration mode. To remove the Internet Security Association and Key Management Protocol (ISAKMP) identity that was defined for the IKE, use the no form of this command.

self-identity {address | address ipv6] | fqdn | user-fqdn user-fqdn}

no self-identity {address | address ipv6] | fqdn | user-fqdn user-fqdn}

Syntax Description

Command Default

If no ISAKMP identity is defined in the ISAKMP profile configuration, global configuration is the default.

Command Modes

ISAKMP profile configuration (config-isa-prof)

Command History

Examples

The following example shows that the IKE identity is the user FQDN "user@vpn.com":

crypto isakmp profile vpnprofile

 self-identity user-fqdn user@vpn.com

Related Commands

send-lifetime

To set the time period during which an authentication key on a key chain is valid to be sent, use the send-lifetime command in key chain key configuration mode. To revert to the default value, use the no form of this command.

send-lifetime start-time {infinite | end-time | duration seconds}

no send-lifetime [start-time {infinite | end-time | duration seconds}]

Syntax Description

Command Default

Forever (the starting time is January 1, 1993, and the ending time is infinite)

Command Modes

Key chain key configuration (config-keychain-key)

Command History

Usage Guidelines

Specify a start-time value and one of the following values: infinite, end-time, or duration seconds.

We recommend running Network Time Protocol (NTP) or some other time synchronization method if you intend to set lifetimes on keys.

If the last key expires, authentication will continue and an error message will be generated. To disable authentication, you must manually delete the last valid key.

Examples

The following example configures a key chain named chain1. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0

Router(config-if)# ip rip authentication key-chain chain1

Router(config-if)# ip rip authentication mode md5

!

Router(config)# router rip

Router(config-router)# network 172.19.0.0

Router(config-router)# version 2

!

Router(config)# key chain chain1

Router(config-keychain)# key 1

Router(config-keychain-key)# key-string key1

Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600

Router(config-keychain-key)# exit

Router(config-keychain)# key 2

Router(config-keychain-key)# key-string key2

Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

The following example configures a key chain named chain1 for EIGRP address-family. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# eigrp virtual-name

Router(config-router)# address-family ipv4 autonomous-system 4453

Router(config-router-af)# network 10.0.0.0

Router(config-router-af)# af-interface ethernet0/0

Router(config-router-af-interface)# authentication key-chain trees

Router(config-router-af-interface)# authentication mode md5

Router(config-router-af-interface)# exit

Router(config-router-af)# exit

Router(config-router)# exit

Router(config)# key chain chain1

Router(config-keychain)# key 1

Router(config-keychain-key)# key-string key1

Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600

Router(config-keychain-key)# exit

Router(config-keychain)# key 2

Router(config-keychain-key)# key-string key2

Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

Related Commands

send-nat-address

To send a client's post-Network Address Translation (NAT) address to the TACACS+ server, use the send-nat-address command in TACACS+ server configuration mode. To disable sending the post-NAT address, use the no form of this command.

send-nat-address

no send-nat-address

Syntax Description

This command has no arguments or keywords.

Command Default

The post-NAT address is not sent.

Command Modes

TACACS+ server configuration (config-server-tacacs)

Command History

Usage Guidelines

Use the send-nat-address command to send a client's post-NAT address to the TACACS+ server.

Examples

The following example shows how to send a client's post-NAT address to the TACACS+ server:

Router(config)# tacacs server server1

Router(config-server-tacacs)# send-nat-address

Related Commands

serial-number (ca-trustpoint)

To specify whether the router serial number should be included in the certificate request, use the serial-number command in ca-trustpoint configuration mode. To restore the default behavior, use the no form of this command.

serial-number [none]

no serial-number

Syntax Description

Defaults

Not configured. You will be prompted for the serial number during certificate enrollment.

Command Modes

Ca-trustpoint configuration

Command History

Usage Guidelines

Before you can issue the serial-number command, you must enable the crypto ca trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode.

Use this command to specify the router serial number in the certificate request, or use the none keyword to specify that a serial number should not be included in the certificate request.

Examples

The following example shows how to omit a serial number from the "root" certificate request:

crypto ca trustpoint root

 enrollment url http://10.3.0.7:80

 ip-address none

 fqdn none

 serial-number none

 subject-name CN=jack, OU=PKI, O=Cisco Systems, C=US

crypto ca trustpoint root

 enrollment url http://10.3.0.7:80

 serial-number

Related Commands

server name (IPv6 TACACS+)

To specify an IPv6 TACACS+ server, use the server name command in TACACS+ group server configuration mode. To remove the IPv6 TACACS+ server from configuration, use the no form of this command.

server name server-name

no server name server-name

Syntax Description

Command Default

No server name is specified.

Command Modes

TACACS+ group server configuration (config-sg-tacacs+)

Command History

Usage Guidelines

You must configure the aaa group server tacacs command before configuring this command.

Enter the server name command to specify an IPv6 TACACS+ server.

Examples

The following example shows how to specify an IPv6 TACACS+ server named server1:

Router(config)# aaa group server tacacs+

Router(config-sg-tacacs+)# server name server1

Related Commands

server-private (RADIUS)

To configure the IP address of the private RADIUS server for the group server, use the server-private command in server-group configuration mode. To remove the associated private server from the authentication, authorization, and accounting (AAA) group server, use the no form of this command.

server-private ip-address [auth-port port-number | acct-port port-number] [non-standard] [timeout seconds] [retransmit retries] [key string]

no server-private ip-address [auth-port port-number | acct-port port-number] [non-standard] [timeout seconds] [retransmit retries] [key string]

Syntax Description

Defaults

If server-private parameters are not specified, global configurations will be used; if global configurations are not specified, default values will be used.

