Chapter 1. IP Addressing Services Overview

This section provides information about IP Addressing Services.

- Understanding IPv6

- IPv6 Addresses

- 128-Bit Wide Unicast Addresses

- DNS for IPv6

- IPv6 Stateless Autoconfiguration and Duplicate Address Detection

- IPv6 Applications

- DHCP for IPv6 Address Assignment

- HTTP(S) Over IPv6

Understanding IPv6

IPv4 users can move to IPv6 and receive services such as end-to-end security, quality of service (QoS), and globally unique addresses. The IPv6 address space reduces the need for private addresses and Network Address Translation (NAT) processing by border routers at network edges.

For information about how Cisco Systems implements IPv6, go to:

http://www.cisco.com/en/US/products/ps6553/products_ios_technology_home.html

For information about IPv6 and other features in this chapter

- See the Cisco IOS IPv6 Configuration Library.

- Use the Search field on Cisco.com to locate the Cisco IOS software documentation. For example, if you want information about static routes, you can enter Implementing Static Routes for IPv6 in the search field to learn about static routes.

IPv6 Addresses

The switch supports only IPv6 unicast addresses. It does not support site-local unicast addresses, or anycast addresses.

The IPv6 128-bit addresses are represented as a series of eight 16-bit hexadecimal fields separated by colons in the format: n:n:n:n:n:n:n:n. This is an example of an IPv6 address:

2031:0000:130F:0000:0000:09C0:080F:130B

For easier implementation, leading zeros in each field are optional. This is the same address without leading zeros:

2031:0:130F:0:0:9C0:80F:130B

You can also use two colons (::) to represent successive hexadecimal fields of zeros, but you can use this short version only once in each address:

2031:0:130F::09C0:080F:130B

For more information about IPv6 address formats, address types, and the IPv6 packet header, see the http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_basic/configuration/xe-3e/ip6b-xe-3e-book.html of Cisco IOS IPv6 Configuration Library on Cisco.com.

- IPv6 Address Formats

- IPv6 Address Type: Multicast

- IPv6 Address Output Display

- Simplified IPv6 Packet Header

128-Bit Wide Unicast Addresses

The switch supports aggregatable global unicast addresses and link-local unicast addresses. It does not support site-local unicast addresses.

- Aggregatable global unicast addresses are IPv6 addresses from the aggregatable global unicast prefix. The address structure enables strict aggregation of routing prefixes and limits the number of routing table entries in the global routing table. These addresses are used on links that are aggregated through organizations and eventually to the Internet service provider.

These addresses are defined by a global routing prefix, a subnet ID, and an interface ID. Current global unicast address allocation uses the range of addresses that start with binary value 001 (2000::/3). Addresses with a prefix of 2000::/3(001) through E000::/3(111) must have 64-bit interface identifiers in the extended unique identifier (EUI)-64 format.

- Link local unicast addresses can be automatically configured on any interface by using the link-local prefix FE80::/10(1111 1110 10) and the interface identifier in the modified EUI format. Link-local addresses are used in the neighbor discovery protocol (NDP) and the stateless autoconfiguration process. Nodes on a local link use link-local addresses and do not require globally unique addresses to communicate. IPv6 routers do not forward packets with link-local source or destination addresses to other links.

For more information, see the section about IPv6 unicast addresses in the “Implementing IPv6 Addressing and Basic Connectivity” chapter in the Cisco IOS IPv6 Configuration Library on Cisco.com.

DNS for IPv6

IPv6 supports Domain Name System (DNS) record types in the DNS name-to-address and address-to-name lookup processes. The DNS AAAA resource record types support IPv6 addresses and are equivalent to an A address record in IPv4. The switch supports DNS resolution for IPv4 and IPv6.

IPv6 Stateless Autoconfiguration and Duplicate Address Detection

The switch uses stateless autoconfiguration to manage link, subnet, and site addressing changes, such as management of host and mobile IP addresses. A host autonomously configures its own link-local address, and booting nodes send router solicitations to request router advertisements for configuring interfaces.

Beginning from Cisco IOS XE Gibraltar 16.11.1, an autoconfigured IPv6 address will contain interface identifiers that are not part of the reserved interface identifiers range specified in RFC5453.

For more information about autoconfiguration and duplicate address detection, see the “Implementing IPv6 Addressing and Basic Connectivity” chapter of Cisco IOS IPv6 Configuration Library on Cisco.com.

IPv6 Applications

The switch has IPv6 support for these applications:

- Ping, traceroute, Telnet, and TFTP

- FTP

- Secure Shell (SSH) over an IPv6 transport

- HTTP server access over IPv6 transport

- DNS resolver for AAAA over IPv4 transport

- Cisco Discovery Protocol (CDP) support for IPv6 addresses

For more information about managing these applications, see the Cisco IOS IPv6 Configuration Library on Cisco.com.

DHCP for IPv6 Address Assignment

DHCPv6 enables DHCP servers to pass configuration parameters, such as IPv6 network addresses, to IPv6 clients. The address assignment feature manages non-duplicate address assignment in the correct prefix based on the network where the host is connected. Assigned addresses can be from one or multiple prefix pools. Additional options, such as default domain and DNS name-server address, can be passed back to the client. Address pools can be assigned for use on a specific interface, on multiple interfaces, or the server can automatically find the appropriate pool.

For configuring DHCP for IPv6, see the Configuring DHCP for IPv6 Address Assignment section.

For more information about configuring the DHCPv6 client, server, or relay agent functions, see the Cisco IOS IPv6 Configuration Library on Cisco.com.

HTTP(S) Over IPv6

The HTTP client sends requests to both IPv4 and IPv6 HTTP servers, which respond to requests from both IPv4 and IPv6 HTTP clients. URLs with literal IPv6 addresses must be specified in hexadecimal using 16-bit values between colons.

The accept socket call chooses an IPv4 or IPv6 address family. The accept socket is either an IPv4 or IPv6 socket. The listening socket continues to listen for both IPv4 and IPv6 signals that indicate a connection. The IPv6 listening socket is bound to an IPv6 wildcard address.

The underlying TCP/IP stack supports a dual-stack environment. HTTP relies on the TCP/IP stack and the sockets for processing network-layer interactions.

Basic network connectivity (ping ) must exist between the client and the server hosts before HTTP connections can be made.

For more information, see the “Managing Cisco IOS Applications over IPv6” chapter in the Cisco IOS IPv6 Configuration Library on Cisco.com.

Chapter 2. IPv6 Client IP Address Learning

- Prerequisites for IPv6 Client Address Learning

- Information About IPv6 Client Address Learning

- How to Configure IPv6 Client Address Learning

- Verifying IPv6 Address Learning Configuration

- Additional References

- Feature History for IPv6 Client Address Learning

Prerequisites for IPv6 Client Address Learning

Before configuring IPv6 client address learning, configure the clients to support IPv6.