Command Modes

Server-group configuration

Command History

Usage Guidelines

Use the server-private command to associate a particular private server with a defined server group. To prevent possible overlapping of private addresses between Virtual Route Forwardings (VRFs), private servers (servers with private addresses) can be defined within the server group and remain hidden from other groups, while the servers in the global pool (default "radius" server group) can still be referred to by IP addresses and port numbers. Thus, the list of servers in server groups includes references to the hosts in the global configuration and the definitions of private servers.

Note If the radius-server directed-request command is configured, then a private RADIUS server cannot be used as the group server by configuring the server-private (RADIUS) command.

Examples

The following example shows how to define the sg_water RADIUS group server and associate private servers with it:

aaa group server radius sg_water

 server-private 10.1.1.1 timeout 5 retransmit 3 key xyz

 server-private 10.2.2.2 timeout 5 retransmit 3 key xyz

Related Commands

server-private (TACACS+)

To configure the IPv4 or IPv6 address of the private TACACS+ server for the group server, use the server-private command in server-group configuration mode. To remove the associated private server from the authentication, authorization, and accounting (AAA) group server, use the no form of this command.

server-private {ip-address | name | ipv6-address} [nat] [single-connection] [port port-number] [timeout seconds] [key [0 | 7] string]

no server-private

Syntax Description

Command Default

If server-private parameters are not specified, global configurations will be used; if global configurations are not specified, default values will be used.

Command Modes

Server-group configuration (server-group)

Command History

Usage Guidelines

Use the server-private command to associate a particular private server with a defined server group. To prevent possible overlapping of private addresses between virtual route forwardings (VRFs), private servers (servers with private addresses) can be defined within the server group and remain hidden from other groups, while the servers in the global pool (default "TACACS+" server group) can still be referred to by IP addresses and port numbers. Thus, the list of servers in server groups includes references to the hosts in the global configuration and the definitions of private servers.

Examples

The following example shows how to define the tacacs1 TACACS+ group server and associate private servers with it:

aaa group server tacacs+ tacacs1

    server-private 10.1.1.1 port 19 key cisco

  ip vrf cisco

   rd 100:1

  interface Loopback0

   ip address 10.0.0.2 255.0.0.0

   ip vrf forwarding cisco

Related Commands

service pad

To enable all packet assembler/disassembler (PAD) commands and connections between PAD devices and access servers, use the service pad command in global configuration mode. To disable this service, use the no form of this command.

service pad [cmns] [from-xot] [to-xot]

no service pad [cmns] [from-xot] [to-xot]

Syntax Description

Command Default

All PAD commands and associated connections are enabled. PAD services over XOT or CMNS are not enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

The keywords from-xot and to-xot enable PAD calls to destinations that are not reachable over physical X.25 interfaces, but instead over TCP tunnels. This feature is known as PAD over XOT (X.25 over TCP).

Examples

If the service pad command is disabled, the pad EXEC command and all PAD related configurations, such as X.29, are unrecognized, as shown in the following example:

Router(config)# no service pad

Router(config)# x29 ?

% Unrecognized command

Router(config)# exit 

Router# pad ?

% Unrecognized command

If the service pad command is enabled, the pad EXEC command and access to an X.29 configuration are granted as shown in the following example:

Router# config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# service pad

Router(config)# x29 ?

access-list       Define an X.29 access list

inviteclear-time  Wait for response to X.29 Invite Clear message

profile           Create an X.3 profile

Router# pad ?

WORD   X121 address or name of a remote system

In the following example, PAD services over CMNS are enabled:

! Enable CMNS on a nonserial interface

interface ethernet0

 cmns enable

!

!Enable inbound and outbound PAD over CMNS service

service pad cmns

!

! Specify an X.25 route entry pointing to an interface's CMNS destination MAC address

x25 route ^2193330 interface Ethernet0 mac 00e0.b0e3.0d62

Router# show x25 vc

SVC 1,  State: D1,  Interface: Ethernet0

     Started 00:00:08, last input 00:00:08, output 00:00:08

     Line: 0   con 0    Location: console Host: 2193330

      connected to 2193330 PAD <--> CMNS Ethernet0 00e0.b0e3.0d62

     Window size input: 2, output: 2

     Packet size input: 128, output: 128

     PS: 2  PR: 3  ACK: 3  Remote PR: 2  RCNT: 0  RNR: no

     P/D state timeouts: 0  timer (secs): 0

     data bytes 54/19 packets 2/3 Resets 0/0 RNRs 0/0 REJs 0/0 INTs 0/0

Related Commands

service password-encryption

To encrypt passwords, use the service password-encryption command in global configuration mode. To restore the default, use the no form of this command.

service password-encryption

no service password-encryption

Syntax Description

This command has no arguments or keywords.

Command Default

No passwords are encrypted.

Command Modes

Global configuration

Command History

Usage Guidelines

The actual encryption process occurs when the current configuration is written or when a password is configured. Password encryption is applied to all passwords, including username passwords, authentication key passwords, the privileged command password, console and virtual terminal line access passwords, and Border Gateway Protocol neighbor passwords. This command is primarily useful for keeping unauthorized individuals from viewing your password in your configuration file.

When password encryption is enabled, the encrypted form of the passwords is displayed when a more system:running-config command is entered.

Caution This command does not provide a high level of network security. If you use this command, you should also take additional network security measures.

Note You cannot recover a lost encrypted password. You must clear NVRAM and set a new password.

Examples

The following example causes password encryption to take place:

service password-encryption

Related Commands

service-policy type inspect

To attach a firewall policy map to a zone-pair, use the service-policy type inspect command in zone-pair configuration mode. To disable this attachment to a zone-pair, use the no form of this command.

service-policy type inspect policy-map-name

no service-policy type inspect policy-map-name

Syntax Description

Command Default

None

Command Modes

Zone-pair configuration (config-sec-zone-pair)

Command History

Usage Guidelines

Use the service-policy type inspect command to attach a policy-map and its associated actions to a zone-pair.

Enter the command after entering the zone-pair security command.

Examples

The following example defines zone-pair z1-z2 and attaches the service policy p1 to the zone-pair:

!

zone security z1

zone security z2

!

class-map type inspect match-all c1

 match protocol tcp

policy-map type inspect p1

 class type inspect c1

  inspect

!

zone-pair security zp source z1 destination z2

 service-policy type inspect p1

!

Related Commands

service timestamps

To configure the system to apply a time stamp to debugging messages or system logging messages, use the service timestamps command in global configuration mode. To disable this service, use the no form of this command.

service timestamps [debug | log] [uptime | datetime [msec]] [localtime] [show-timezone] [year]

no service timestamps [debug | log]

Syntax Description

Command Default

Time stamps are applied to debug and logging messages.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Time stamps can be added to either debugging messages (service timestamp debug) or logging messages (service timestamp log) independently.

If the service timestamps command is specified with no arguments or keywords, the default is service timestamps debug uptime.

The no service timestamps command by itself disables time stamps for both debug and log messages.

The uptime form of the command adds time stamps (such as "2w3d") that indicating the time since the system was rebooted. The datetime form of the command adds time stamps (such as "Sep 5 2002 07:28:20") that indicate the date and time according to the system clock.

Entering the service timestamps {debug | log} command a second time will overwrite any previously configured service timestamp {debug | log} commands and associated options.

To set the local time zone, use the clock timezone zone hours-offset command in global configuration mode.

The time stamp will be preceeded by an asterisk or period if the time is potentially inaccurate. Table 49 describes the symbols that proceed the time stamp.

Examples

In the following example, the router begins with time-stamping disabled. Then, the default time-stamping is enabled (uptime time stamps applied to debug output). Then, the default time-stamping for logging is enabled (uptime time stamps applied to logging output).

Router# show running-config | include time 

no service timestamps debug uptime

no service timestamps log uptime

Router# config terminal 

Router(config)# service timestamps 

! issue the show running-config command in config mode using do 

Router(config)# do show running-config | inc time 

! shows that debug timestamping is enabled, log timestamping is disabled 

service timestamps debug uptime

no service timestamps log uptime

! enable timestamps for logging messages 

Router(config)# service timestamps log 

Router(config)# do show run | inc time 

service timestamps debug uptime

service timestamps log uptime

Router(config)# service sequence-numbers 

Router(config)# end 

000075: 5w0d: %SYS-5-CONFIG_I: Configured from console by console

! The following is a level 5 system logging message 

! The leading number comes from the service sequence-numbers command. 

! 4w6d indicates the timestamp of 4 weeks, 6 days

000075: 4w6d: %SYS-5-CONFIG_I: Configured from console by console

In the following example, the user enables time-stamping on logging messages using the current time and date in Coordinated Universal Time/Greenwich Mean Time (UTC/GMT), and enables the year to be shown.

Router(config)#

! The following line shows the timestamp with uptime (1 week 0 days) 

1w0d: %SYS-5-CONFIG_I: Configured from console by console

Router(config)# service timestamps log datetime show-timezone year 

Router(config)# end

! The following line shows the timestamp with datetime (11:13 PM March 22nd) 

.Mar 22 2004 23:13:25 UTC: %SYS-5-CONFIG_I: Configured from console by console

The following example shows the change from UTC to local time:

Router# configure terminal 

! Logging output can be quite long; first changing line width to show full 

! logging message 

Router(config)# line 0 

Router(config-line)# width 180 

Router(config-line)# logging synchronous 

Router(config-line)# end 

! Timestamping already enabled for logging messages; time shown in UTC. 

Oct 13 23:20:05 UTC: %SYS-5-CONFIG_I: Configured from console by console

Router# show clock 

23:20:53.919 UTC Wed Oct 13 2004

Router# configure terminal 

Enter configuration commands, one per line.  End with the end command. 

! Timezone set as Pacific Standard Time, with an 8 hour offset from UTC 

Router(config)# clock timezone PST -8 

Router(config)# 

Oct 13 23:21:27 UTC: %SYS-6-CLOCKUPDATE:  
System clock has been updated from 23:21:27 UTC Wed Oct 13 2004  
to 15:21:27 PST Wed Oct 13 2004, configured from console by console.

Router(config)# 

! Pacific Daylight Time (PDT) configured to start in April and end in October. 

! Default offset is +1 hour. 

Router(config)# clock summer-time PDT recurring first Sunday April 2:00 last Sunday 
October 2:00 

Router(config)#

! Time changed from 3:22 P.M. Pacific Standard Time (15:22 PST) 

! to 4:22 P.M. Pacific Daylight (16:22 PDT) 

Oct 13 23:22:09 UTC: %SYS-6-CLOCKUPDATE:  
System clock has been updated from 15:22:09 PST Wed Oct 13 2004  
to 16:22:09 PDT Wed Oct 13 2004, configured from console by console.