Information About IPv6 Client Address Learning

Client Address Learning is configured on device to learn the client's IPv4 and IPv6 address and clients transition state maintained by the device on an association, re-association, de-authentication and timeout.

There are three ways for IPv6 client to acquire IPv6 addresses:

- Stateless Address Auto-Configuration (SLACC)

- Stateful DHCPv6

- Static Configuration

For all of these methods, the IPv6 client always sends neighbor solicitation DAD (Duplicate Address Detection) request to ensure there is no duplicate IP address on the network. The device snoops the client's Neighbor Discovery Protocol (NDP) and DHCPv6 packets to learn about its client IP addresses.

When a duplicate IPv6 address is configured, DAD detects the duplicate address, and advertises it in the Router Advertisement (RA). The duplicate address can be manually removed from the system, so that it is not displayed in the connected address and not advertised in the RA prefix.

- SLAAC Address Assignment

- Stateful DHCPv6 Address Assignment

- Static IP Address Assignment

- Router Solicitation

- Router Advertisement

- Neighbor Discovery

- Neighbor Discovery Suppression

- RA Guard

SLAAC Address Assignment

The most common method for IPv6 client address assignment is Stateless Address Auto-Configuration (SLAAC). SLAAC provides simple plug-and-play connectivity where clients self-assign an address based on the IPv6 prefix. This process is achieved

Stateless Address Auto-Configuration (SLAAC) is configured as follows:

- Host sends a router solicitation message.

- Hosts waits for a Router Advertisement message.

- Hosts take the first 64 bits of the IPv6 prefix from the Router Advertisement message and combines it with the 64 bit EUI-64 address (in the case of ethernet, this is created from the MAC Address) to create a global unicast message. The host also uses the source IP address, in the IP header, of the Router Advertisement message, as its default gateway.

- Duplicate Address Detection is performed by IPv6 clients in order to ensure that random addresses that are picked do not collide with other clients.

- The choice of algorithm is up to the client and is often configurable.

The last 64 bits of the IP v6 address can be learned based on the following 2 algorithms:

- EUI-64 which is based on the MAC address of the interface, or

- Private addresses that are randomly generated.

SLAAC Address Assignment

The following Cisco IOS configuration commands from a Cisco-capable IPv6 router are used to enable SLAAC addressing and router advertisements:

ipv6 unicast-routing
interface Vlan20
description IPv6-SLAAC
ip address 192.168.20.1 255.255.255.0
ipv6 address FE80:DB8:0:20::1 linklocal
ipv6 address 2001:DB8:0:20::1/64
ipv6 enable
end

Stateful DHCPv6 Address Assignment

Stateful DHCPv6 Address Assignment

The use of DHCPv6 is not required for IPv6 client connectivity if SLAAC is already deployed. There are two modes of operation for DHCPv6 called Stateless and Stateful.

The DHCPv6 Stateless mode is used to provide clients with additional network information that is not available in the router advertisement, but not an IPv6 address as this is already provided by SLAAC. This information can include the DNS domain name, DNS server(s), and other DHCP vendor-specific options. This interface configuration is for a Cisco IOS IPv6 router implementing stateless DHCPv6 with SLAAC enabled:

ipv6 unicast-routing
ipv6 dhcp pool IPV6_DHCPPOOL
address prefix 2001:db8:5:10::/64
domain-name cisco.com
dns-server 2001:db8:6:6::1
interface Vlan20
description IPv6-DHCP-Stateless
ip address 192.168.20.1 255.255.255.0
ipv6 nd other-config-flag
ipv6 dhcp server IPV6_DHCPPOOL
ipv6 address 2001:DB8:0:20::1/64
end

The DHCPv6 Stateful option, also known as managed mode, operates similarly to DHCPv4 in that it assigns unique addresses to each client instead of the client generating the last 64 bits of the address as in SLAAC. This interface configuration is for a Cisco IOS IPv6 router implementing stateful DHCPv6 on a local device:

ipv6 unicast-routing
ipv6 dhcp pool IPV6_DHCPPOOL
address prefix 2001:db8:5:10::/64
domain-name cisco.com
dns-server 2001:db8:6:6::1
interface Vlan20
description IPv6-DHCP-Stateful
ip address 192.168.20.1 255.255.255.0
ipv6 address 2001:DB8:0:20::1/64
ipv6 nd prefix 2001:DB8:0:20::/64 no-advertise
ipv6 nd managed-config-flag
ipv6 nd other-config-flag
ipv6 dhcp server IPV6_DHCPPOOL
end

This interface configuration is for a Cisco IOS IPv6 router implementing stateful DHCPv6 on an external DHCP server:

ipv6 unicast-routing
domain-name cisco.com
dns-server 2001:db8:6:6::1
interface Vlan20
description IPv6-DHCP-Stateful
ip address 192.168.20.1 255.255.255.0
ipv6 address 2001:DB8:0:20::1/64
ipv6 nd prefix 2001:DB8:0:20::/64 no-advertise
ipv6 nd managed-config-flag
ipv6 nd other-config-flag
ipv6 dhcp relay destination 2001:DB8:0:20::2
end

Static IP Address Assignment

Statically configured address on a client.

Router Solicitation

A Router Solicitation message is issued by a host to facilitate local routers to transmit Router Advertisement from which it can obtain information about local routing or perform Stateless Auto-configuration. Router Advertisements are transmitted periodically and the host prompts with an immediate Router Advertisement using a Router Solicitation such as - when it boots or following a restart operation.

Router Advertisement

A Router Advertisement message is issued periodically by a router or in response to a Router Solicitation message from a host. The information contained in these messages is used by hosts to perform Stateless Auto-configuration and to modify its routing table.

Neighbor Discovery

IPv6 Neighbor Discovery is a set of messages and processes that determine relationships between neighboring nodes. Neighbor Discovery replaces ARP, ICMP Router Discovery, and ICMP Redirect used in IPv4.

IPv6 Neighbor Discovery inspection analyzes neighbor discovery messages in order to build a trusted binding table database, and IPv6 neighbor discovery packets that do not comply are dropped. The neighbor binding table in the switch tracks each IPv6 address and its associated MAC address. Clients are expired from the table according to Neighbor Binding timers.

Neighbor Discovery Suppression

The IPv6 addresses of clients are cached by the device. When the device receives an NS multicast looking for an IPv6 address, and if the target address is known to the device and belongs to one of its clients, the device will reply with an NA message on behalf of the client. The result of this process generates the equivalent of the Address Resolution Protocol (ARP) table of IPv4 but is more efficient - uses generally fewer messages.