! Change the timestamp to show the local time and timezone. 

Router(config)# service timestamps log datetime localtime show-timezone 

Router(config)# end 

Oct 13 16:23:19 PDT: %SYS-5-CONFIG_I: Configured from console by console 

Router# show clock 

16:23:58.747 PDT Wed Oct 13 2004 

Router# config t 

Enter configuration commands, one per line.  End with the end command. 

Router(config)# service sequence-numbers 

Router(config)# end 

Router#

In the following example, the service timestamps log datetime command is used to change previously configured options for the date-time time stamp.

Router(config)# service timestamps log datetime localtime show-timezone 

Router(config)# end 

! The year is not displayed. 

Oct 13 15:44:46 PDT: %SYS-5-CONFIG_I: Configured from console by console 

Router# config t 

Enter configuration commands, one per line.  End with the end command.

Router(config)# service timestamps log datetime show-timezone year 

Router(config)# end 

! note: because the localtime option was not specified again, that option is 

! removed from the output, and time is displayed in UTC (the default) 

Oct 13 2004 22:45:31 UTC: %SYS-5-CONFIG_I: Configured from console by console

Related Commands

session protocol (dial peer)

To specify a session protocol for calls between local and remote routers using the packet network, use the session protocol command in dial-peer configuration mode. To reset to the default, use the no form of this command.

session protocol {aal2-trunk | cisco | sipv2 | smtp}

no session protocol

Syntax Description

Command Default

No default behaviors or values

Command Modes

Dial-peer configuration (config-dial-peer)

Command History

Usage Guidelines

The cisco keyword is applicable only to VoIP on the Cisco 1750, Cisco 1751, Cisco 3600 series, and Cisco 7200 series routers.

The aal2-trunk keyword is applicable only to VoATM on the Cisco 7200 series router.

This command applies to both on-ramp and off-ramp store-and-forward fax functions.

Examples

The following example shows that AAL2 trunking has been configured as the session protocol:

dial-peer voice 10 voatm

 session protocol aal2-trunk

The following example shows that Cisco session protocol has been configured as the session protocol:

dial-peer voice 20 voip

 session protocol cisco

The following example shows that a VoIP dial peer for SIP has been configured as the session protocol for VoIP call signaling:

dial-peer voice 102 voip

 session protocol sipv2

Related Commands

session target (VoIP dial peer)

To designate a network-specific address to receive calls from a VoIP or VoIPv6 dial peer, use the session target command in dial peer configuration mode. To reset to the default, use the no form of this command.

Cisco 1751, Cisco 3725, Cisco 3745, and Cisco AS5300

session target {dhcp | ipv4:destination-address | ipv6:[destination-address] | dns:[$s$. | $d$. | $e$. | $u$.] hostname | enum:table-num | loopback:rtp | ras | sip-server | registrar} [:port]

no session target

Cisco 2600 Series, Cisco 3600 Series, Cisco AS5350, Cisco AS5400, and Cisco AS5850

session target {dhcp | ipv4:destination-address | ipv6:[destination-address] | dns:[$s$. | $d$. | $e$. | $u$.] hostname | enum:table-num | loopback:rtp | ras | settlement provider-number | sip-server | registrar} [:port]

no session target

Syntax Description

Command Default

No IP address or domain name is defined.

Command Modes

Dial peer configuration (config-dial-peer)

Command History

Usage Guidelines

Use the session target command to specify a network-specific destination for a dial peer to receive calls from the current dial peer. You can select an option to define a network-specific address or domain name as a target, or you can select one of several methods to automatically determine the destination for calls from the current dial peer.

Use the session target dns command with or without the specified macros. Using the optional macros can reduce the number of VoIP dial-peer session targets that you must configure if you have groups of numbers associated with a particular router.

The session target enum command instructs the dial peer to use a table of translation rules to convert the dialed number identification service (DNIS) number into a number in E.164 format. This translated number is sent to a DNS server that contains a collection of URLs. These URLs identify each user as a destination for a call and may represent various access services, such as SIP, H.323, telephone, fax, e-mail, instant messaging, and personal web pages. Before assigning the session target to the dial peer, configure an ENUM match table with the translation rules using the voice enum-match-table command in global configuration mode. The table is identified in the session target enum command with the table-num argument.

Use the session target loopback command to test the voice transmission path of a call. The loopback point depends on the call origin.

Use the session target dhcp command to specify that the session target host is obtained via DHCP. The dhcp option can be made available only if the SIP is being used as the session protocol. To enable SIP, use the session protocol (dial peer) command.

In Cisco IOS Release 12.1(1)T the session target command configuration cannot combine the target of RAS with the settle-call command.

For the session target settlement provider-number command, when the VoIP dial peers are configured for a settlement server, the provider-number argument in the session target and settle-call commands should be identical.

Use the session target sip-server command to name the global SIP server interface as the destination for calls from the dial peer. You must first define the SIP server interface by using the sip-server command in SIP user-agent (UA) configuration mode. Then you can enter the session target sip-server option for each dial peer instead of having to enter the entire IP address for the SIP server interface under each dial peer.

After the SIP endpoints are registered with the SIP registrar in the hosted unified communications (UC), you can use the session target registrar command to route the call automatically to the registrar end point. You must configure the session target command on a dial pointing towards the end point.

Examples

The following example shows how to create a session target using DNS for a host named "voicerouter" in the domain example.com:

dial-peer voice 10 voip

 session target dns:voicerouter.example.com

The following example shows how to create a session target using DNS with the optional $u$. macro. In this example, the destination pattern ends with four periods (.) to allow for any four-digit extension that has the leading number 1310555. The optional $u$. macro directs the gateway to use the unmatched portion of the dialed number—in this case, the four-digit extension—to identify a dial peer. The domain is "example.com."

dial-peer voice 10 voip

 destination-pattern 1310555....

 session target dns:$u$.example.com

The following example shows how to create a session target using DNS, with the optional $d$. macro. In this example, the destination pattern has been configured to 13105551111. The optional macro $d$. directs the gateway to use the destination pattern to identify a dial peer in the "example.com" domain.

dial-peer voice 10 voip

 destination-pattern 13105551111

 session target dns:$d$.example.com

The following example shows how to create a session target using DNS, with the optional $e$. macro. In this example, the destination pattern has been configured to 12345. The optional macro $e$. directs the gateway to do the following: reverse the digits in the destination pattern, add periods between the digits, and use this reverse-exploded destination pattern to identify the dial peer in the "example.com" domain.

dial-peer voice 10 voip

 destination-pattern 12345

 session target dns:$e$.example.com

The following example shows how to create a session target using an ENUM match table. It indicates that calls made using dial peer 101 should use the preferential order of rules in enum match table 3:

dial-peer voice 101 voip

 session target enum:3

The following example shows how to create a session target using DHCP:

dial-peer voice 1 voip

session protocol sipv2 

voice-class sip outbound-proxy dhcp

session target dhcp

The following example shows how to create a session target using RAS:

dial-peer voice 11 voip

 destination-pattern 13105551111

 session target ras

The following example shows how to create a session target using settlement:

dial-peer voice 24 voip

 session target settlement:0

The following example shows how to create a session target using IPv6 for a host at 2001:10:10:10:10:10:10:230a:5090:

dial-peer voice 4 voip

destination-pattern 5000110011 

session protocol sipv2 

session target ipv6:[2001:0DB8:10:10:10:10:10:230a]:5090 

codec g711ulaw

The following example shows how to configure Cisco Unified Border Element (UBE) to route a call to the registering end point:

dial-peer voice 4 voip

session target registrar

Related Commands

sessions maximum

To set the maximum number of allowed sessions that can exist on a zone pair, use the sessions maximum command in parameter-map configuration mode. To change the number of allowed sessions, use the no form of this command.

sessions maximum sessions

no sessions maximum

Syntax Description

Command Default

Default value is unlimited.

Command Modes

Parameter-map configuration

Command History

Usage Guidelines

Use the sessions maximum command to limit the number of inspect sessions that match a certain class. Session limiting is activated when this parameter is configured.

This command is available only within an inspect type parameter map and takes effect only when the parameter map is associated with an inspect action in a policy.

If the sessions maximum command is configured, the number of established sessions on the router can be shown via the show policy-map type inspect zone-pair command.

Examples

The following example shows how to limit the maximum number of allowed sessions to 200 and how verify the number of established sessions:

parameter map type inspect abc

 sessions maximum 200 

Router# show policy-map type inspect zone-pair

 Zone-pair: zp

  Service-policy inspect : test-udp

    Class-map: check-udp (match-all)

      Match: protocol udp

      Inspect

        Packet inspection statistics [process switch:fast switch]

        udp packets: [3:4454]

        Session creations since subsystem startup or last reset 92

        Current session counts (estab/half-open/terminating) [5:33:0]<---

        Maxever session counts (estab/half-open/terminating) [5:59:0]

        Last session created 00:00:06

        Last statistic reset never

        Last session creation rate 61

        Last half-open session total 33

      Police 

      rate 8000 bps,1000 limit 

      conformed 2327 packets, 139620 bytes; actions: transmit

      exceeded 36601 packets, 2196060 bytes; actions: drop

      conformed 6000 bps, exceed 61000 bps

    Class-map: class-default (match-any)

      Match: any 

      Drop (default action)

        0 packets, 0 bytes

Related Commands

set aggressive-mode client-endpoint

To specify the Tunnel-Client-Endpoint attribute within an Internet Security Association Key Management Protocol (ISAKMP) peer configuration, use the set aggressive-mode client-endpoint command in ISAKMP policy configuration mode. To remove this attribute from your configuration, use the no form of this command.

set aggressive-mode client-endpoint client-endpoint

no set aggressive-mode client-endpoint client-endpoint

Syntax Description

Command Default

The Tunnel-Client-Endpoint attribute is not defined.

Command Modes

ISAKMP policy configuration

Command History

Usage Guidelines

Before you can use this command, you must enable the crypto isakmp peer command.

To initiate an IKE aggressive mode negotiation and specify the RADIUS Tunnel-Client-Endpoint attribute, the set aggressive-mode client-endpoint command, along with the set aggressive-mode password command, must be configured in the ISAKMP peer policy. The Tunnel-Client-Endpoint attribute will be communicated to the server by encoding it in the appropriate IKE identity payload.

Examples

The following example shows how to initiate aggressive mode using RADIUS tunnel attributes:

crypto isakmp peer address 10.4.4.1

 set aggressive-mode client-endpoint user-fqdn user@cisco.com

 set aggressive-mode password cisco123

Related Commands

set default interface

To indicate where to output packets that pass a match clause of a route map for policy routing and have no explicit route to the destination, use the set default interface command in route-map configuration mode. To delete an entry, use the no form of this command.

set default interface type number [...type number]

no set default interface type number [...type number]

Syntax Description

Command Default

This command is disabled by default.

Command Modes

Route-map configuration

Command History

Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the type and number arguments.