Note

The device acts like proxy and respond with NA, only when the ipv6 nd suppress command is configured

If the device does not have the IPv6 address of a client, the device will not respond with NA and forward the NS packet . To resolve this, an NS Multicast Forwarding knob is provided. If this knob is enabled, the device gets the NS packet for the IPv6 address that it does not have (cache miss) and forwards it . This packet reaches the intended client and the client replies with NA.

This cache miss scenario occurs rarely, and only very few clients which do not implement complete IPv6 stack may not advertise their IPv6 address during NDP.

RA Guard

IPv6 clients configure IPv6 addresses and populate their router tables based on IPv6 router advertisement (RA) packets. The RA guard feature is similar to the RA guard feature of wired networks. RA guard increases the security of the IPv6 network by dropping the unwanted or rogue RA packets that come from clients. If this feature is not configured, malicious IPv6 clients announce themselves as the router for the network often with high priority, which would take higher precedence over legitimate IPv6 routers.

RA-Guard also examines the incoming RA's and decides whether to switch or block them based solely on information found in the message or in the switch configuration. The information available in the frames received is useful for RA validation:

- Port on which the frame is received

- IPv6 source address

- Prefix list

The following configuration information created on the switch is available to RA-Guard to validate against the information found in the received RA frame:

- Trusted/Untrusted ports for receiving RA-guard messages

- Trusted/Untrusted IPv6 source addresses of RA-sender

- Trusted/Untrusted Prefix list and Prefix ranges

- Router Preference

RA guard is applied on the device. You can configure the device to drop RA messages on the device. All IPv6 RA messages are dropped, which protects other clients and upstream wired network from malicious IPv6 clients.

//Create a policy for RA Guard//
ipv6 nd raguard policy raguard-router
trusted-port
device-role router

//Applying the RA Guard Policy on port/interface//
interface tengigabitethernet1/0/1 (Katana)
interface gigabitethernet1/0/1 (Edison)

ipv6 nd raguard attach-policy raguard-router

How to Configure IPv6 Client Address Learning

The following sections provide configuration information about IPv6 client address learning.

- Configuring IPv6 Unicast

- Configuring RA Guard Policy

- Applying RA Guard Policy

- Configuring IPv6 Snooping

- Configuring IPv6 ND Suppress Policy

- Configuring IPv6 Snooping on VLAN/PortChannel

- Configuring IPv6 on Switch Interface

- Configuring DHCP Pool on Switch Interface

- Configuring Stateless Auto Address Configuration Without DHCP

- Configuring Stateless Auto Address Configuration With DHCP

- Configuring Stateful DHCP Locally

- Configuring Stateful DHCP Externally

Configuring IPv6 Unicast

IPv6 unicasting must always be enabled on the switch. IPv6 unicast routing is disabled.

To configure IPv6 unicast, perform this procedure:

Before you begin

To enable the forwarding of IPv6 unicast datagrams, use the ipv6 unicast-routing command in global configuration mode. To disable the forwarding of IPv6 unicast datagrams, use the no form of this command.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 unicast routing

Example:

Device(config)# ipv6 unicast routing

enable the forwarding of IPv6 unicast datagrams

Configuring RA Guard Policy

Configure RA Guard policy on the device to add IPv6 client addresses and populate the router table based on IPv6 router advertisement packets.

To configuring RA guard policy, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 nd raguard policy raguard-router

Example:

Device(config)# ipv6 nd raguard policy raguard-router

Defines the RA guard policy name and enters RA guard policy configuration mode.

Step 4

trustedport

Example:

Device(config-ra-guard)# trustedport

(Optional) Specifies that this policy is being applied to trusted ports.

Step 5

device-role router

Example:

Device(config-ra-guard)# device-role router

Specifies the role of the device attached to the port.

Step 6

exit

Example:

Device(config-ra-guard)# exit

Exits RA guard policy configuration mode and returns to global configuration mode.

Applying RA Guard Policy

Applying the RA Guard policy on the device will block all the untrusted RA's.

To apply RA guard policy, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface tengigabitethernet 1/0/1

Example:

Device(config)# interface tengigabitethernet 1/0/1

Specifies an interface type and number, and places the device in interface configuration mode.

Step 4

ipv6 nd raguard attach-policy raguard-router

Example:

Device(config-if)# ipv6 nd raguard attach-policy raguard-router

Applies the IPv6 RA Guard feature to a specified interface.

Step 5

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Configuring IPv6 Snooping

Note

We recommend that you configure SISF-based device tracking configurations instead of IPv6 snooping legacy configuration. For more information, refer to the Configuring SISF-Based Device Tracking section in the Security Configuration Guide.

IPv6 snooping must always be enabled on the device.

To configuring IPv6 snooping, perform this procedure:

Before you begin

Enable IPv6 on the client machine.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

vlan configuration 1

Example:

Device(config)# vlan configuration 1

Enters VLAN configuration mode.

Step 4

ipv6 snooping

Example:

Device(config-vlan)# ipv6 snooping

Enables IPv6 snooping on the VLAN.

Step 5

ipv6 nd suppress

Example:

Device(config-vlan-config)# ipv6 nd suppress

Enables the IPv6 ND suppress on the VLAN.

Step 6

exit

Example:

Device(config-vlan-config)# exit

Saves the configuration and comes out of the VLAN configuration mode.

Configuring IPv6 ND Suppress Policy

The IPv6 neighbor discovery (ND) multicast suppress feature stops as many ND multicast neighbor solicit (NS) messages as possible by dropping them (and responding to solicitations on behalf of the targets) or converting them into unicast traffic. This feature runs on a layer 2 switch and is used to reduce the amount of control traffic necessary for proper link operations.

When an address is inserted into the binding table, an address resolution request sent to a multicast address is intercepted, and the device either responds on behalf of the address owner or, at layer 2, converts the request into a unicast message and forwards it to its destination.

To configure IPv6 ND suppress policy, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 nd suppress policy policy_name

Example:

Device(config)# ipv6 nd suppress policy policy1

Defines the ND suppress policy name and enters ND suppress policy configuration mode.

Configuring IPv6 Snooping on VLAN/PortChannel

Neighbor Discover (ND) suppress can be enabled or disabled on either the VLAN or a switchport.

To configure IPv6 snooping on VLAN/PortChannel, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

vlan config901

Example:

Device(config)# vlan config901

Creates a VLAN and enter the VLAN configuration mode

Step 4

ipv6 nd suppress

Example:

Device(config-vlan)# ipv6 nd suppress

Applies the IPv6 nd suppress on VLAN.

Step 5

end

Example:

Device(config-vlan)# end

Exits vlan configuration mode and enters the global configuration mode.