Use this command to provide certain users a different default route. If the Cisco IOS software has no explicit route for the destination, then it routes the packet to this interface. The first interface specified with the set default interface command that is up is used. The optionally specified interfaces are tried in turn.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which policy routing occurs. The set commands specify the set actions—the particular routing actions to perform if the criteria enforced by the match commands are met.

In PBR for IPv6, use the ipv6 policy route-map or ipv6 local policy route-map command with match and set route map configuration commands to define conditions for policy routing packets.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

Examples

In the following example, packets that have a Level 3 length of 3 to 50 bytes and for which the software has no explicit route to the destination are output to Ethernet interface 0:

interface serial 0

 ip policy route-map brighton

!

route-map brighton

 match length 3 50

 set default interface ethernet 0

Related Commands

set dscp

To mark a packet by setting the differentiated services code point (DSCP) value in the type of service (ToS) byte, use the set dscp command in QoS policy-map class configuration mode. To remove a previously set DSCP value, use the no form of this command.

set dscp {dscp-value | from-field [table table-map-name]}

no set dscp {dscp-value | from-field [table table-map-name]}

Syntax Description

Command Default

The DSCP value in the ToS byte is not set.

Command Modes

QoS policy-map class configuration (config-pmap-c)

Command History

Usage Guidelines

Once the DSCP bit is set, other quality of service (QoS) features can then operate on the bit settings.

DSCP and Precedence Values Are Mutually Exclusive

The set dscp command cannot be used with the set precedence command to mark the same packet. The two values, DSCP and precedence, are mutually exclusive. A packet can have one value or the other, but not both.

Precedence Value and Queueing

The network gives priority (or some type of expedited handling) to marked traffic. Typically, you set the precedence value at the edge of the network (or administrative domain); data then is queued according to the precedence. Weighted fair queueing (WFQ) can speed up handling for high-precedence traffic at congestion points. Weighted Random Early Detection (WRED) ensures that high-precedence traffic has lower loss rates than other traffic during times of congestion.

Use of the "from-field" Packet-marking Category

If you are using this command as part of the Enhanced Packet Marking feature, it can specify the "from-field" packet-marking category to be used for mapping and setting the DSCP value. The "from-field" packet-marking categories are as follows:

•Class of service (CoS)

•QoS group

If you specify a "from-field" category but do not specify the table keyword and the applicable table-map-name argument, the default action will be to copy the value associated with the "from-field" category as the DSCP value. For instance, if you configure the set dscp cos command, the CoS value will be copied and used as the DSCP value.

Note The CoS field is a three-bit field, and the DSCP field is a six-bit field. If you configure the set dscp cos command, only the three bits of the CoS field will be used.

If you configure the set dscp qos-group command, the QoS group value will be copied and used as the DSCP value.

The valid value range for the DSCP is a number from 0 to 63. The valid value range for the QoS group is a number from 0 to 99. Therefore, when configuring the set dscp qos-group command, note the following points:

•If a QoS group value falls within both value ranges (for example, 44), the packet-marking value will be copied and the packets will be marked.

•If QoS group value exceeds the DSCP range (for example, 77), the packet-marking value will not be copied and the packet will not be marked. No action is taken.

Set DSCP Values in IPv6 Environments

When this command is used in IPv6 environments, the default match occurs on both IP and IPv6 packets. However, the actual packets set by this function are only those that meet the match criteria of the class map containing this function.

Set DSCP Values for IPv6 Packets Only

To set DSCP values for IPv6 values only, you must also use the match protocol ipv6 command. Without that command, the precedence match defaults to match both IPv4 and IPv6 packets.

Set DSCP Values for IPv4 Packets Only

To set DSCP values for IPv4 values only, you must use the appropriate match ip command. Without this command, the class map may match both IPv6 and IPv4 packets, depending on the other match criteria, and the DSCP values may act upon both types of packets.

Examples

Packet-marking Values and Table Map

In the following example, the policy map called "policy1" is created to use the packet-marking values defined in a table map called "table-map1". The table map was created earlier with the table-map (value mapping) command. For more information about the table-map (value mapping) command, see the table-map (value mapping) command page.

In this example, the DSCP value will be set according to the CoS value defined in the table map called "table-map1".

Router(config)# policy-map policy1 
Router(config-pmap)# class class-default 
Router(config-pmap-c)# set dscp cos table table-map1

Router(config-pmap-c)# end

The set dscp command is applied when you create a service policy in QoS policy-map configuration mode. This service policy is not yet attached to an interface. For information on attaching a service policy to an interface, see the "Modular Quality of Service Command-Line Interface" section of the Cisco IOS Quality of Service Solutions Configuration Guide.

Related Commands

set extcommunity

To set Border Gateway Protocol (BGP) extended community attributes, use the set extcommunity command in route-map configuration mode. To delete the entry, use the no form of this command.

set extcommunity {rt [extended-community-value] [additive] | soo [extended-community-value]}

no set extcommunity

Syntax Description

Command Default

Specifying new route targets with the rt keyword replaces existing route targets by default, unless the additive keyword is used. The use of the additive keyword adds the new route target to the existing route target list but does not replace any existing route targets.

Command Modes

Route-map configuration (config-route-map)

Command History

Usage Guidelines

Extended community attributes are used to configure, filter, and identify routes for virtual routing and forwarding instances (VRFs) and Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs).

The set extcommunity command is used to configure set clauses that use extended community attributes in route maps. All of the standard rules of match and set clauses apply to the configuration of extended community attributes.

The route target (RT) extended community attribute is configured with the rt keyword. This attribute is used to identify a set of sites and VRFs that may receive routes that are tagged with the configured route target. Configuring the route target extended attribute with a route allows that route to be placed in the per-site forwarding tables that are used for routing traffic that is received from corresponding sites.

The site of origin (SOO) extended community attribute is configured with the soo keyword. This attribute uniquely identifies the site from which the Provider Edge (PE) router learned the route. All routes learned from a particular site must be assigned the same SOO extended community attribute, whether a site is connected to a single PE router or multiple PE routers. Configuring this attribute prevents routing loops from occurring when a site is multihomed. The SOO extended community attribute is configured on the interface and is propagated into BGP through redistribution. The SOO can be applied to routes that are learned from VRFs. The SOO should not be configured for stub sites or sites that are not multihomed.

In Cisco IOS Release 12.0(32)SY8, 12.0(33)S3, 12.2(33)SRE, 12.2(33)XNE, 12.2(33)SXI1, Cisco IOS XE Release 2.4, and later releases, the Cisco implementation of 4-byte autonomous system numbers uses asplain—65538 for example—as the default regular expression match and output display format for autonomous system numbers, but you can configure 4-byte autonomous system numbers in both the asplain format and the asdot format as described in RFC 5396. To change the default regular expression match and output display of 4-byte autonomous system numbers to asdot format, use the bgp asnotation dot command followed by the clear ip bgp * command to perform a hard reset of all current BGP sessions.

In Cisco IOS Release 12.0(32)S12, 12.4(24)T, and Cisco IOS XE Release 2.3, the Cisco implementation of 4-byte autonomous system numbers uses asdot—1.2 for example—as the only configuration format, regular expression match, and output display, with no asplain support.

Examples

The following example sets the route target to extended community attribute 100:2 for routes that are permitted by the route map:

Router(config)# access-list 2 permit 192.168.78.0 255.255.255.0

Router(config)# route-map MAP_NAME permit 10

Router(config-route-map)# match ip-address 2

Router(config-route-map)# set extcommunity rt 100:2

The following example sets the route target to extended community attribute 100:3 for routes that are permitted by the route map. The use of the additive keyword adds route target 100:3 to the existing route target list but does not replace any existing route targets.

Router(config)# access-list 3 permit 192.168.79.0 255.255.255.0

Router(config)# route-map MAP_NAME permit 10

Router(config-route-map)# match ip-address 3

Router(config-route-map)# set extcommunity rt 100:3 additive

Note Configuring route targets with the set extcommunity command will replace existing route targets, unless the additive keyword is used.

The following example sets the site of origin to extended community attribute 100:4 for routes that are permitted by the route map:

Router(config)# access-list 4 permit 192.168.80.0 255.255.255.0

Router(config)# route-map MAP_NAME permit 10

Router(config-route-map)# match ip-address 4

Router(config-route-map)# set extcommunity soo 100:4

In IPv6, the following example sets the SoO to extended community attribute 100:28 for routes that are permitted by the route map:

(config)# router bgp 100

(config-router)# address-family ipv6 vrf red

(config-router-af)# neighbor 8008::72a route-map setsoo in

(config-router-af)# exit

(config-router)# route-map setsoo permit 10

(config-router)# set extcommnunity soo 100:28

The following example available in Cisco IOS Release 12.0(32)SY8, 12.0(33)S3, 12.2(33)SRE, 12.2(33)XNE, 12.2(33)SXI1, Cisco IOS XE Release 2.4, and later releases, shows how to create a VRF with a route-target that uses a 4-byte autonomous system number, 65537 in asplain format, and how to set the route-target to extended community value 65537:100 for routes that are permitted by the route map.

Router(config)# ip vrf vpn_red

Router(config-vrf)# rd 64500:100

Router(config-vrf)# route-target both 65537:100

Router(config-vrf)# exit

Router(config)# route-map rt_map permit 10

Router(config-route-map)# set extcommunity rt 65537:100

Router(config-route-map)# end

The following example available in Cisco IOS Release 12.0(32)SY8, 12.0(32)S12, 12.2(33)SRE, 12.2(33)XNE, 12.2(33)SXI1, 12.4(24)T, Cisco IOS XE Release 2.3, and later releases, shows how to create a VRF with a route-target that uses a 4-byte autonomous system number, 1.1 in asdot format, and how to set the SoO to extended community attribute 1.1:100 for routes that are permitted by the route map.

Router(config)# ip vrf vpn_red

Router(config-vrf)# rd 64500:100

Router(config-vrf)# route-target both 1.1:100

Router(config-vrf)# exit

Router(config)# route-map soo_map permit 10

Router(config-route-map)# set extcommunity soo 1.1:100

Router(config-route-map)# end

Related Commands

set interface

To indicate where to forward packets that pass a match clause of a route map for policy routing, use the set interface command in route-map configuration mode. To delete an entry, use the no form of this command.

set interface type number [...type number]

no set interface type number [...type number]

Syntax Description

Command Default

Packets that pass a match clause are not forwarded to an interface.

Command Modes

Route-map configuration (config-route-map)

Command History

Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the type and number arguments.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands to define the conditions for policy-routing packets. The ip policy route-map command identifies a route map by name. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which policy routing occurs. The set commands specify the set actions—the particular routing actions to perform if the criteria enforced by the match commands are met.

In PBR for IPv6, use the ipv6 policy route-map or ipv6 local policy route-map command with match and set route-map configuration commands to define conditions for policy-routing packets.