Step 6

interface gi1/0/1

Example:

Device(config)# interface gi1/0/1

Creates a gigabitethernet port interface.

Step 7

ipv6 nd suppress

Example:

Device(config-vlan)# ipv6 nd suppress

Applies the IPv6 nd suppress on the interface.

Step 8

end

Example:

Device(config-vlan)# end

Exits vlan configuration mode and enters the global configuration mode.

Configuring IPv6 on Switch Interface

Follow the procedure given below to configure IPv6 on an interface:

Before you begin

Enable IPv6 on the client and IPv6 support on the wired infrastructure.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface vlan 1

Example:

Device(config)# interface vlan 1

Creates a interface and enters interface configuration mode.

Step 4

ip address fe80::1 link-local

Example:

Device(config-if)# ip address 198.51.100.1 255.255.255.0
Device(config-if)# ipv6 address fe80::1 link-local
Device(config-if)# ipv6 address 2001:DB8:0:1:FFFF:1234::5/64
Device(config-if)# ipv6 address 2001:DB8:0:0:E000::F/64

Configures IPv6 address on the interface using the link-local option.

Step 5

ipv6 enable

Example:

Device(config)# ipv6 enable

(Optional) Enables IPv6 on the interface.

Step 6

end

Example:

Device(config)# end

Exits from the interface mode.

Configuring DHCP Pool on Switch Interface

Follow the procedure given below to configure DHCP Pool on an interface:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 dhcp pool Vlan21

Example:

Device(config)# ipv6 dhcp pool vlan1

Enters the configuration mode and configures the IPv6 DHCP pool on the Vlan.

Step 4

address prefix 2001:DB8:0:1:FFFF:1234::/64 lifetime 300 10

Example:

Device(config-dhcpv6)# address prefix 2001:DB8:0:1:FFFF:1234::/64 lifetime 300 10

Enters the configuration-dhcp mode and configures the address pool and its lifetime on a Vlan.

Step 5

dns-server 2001:100:0:1::1

Example:

Device(config-dhcpv6)# dns-server 2001:20:21::1

Configures the DNS servers for the DHCP pool.

Step 6

domain-name example.com

Example:

Device(config-dhcpv6)# domain-name example.com

Configures the domain name to complete unqualified host names.

Step 7

end

Example:

Device(config)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Stateless Auto Address Configuration Without DHCP

Follow the procedure given below to configure stateless auto address configuration without DHCP:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface vlan 1

Example:

Device(config)# interface vlan 1

Creates a interface and enters interface configuration mode.

Step 4

ip address fe80::1 link-local

Example:

Device(config-if)# ip address 198.51.100.1 255.255.255.0
Device(config-if)# ipv6 address fe80::1 link-local
Device(config-if)# ipv6 address 2001:DB8:0:1:FFFF:1234::5/64
Device(config-if)# ipv6 address 2001:DB8:0:0:E000::F/64

Configures IPv6 address on the interface using the link-local option.

Step 5

ipv6 enable

Example:

Device(config)# ipv6 enable

(Optional) Enables IPv6 on the interface.

Step 6

no ipv6 nd managed-config-flag

Example:

Device(config)# interface vlan 1
Device(config-if)# no ipv6 nd managed-config-flag

Ensures the attached hosts do not use stateful autoconfiguration to obtain addresses.

Step 7

no ipv6 nd other-config-flag

Example:

Device(config-if)# no ipv6 nd other-config-flag

Ensures the attached hosts do not use stateful autoconfiguration to obtain non-address options from DHCP (domain etc).

Step 8

end

Example:

Device(config)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Stateless Auto Address Configuration With DHCP

Follow the procedure given below to configure stateless auto address configuration with DHCP:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface vlan 1

Example:

Device(config)# interface vlan 1

Creates a interface and enters interface configuration mode.

Step 4

ip address fe80::1 link-local

Example:

Device(config-if)# ip address 198.51.100.1 255.255.255.0
Device(config-if)# ipv6 address fe80::1 link-local
Device(config-if)# ipv6 address 2001:DB8:0:1:FFFF:1234::5/64
Device(config-if)# ipv6 address 2001:DB8:0:0:E000::F/64

Configures IPv6 address on the interface using the link-local option.

Step 5

ipv6 enable

Example:

Device(config)# ipv6 enable

(Optional) Enables IPv6 on the interface.

Step 6

no ipv6 nd managed-config-flag

Example:

Device(config)# interface vlan 1
Device(config-if)# no ipv6 nd managed-config-flag

Ensures the attached hosts do not use stateful autoconfiguration to obtain addresses.

Step 7

ipv6 nd other-config-flag

Example:

Device(config-if)# no ipv6 nd other-config-flag

Ensures the attached hosts do not use stateful autoconfiguration to obtain non-address options from DHCP (domain etc).

Step 8

end

Example:

Device(config)# end

Exits from the interface mode.

Configuring Stateful DHCP Locally

This interface configuration is for a Cisco IOS IPv6 router implementing stateful DHCPv6 on a local device.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 unicast-routing

Example:

Device(config)# ipv6 unicast-routing

Configures IPv6 for unicasting.

Step 4

ipv6 dhcp pool IPv6_DHCPPOOL

Example:

Device(config)# ipv6 dhcp pool IPv6_DHCPPOOL

Enters the configuration mode and configures the IPv6 DHCP pool on the VLAN.

Step 5

address prefix 2001:DB8:0:1:FFFF:1234::/64

Example:

Device(config-dhcpv6)# address prefix 2001:DB8:0:1:FFFF:1234::/64

Specifies the address range to provide in the pool.

Step 6

dns-server 2001:100:0:1::1

Example:

Device(config-dhcpv6)# dns-server 2001:100:0:1::1

Provides the DNS server option to DHCP clients.

Step 7

domain-name example.com

Example:

Device(config-dhcpv6)# domain-name example.com

Provides the domain name option to DHCP clients.

Step 8

exit

Example:

Device(config-dhcpv6)# exit

Returns to the previous mode.

Step 9

interface vlan1

Example:

Device(config)# interface vlan 1

Enters the interface mode to configure the stateful DHCP.

Step 10

description IPv6-DHCP-Stateful

Example:

Device(config-if)# description IPv6-DHCP-Stateful

Enter description for the stateful IPv6 DHCP.

Step 11

ipv6 address 2001:DB8:0:20::1/64

Example:

Device(config-if)# ipv6 address 2001:DB8:0:20::1/64

Enters the IPv6 address for the stateful IPv6 DHCP.

Step 12

ip address 192.168.20.1 255.255.255.0

Example:

Device(config-if)# ip address 192.168.20.1 255.255.255.0

Enters the IPv6 address for the stateful IPv6 DHCP.

Step 13

ipv6 nd prefix 2001:db8::/64 no-advertise

Example:

Device(config-if)# ipv6 nd prefix 2001:db8::/64 no-advertise

Configures the IPv6 routing prefix advertisement that must not be advertised.

Step 14

ipv6 nd managed-config-flag

Example:

Device(config-if)# ipv6 nd managed-config-flag

Configures IPv6 interfaces neighbor discovery to allow the hosts to uses DHCP for address configuration.

Step 15

ipv6 nd other-config-flag

Example:

Device(config-if)# ipv6 nd other-config-flag

Configures IPv6 interfaces neighbor discovery to allow the hosts to uses DHCP for non-address configuration.

Step 16

ipv6 dhcp server IPv6_DHCPPOOL

Example:

Device(config-if)# ipv6 dhcp server IPv6_DHCPPOOL

Configures the DHCP server on the interface.

Configuring Stateful DHCP Externally

This interface configuration is for a Cisco IOS IPv6 router implementing stateful DHCPv6 on an external DHCP server.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 unicast-routing

Example:

Device(config)# ipv6 unicast-routing

Configures the IPv6 for unicasting.

Step 4

dns-server 2001:100:0:1::1

Example:

Device(config-dhcpv6)# dns-server 2001:100:0:1::1

Provides the DNS server option to DHCP clients.

Step 5

domain-name example.com

Example:

Device(config-dhcpv6)# domain-name example.com

Provides the domain name option to DHCP clients.

Step 6

exit

Example:

Device(config-dhcpv6)# exit

Returns to the previous mode.

Step 7

interface vlan 1

Example:

Device(config)# interface vlan 1

Enters the interface mode to configure the stateful DHCP.

Step 8

description IPv6-DHCP-Stateful

Example:

Device(config-if)# description IPv6-DHCP-Stateful

Enter description for the stateful IPv6 DHCP.

Step 9

ipv6 address 2001:DB8:0:20::1/64

Example:

Device(config-if)# ipv6 address 2001:DB8:0:20::1/64

Enters the IPv6 address for the stateful IPv6 DHCP.

Step 10

ip address 192.168.20.1 255.255.255.0

Example:

Device(config-if)# ip address 192.168.20.1 255.255.255.0

Enters the IPv6 address for the stateful IPv6 DHCP.

Step 11

ipv6 nd prefix 2001:db8::/64 no-advertise

Example:

Device(config-if)# ipv6 nd prefix 2001:db8::/64 no-advertise

Configures the IPv6 routing prefix advertisement that must not be advertised.

Step 12

ipv6 nd managed-config-flag

Example:

Device(config-if)# ipv6 nd managed-config-flag

Configures IPv6 interfaces neighbor discovery to allow the hosts to uses DHCP for address configuration.

Step 13

ipv6 nd other-config-flag

Example:

Device(config-if)# ipv6 nd other-config-flag

Configures IPv6 interfaces neighbor discovery to allow the hosts to uses DHCP for non-address configuration.

Step 14

ipv6 dhcp relay destination 2001:DB8:0:20::2

Example:

Device(config-if)# ipv6 dhcp relay destination 2001:DB8:0:20::2

Configures the DHCP server on the interface.

Verifying IPv6 Address Learning Configuration

This example displays the output of the show ipv6 dhcp pool command. This command displays the IPv6 service configuration on the device. The vlan 21 configured pool detail displays 6 clients that are currently using addresses from the pool.

Procedure

show ipv6 dhcp pool

Example:

Device show ipv6 dhcp pool
DHCPv6 pool: vlan21
Address allocation prefix: 2001:DB8:0:1:FFFF:1234::/64 valid 86400 preferred 86400 (6 in use, 0 conflicts)
DNS server: 2001:100:0:1::1
Domain name: example.com
Active clients: 6

Displays the IPv6 service configuration on the device.

Additional References

Related Documents

Related Topic

Document Title

For complete syntax and usage information for the commands used in this chapter.

Command Reference (Catalyst 9200 Series Switches)

Feature History for IPv6 Client Address Learning

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

IPv6 Client Address Learning Functionality

Client Address Learning is configured on device to learn the client's IPv4 and IPv6 address and clients transition state maintained by the device on an association, re-association, de-authentication and timeout.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 3. Configuring DHCP

This section provides information about configuring DHCP.

- Prerequisites for Configuring DHCP

- Restrictions for Configuring DHCP

- Information About DHCP

- How to Configure DHCP

- Feature History for DHCP

Prerequisites for Configuring DHCP

The following prerequisites apply to DHCP Snooping and Option 82:

- You must globally enable DHCP snooping on the switch.

- Before globally enabling DHCP snooping on the switch, make sure that the devices acting as the DHCP server and the DHCP relay agent are configured and enabled.

- If you want the switch to respond to DHCP requests, it must be configured as a DHCP server.

- Before configuring the DHCP snooping information option on your switch, be sure to configure the device that is acting as the DHCP server. You must specify the IP addresses that the DHCP server can assign or exclude, or you must configure DHCP options for these devices.

- For DHCP snooping to function properly, all DHCP servers must be connected to the switch through trusted interfaces, as untrusted DHCP messages will be forwarded only to trusted interfaces. In a service-provider network, a trusted interface is connected to a port on a device in the same network.

- You must configure the switch to use the Cisco IOS DHCP server binding database to use it for DHCP snooping.

- To use the DHCP snooping option of accepting packets on untrusted inputs, the switch must be an aggregation switch that receives packets with option-82 information from an edge switch.

- The following prerequisites apply to DHCP snooping binding database configuration:

- You must configure a destination on the DHCP snooping binding database to use the switch for DHCP snooping.

- Because both NVRAM and the flash memory have limited storage capacity, we recommend that you store the binding file on a TFTP server.

- For network-based URLs (such as TFTP and FTP), you must create an empty file at the configured URL before the switch can write bindings to the binding file at that URL. See the documentation for your TFTP server to determine whether you must first create an empty file on the server; some TFTP servers cannot be configured this way.

- To ensure that the lease time in the database is accurate, we recommend that you enable and configure Network Time Protocol (NTP).

- If NTP is configured, the switch writes binding changes to the binding file only when the switch system clock is synchronized with NTP.

- Before configuring the DHCP relay agent on your switch, make sure to configure the device that is acting as the DHCP server. You must specify the IP addresses that the DHCP server can assign or exclude, configure DHCP options for devices, or set up the DHCP database agent.

- If you want the switch to relay DHCP packets, the IP address of the DHCP server must be configured on the switch virtual interface (SVI) of the DHCP client.

- If a switch port is connected to a DHCP server, configure a port as trusted by entering the ip dhcp snooping trust interface configuration command.

- If a switch port is connected to a DHCP client, configure a port as untrusted by entering the no ip dhcp snooping trust interface configuration command.