If the first interface specified with the set interface command is down, the optionally specified interfaces are tried in turn.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

A useful next hop implies an interface. As soon as a next hop and an interface are found, the packet is routed.

Specifying the set interface null 0 command is a way to write a policy that the packet be dropped and an "unreachable" message be generated. In Cisco IOS Release 12.4(15)T and later releases, the packets are dropped; however, the "unreachable" messages are generated only when CEF is disabled.

In Cisco IOS Release 12.2(33)SRB and later releases, hardware switching support was introduced for PBR packets sent over a traffic engineering (TE) tunnel interface on a Cisco 7600 series router. When a TE tunnel interface is configured using the set interface command in a policy, the packets are processed in hardware. In previous releases, PBR packets sent over TE tunnels are fast switched by Route Processor software.

Examples

In the following example, packets with a Level 3 length of 3 to 50 bytes are forwarded to Ethernet interface 0:

interface serial 0

 ip policy route-map testing

!

route-map testing

 match length 3 50

 set interface ethernet 0

In the following example for IPv6, packets with a Level 3 length of 3 to 50 bytes are forwarded to Ethernet interface 0:

interface serial 0

 ipv6 policy route-map testing

!

route-map testing

 match length 3 50

 set interface ethernet 0

In the following example, a TE tunnel interface is configured on a Cisco 7600 series router using the set interface command in a policy, and the packets are processed in hardware, instead of being fast switched by Route Processor software. This example can be used only with a Cisco IOS Release 12.2(33)SRB, or later release, image.

interface Tunnel101 

 description FRR-Primary-Tunnel 

 ip unnumbered Loopback0 

 tunnel destination 172.17.2.2 

 tunnel mode mpls traffic-eng 

 tunnel mpls traffic-eng autoroute announce 

 tunnel mpls traffic-eng path-option 1 explicit name p1 

!

access-list 101 permit ip 10.100.0.0 0.255.255.255 any

! 

route-map test permit 10 

 match ip address 101 

 set interface Tunnel101 

!

interface GigabitEthernet9/5 

 description TO_CE_C1A_FastEther-5/5 

 ip address 192.168.5.1 255.255.255.0 

 ip policy route-map test 

 no keepalive

Related Commands

set ip next-hop

To indicate where to output packets that pass a match clause of a route map for policy routing, use the set ip next-hop command in route-map configuration mode. To delete an entry, use the no form of this command.

set ip next-hop {ip-address [...ip-address] | dynamic dhcp | encapsulate l3vpn profile name | peer-address | recursive [global | vrf vrf name] ip-address | verify-availability [ip-address sequence track track object number}

no set ip next-hop ip-address [...ip-address]

Syntax Description

Command Default

Packets are forwarded to the next hop router in the routing table.

Command Modes

Route-map configuration (config-route-map)

Command History

Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the ip-address argument.

Use the ip policy route-map interface configuration command, the route-map global configuration command, and the match and set route-map configuration commands to define the conditions for policy routing packets. The ip policy route-map command identifies a route map by name. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which policy routing occurs. The set commands specify the set actions—the particular routing actions to perform if the criteria enforced by the match commands are met.

If the interface associated with the first next hop specified with the set ip next-hop command is down, the optionally specified IP addresses are tried in turn.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ip next-hop

2. set interface

3. set ip default next-hop

4. set default interface

Note The set ip next-hop and set ip default next-hop are similar commands but have a different order of operations. Configuring the set ip next-hop command causes the system to use policy routing first and then use the routing table. Configuring the set ip default next-hop command causes the system to use the routing table first and then policy route the specified next hop.

Examples

In the following example, packets with a Level 3 length of 3 to 50 bytes are output to the router at IP address 10.14.2.2:

interface serial 0

 ip policy route-map thataway

!

route-map thataway

 match length 3 50

 set ip next-hop 10.14.2.2

In the following example, the IP address of 10.3.3.3 is set as the recursive next-hop address:

route-map map_recurse

 set ip next-hop recursive 10.3.3.3

Related Commands

set ipv6 default next-hop

To specify an IPv6 default next hop to which matching packets will be forwarded, use the set ipv6 default next-hop command in route-map configuration mode. To delete the default next hop, use the no form of this command.

set ipv6 default next-hop global-ipv6-address [global-ipv6-address...]

no set ipv6 default next-hop global-ipv6-address [global-ipv6-address...]

Syntax Description

Command Default

This command is disabled by default.

Command Modes

Route-map configuration

Command History

Usage Guidelines

An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the global-ipv6-address argument.

Use the set ipv6 default next-hop command in policy-based routing PBR for IPv6 to specify an IPv6 next-hop address to which a packet will be policy routed when the router has no route in the IPv6 routing table or the packets match the default route. The IPv6 next-hop address must be adjacent to the router; that is, reachable by using a directly connected IPv6 route in the IPv6 routing table. The IPv6 next-hop address also must be a global IPv6 address. An IPv6 link-local address cannot be used because use of an IPv6 link-local address requires interface context.

If the software has no explicit route for the destination in the packet, then it routes the packet to the next hop as specified by the set ipv6 default next-hop command. The optional specified IPv6 addresses are tried in turn.

Use the ipv6 policy route-map command, the route-map command, and the match and set route-map commands to define the conditions for PBR packets. The ipv6 policy route-map command identifies a route map by name. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria, which are the conditions under which PBR occurs. The set commands specify the set actions, which are the particular routing actions to perform if the criteria enforced by the match commands are met.

The set clauses can be used in conjunction with one another. They are evaluated in the following order:

1. set ipv6 next-hop

2. set interface