Restrictions for Configuring DHCP

We recommend that you do not use transmit (Tx) Switched Port Analyzer (SPAN) or egress SPAN that supports DHCP Snooping, DHCP Relay Agent. If SPAN at Tx is required, avoid using VLAN ports that are in the forwarding path for DHCP packets.

Information About DHCP

- DHCP Server

- DHCP Relay Agent

- DHCP Snooping

- Option-82 Data Insertion

- Cisco IOS DHCP Server Database

- DHCP Snooping Binding Database

- DHCP Snooping and Switch Stacks

- Default DHCP Snooping Configuration

- DHCP Snooping Configuration Guidelines

- DHCP Server and Switch Stacks

- DHCP Server Port-Based Address Allocation

DHCP Server

The DHCP server assigns IP addresses from specified address pools on a switch or router to DHCP clients and manages them. If the DHCP server cannot give the DHCP client the requested configuration parameters from its database, it forwards the request to one or more secondary DHCP servers defined by the network administrator. The switch can act as a DHCP server. If the DHCP server provides the client with the requested configuration, it will not forward the message to the other server.

DHCP Relay Agent

A DHCP relay agent is a Layer 3 device that forwards DHCP packets between clients and servers. Relay agents forward requests and replies between clients and servers when they are not on the same physical subnet. Relay agent forwarding is different from the normal Layer 2 forwarding, in which IP datagrams are switched transparently between networks. Relay agents receive DHCP messages and generate new DHCP messages to send on output interfaces.

DHCP Snooping

DHCP snooping is a DHCP security feature that provides network security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding database, also referred to as a DHCP snooping binding table.

DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You use DHCP snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another switch.

Note

For DHCP snooping to function properly, all DHCP servers must be connected to the switch through trusted interfaces, as untrusted DHCP messages will be forwarded only to trusted interfaces.

An untrusted DHCP message is a message that is received through an untrusted interface. By default, the switch considers all interfaces untrusted. So, the switch must be configured to trust some interfaces to use DHCP Snooping. When you use DHCP snooping in a service-provider environment, an untrusted message is sent from a device that is not in the service-provider network, such as a customer’s switch. Messages from unknown devices are untrusted because they can be sources of traffic attacks.

The DHCP snooping binding database has the MAC address, the IP address, the lease time, the binding type, the VLAN number, and the interface information that corresponds to the local untrusted interfaces of a switch. It does not have information regarding hosts interconnected with a trusted interface.

In a service-provider network, an example of an interface you might configure as trusted is one connected to a port on a device in the same network. An example of an untrusted interface is one that is connected to an untrusted interface in the network or to an interface on a device that is not in the network.

When a switch receives a packet on an untrusted interface and the interface belongs to a VLAN in which DHCP snooping is enabled, the switch compares the source MAC address and the DHCP client hardware address. If the addresses match (the default), the switch forwards the packet. If the addresses do not match, the switch drops the packet.

The switch drops a DHCP packet when one of these situations occurs:

- A packet from a DHCP server, such as a DHCPOFFER, DHCPACK, DHCPNAK, or DHCPLEASEQUERY packet, is received from outside the network or firewall.

- A packet is received on an untrusted interface, and the source MAC address and the DHCP client hardware address do not match.

- The switch receives a DHCPRELEASE or DHCPDECLINE broadcast message that has a MAC address in the DHCP snooping binding database, but the interface information in the binding database does not match the interface on which the message was received.

- A DHCP relay agent forwards a DHCP packet that includes a relay-agent IP address that is not 0.0.0.0, or the relay agent forwards a packet that includes option-82 information to an untrusted port.

- The maximum snooping queue size of 1000 is exceeded when DHCP snooping is enabled.

If the switch is an aggregation switch supporting DHCP snooping and is connected to an edge switch that is inserting DHCP option-82 information, the switch drops packets with option-82 information when packets are received on an untrusted interface. If DHCP snooping is enabled and packets are received on a trusted port, the aggregation switch does not learn the DHCP snooping bindings for connected devices and cannot build a complete DHCP snooping binding database.

When an aggregation switch can be connected to an edge switch through an untrusted interface and you enter the ip dhcp snooping information option allow-untrusted global configuration command, the aggregation switch accepts packets with option-82 information from the edge switch. The aggregation switch learns the bindings for hosts connected through an untrusted switch interface. The DHCP security features, such as dynamic ARP inspection or IP source guard, can still be enabled on the aggregation switch while the switch receives packets with option-82 information on untrusted input interfaces to which hosts are connected. The port on the edge switch that connects to the aggregation switch must be configured as a trusted interface.

Option-82 Data Insertion

In residential, metropolitan Ethernet-access environments, DHCP can centrally manage the IP address assignments for a large number of subscribers. When the DHCP option-82 feature is enabled on the switch, a subscriber device is identified by the switch port through which it connects to the network (in addition to its MAC address). Multiple hosts on the subscriber LAN can be connected to the same port on the access switch and are uniquely identified.

Note

The DHCP option-82 feature is supported only when DHCP snooping is globally enabled on the VLANs to which subscriber devices using option-82 are assigned.

The following illustration shows a metropolitan Ethernet network in which a centralized DHCP server assigns IP addresses to subscribers connected to the switch at the access layer. Because the DHCP clients and their associated DHCP server do not reside on the same IP network or subnet, a DHCP relay agent (the Catalyst switch) is configured with a helper address to enable broadcast forwarding and to transfer DHCP messages between the clients and the server.

DHCP Relay Agent in a Metropolitan Ethernet Network

When you enable the DHCP snooping information option 82 on the switch, the following sequence of events occurs:

- The host (DHCP client) generates a DHCP request and broadcasts it on the network.

- When the switch receives the DHCP request, it adds the option-82 information in the packet. By default, the remote-ID suboption is the switch MAC address, and the circuit-ID suboption is the port identifier, vlan-mod-port , from which the packet is received. You can configure the remote ID and circuit ID.

- If the IP address of the relay agent is configured, the switch adds this IP address in the DHCP packet.

- The switch forwards the DHCP request that includes the option-82 field to the DHCP server.

- The DHCP server receives the packet. If the server is option-82-capable, it can use the remote ID, the circuit ID, or both to assign IP addresses and implement policies, such as restricting the number of IP addresses that can be assigned to a single remote ID or circuit ID. Then the DHCP server echoes the option-82 field in the DHCP reply.

- The DHCP server unicasts the reply to the switch if the request was relayed to the server by the switch. The switch verifies that it originally inserted the option-82 data by inspecting the remote ID and possibly the circuit ID fields. The switch removes the option-82 field and forwards the packet to the switch port that connects to the DHCP client that sent the DHCP request.

In the default suboption configuration, when the described sequence of events occurs, the values in these fields do not change (see the illustration,Suboption Packet Formats):

- Circuit-ID suboption fields

- Suboption type

- Length of the suboption type

- Circuit-ID type

- Length of the circuit-ID type

- Remote-ID suboption fields

- Suboption type

- Length of the suboption type

- Remote-ID type

- Length of the remote-ID type

In the port field of the circuit ID suboption, the port numbers start at 3. For example, on a switch with 24 10/100/1000 ports and four small form-factor pluggable (SFP) module slots, port 3 is the Gigabit Ethernet 1/0/1 port, port 4 is the Gigabit Ethernet 1/0/2 port, and so forth. Port 27 is the SFP module slot Gigabit Ethernet1/0/25, and so forth.

The illustration, Suboption Packet Formats. shows the packet formats for the remote-ID suboption and the circuit-ID suboption when the default suboption configuration is used. For the circuit-ID suboption, the module number corresponds to the switch number in the stack. The switch uses the packet formats when you globally enable DHCP snooping and enter the ip dhcp snooping information option global configuration command.

Suboption Packet Formats

The illustration, User-Configured Suboption Packet Formats, shows the packet formats for user-configured remote-ID and circuit-ID suboptions The switch uses these packet formats when DHCP snooping is globally enabled and when the ip dhcp snooping information option format remote-id global configuration command and theip dhcp snooping vlan information option format-type circuit-id string interface configuration command are entered.

The values for these fields in the packets change from the default values when you configure the remote-ID and circuit-ID suboptions:

- Circuit-ID suboption fields

- The circuit-ID type is 1.

- The length values are variable, depending on the length of the string that you configure.

- Remote-ID suboption fields

- The remote-ID type is 1.

- The length values are variable, depending on the length of the string that you configure.

User-Configured Suboption Packet Formats

Cisco IOS DHCP Server Database

During the DHCP-based autoconfiguration process, the designated DHCP server uses the Cisco IOS DHCP server database. It has IP addresses, address bindings, and configuration parameters, such as the boot file.

An address binding is a mapping between an IP address and a MAC address of a host in the Cisco IOS DHCP server database. You can manually assign the client IP address, or the DHCP server can allocate an IP address from a DHCP address pool.

DHCP Snooping Binding Database

When DHCP snooping is enabled, the switch uses the DHCP snooping binding database to store information about untrusted interfaces. The database can have up to 64,000 bindings.

Each database entry (binding) has an IP address, an associated MAC address, the lease time (in hexadecimal format), the interface to which the binding applies, and the VLAN to which the interface belongs. The database agent stores the bindings in a file at a configured location. At the end of each entry is a checksum that accounts for all the bytes from the start of the file through all the bytes associated with the entry. Each entry is 77 bytes, followed by a space, the checksum value, and the EOL symbol.

To keep the bindings when the switch reloads, you must use the DHCP snooping database agent. If the agent is disabled, dynamic ARP inspection or IP source guard is enabled, and the DHCP snooping binding database has dynamic bindings, the switch loses its connectivity. If the agent is disabled and only DHCP snooping is enabled, the switch does not lose its connectivity, but DHCP snooping might not prevent DHCP spoofing attacks.

When reloading, the switch reads the binding file to build the DHCP snooping binding database. The switch updates the file when the database changes.

When a switch learns of new bindings or when it loses bindings, the switch immediately updates the entries in the database. The switch also updates the entries in the binding file. The frequency at which the file is updated is based on a configurable delay, and the updates are batched. If the file is not updated in a specified time (set by the write-delay and abort-timeout values), the update stops.

This is the format of the file with bindings:

<initial-checksum>
TYPE DHCP-SNOOPING
VERSION 1
BEGIN
<entry-1> <checksum-1>
<entry-2> <checksum-1-2>
...
...
<entry-n> <checksum-1-2-..-n>
END

Each entry in the file is tagged with a checksum value that the switch uses to verify the entries when it reads the file. The initial-checksum entry on the first line distinguishes entries associated with the latest file update from entries associated with a previous file update.

This is an example of a binding file:

3ebe1518
TYPE DHCP-SNOOPING
VERSION 1
BEGIN
10.1.1.1 512 001.0001.0005 3EBE2881 Gi1/1                                e5e1e733
10.1.1.1 512 001.0001.0002 3EBE2881 Gi1/1                                4b3486ec
10.1.1.1 1536 001.0001.0004 3EBE2881 Gi1/1                               f0e02872
10.1.1.1 1024 001.0001.0003 3EBE2881 Gi1/1                               ac41adf9
10.1.1.1 1 001.0001.0001 3EBE2881 Gi1/1                                  34b3273e
END

When the switch starts and the calculated checksum value equals the stored checksum value, the switch reads entries from the binding file and adds the bindings to its DHCP snooping binding database. The switch ignores an entry when one of these situations occurs:

- The switch reads the entry and the calculated checksum value does not equal the stored checksum value. The entry and the ones following it are ignored.

- An entry has an expired lease time (the switch might not remove a binding entry when the lease time expires).

- The interface in the entry no longer exists on the system.

- The interface is a routed interface or a DHCP snooping-trusted interface.

DHCP Snooping and Switch Stacks

DHCP snooping is managed on the active switch. When a new switch joins the stack, the switch receives the DHCP snooping configuration from the active switch. When a member leaves the stack, all DHCP snooping address bindings associated with the switch age out.

All snooping statistics are generated on the active switch. If a new active switch is elected, the statistics counters reset.

When a stack merge occurs, all DHCP snooping bindings in the active switch are lost if it is no longer the active switch. With a stack partition, the existing active switch is unchanged, and the bindings belonging to the partitioned switches age out. The new active switch of the partitioned stack begins processing the new incoming DHCP packets.

Default DHCP Snooping Configuration

Default DHCP Configuration

Feature

Default Setting

DHCP server

Enabled in Cisco IOS software, requires configuration[1]

DHCP relay agent

Enabled[2]

DHCP packet forwarding address

None configured

Checking the relay agent information

Enabled (invalid messages are dropped)

DHCP relay agent forwarding policy

Replace the existing relay agent information

DHCP snooping enabled globally

Disabled

DHCP snooping information option

Enabled

DHCP snooping option to accept packets on untrusted input interfaces[3]

Disabled

DHCP snooping limit rate

None configured

DHCP snooping trust

Untrusted

DHCP snooping VLAN

Disabled

DHCP snooping MAC address verification

Enabled

Cisco IOS DHCP server binding database

Enabled in Cisco IOS software, requires configuration.

Note

The switch gets network addresses and configuration parameters only from a device configured as a DHCP server.

DHCP snooping binding database agent

Enabled in Cisco IOS software, requires configuration. This feature is operational only when a destination is configured.

[1] The switch responds to DHCP requests only if it is configured as a DHCP server.

[2] The switch relays DHCP packets only if the IP address of the DHCP server is configured on the SVI of the DHCP client.

[3] Use this feature when the switch is an aggregation switch that receives packets with option-82 information from an edge switch.

DHCP Snooping Configuration Guidelines

- If a switch port is connected to a DHCP server, configure a port as trusted by entering the ip dhcp snooping trust interface configuration command.

- If a switch port is connected to a DHCP client, configure a port as untrusted by entering the no ip dhcp snooping trust interface configuration command.

- You can display DHCP snooping statistics by entering the show ip dhcp snooping statistics user EXEC command, and you can clear the snooping statistics counters by entering the clear ip dhcp snooping statistics privileged EXEC command.

DHCP Server and Switch Stacks

The DHCP binding database is managed on the active switch. When a new active switch is assigned, the new active switch downloads the saved binding database from the TFTP server. When a switch changeover happens, the new active switch will use its database file that has been synced from the old active switch using the SSO function. The IP addresses associated with the lost bindings are released. You should configure an automatic backup by using the ip dhcp database url [timeout seconds | write-delay seconds] global configuration command.

DHCP Server Port-Based Address Allocation

DHCP server port-based address allocation is a feature that enables DHCP to maintain the same IP address on an Ethernet switch port regardless of the attached device client identifier or client hardware address.

When Ethernet switches are deployed in the network, they offer connectivity to the directly connected devices. In some environments, such as on a factory floor, if a device fails, the replacement device must be working immediately in the existing network. With the current DHCP implementation, there is no guarantee that DHCP would offer the same IP address to the replacement device. Control, monitoring, and other software expect a stable IP address associated with each device. If a device is replaced, the address assignment should remain stable even though the DHCP client has changed.

When configured, the DHCP server port-based address allocation feature ensures that the same IP address is always offered to the same connected port even as the client identifier or client hardware address changes in the DHCP messages received on that port. The DHCP protocol recognizes DHCP clients by the client identifier option in the DHCP packet. Clients that do not include the client identifier option are identified by the client hardware address. When you configure this feature, the port name of the interface overrides the client identifier or hardware address and the actual point of connection, the switch port, becomes the client identifier.

In all cases, by connecting the Ethernet cable to the same port, the same IP address is allocated through DHCP to the attached device.

The DHCP server port-based address allocation feature is only supported on a Cisco IOS DHCP server and not a third-party server.

- Default Port-Based Address Allocation Configuration

- Port-Based Address Allocation Configuration Guidelines

Default Port-Based Address Allocation Configuration

By default, DHCP server port-based address allocation is disabled.

Port-Based Address Allocation Configuration Guidelines

- By default, DHCP server port-based address allocation is disabled.

- To restrict assignments from the DHCP pool to preconfigured reservations (unreserved addresses are not offered to the client and other clients are not served by the pool), you can enter the reserved-only DHCP pool configuration command.

How to Configure DHCP

- Configuring the DHCP Server

- Configuring the DHCP Relay Agent

- Specifying the Packet Forwarding Address

- Configuring DHCP for IPv6 Address Assignment

- Enabling the Cisco IOS DHCP Server Database

- Enabling the DHCP Snooping Binding Database Agent

- Monitoring DHCP Snooping Information

- Enabling DHCP Server Port-Based Address Allocation

- Monitoring DHCP Server Port-Based Address Allocation

Configuring the DHCP Server

The switch can act as a DHCP server. If DHCP server for DHCP clients with management ports are used, both DHCP pool and the corresponding interface must be configured using the Management VRF.

Configuring the DHCP Relay Agent

Follow these steps to enable the DHCP relay agent on the switch:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

service dhcp

Example:

Device(config)# service dhcp

Enables the DHCP server and relay agent on your switch. By default, this feature is enabled.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

What to do next

- Checking (validating) the relay agent information

- Configuring the relay agent forwarding policy

Specifying the Packet Forwarding Address

If the DHCP server and the DHCP clients are on different networks or subnets, you must configure the switch with the ip helper-address address interface configuration command. The general rule is to configure the command on the Layer 3 interface closest to the client. The address used in the ip helper-address command can be a specific DHCP server IP address, or it can be the network address if other DHCP servers are on the destination network segment. Using the network address enables any DHCP server to respond to requests.

Perform these steps to specify the packet forwarding address:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface vlan vlan-id

Example:

Device(config)# interface vlan 1

Creates a switch virtual interface by entering a VLAN ID, and enters interface configuration mode.

Step 4

ip address ip-address subnet-mask

Example:

Device(config-if)# ip address 192.108.1.27 255.255.255.0

Configures the interface with an IP address and an IP subnet.

Step 5

ip helper-address address

Example:

Device(config-if)# ip helper-address 172.16.1.2

Specifies the DHCP packet forwarding address.

- The helper address can be a specific DHCP server address, or it can be the network address if other DHCP servers are on the destination network segment. Using the network address enables other servers to respond to DHCP requests.

- If you have multiple servers, you can configure one helper address for each server.

Step 6

exit

Example:

Device(config-if)# exit

Exits interface configuration mode and returns to global configuration mode.

Step 7

Use one of the following:

- interface range port-range

- interface interface-id

Example:

Device(config)# interface gigabitethernet 1/0/2

Configures multiple physical ports that are connected to the DHCP clients, and enters interface range configuration mode.

or

Configures a single physical port that is connected to the DHCP client, and enter interface configuration mode.

Step 8

switchport mode access

Example:

Device(config-if)# switchport mode access

Defines the VLAN membership mode for the port.

Step 9

switchport access vlan vlan-id

Example:

Device(config-if)# switchport access vlan 1

Assigns the ports to the same VLAN as configured in Step 2.

Step 10

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

Configuring DHCP for IPv6 Address Assignment

- Default DHCPv6 Address Assignment Configuration

- DHCPv6 Address Assignment Configuration Guidelines

- Enabling DHCPv6 Server Function (CLI)

- Enabling DHCPv6 Client Function

Default DHCPv6 Address Assignment Configuration

By default, no DHCPv6 features are configured on the switch.

DHCPv6 Address Assignment Configuration Guidelines

The following prerequisites apply when configuring DHCPv6 address assignment:

- In the following procedures, the specified interface must be one of these Layer 3 interfaces:

- If the IPv6 address is not explicitly configured, enable IPv6 routing by using the ipv6 enable command.

- DHCPv6 routing must be enabled on a Layer 3 interface.

- SVI: A VLAN interface created by using the interface vlan vlan_id command.

- EtherChannel port channel in Layer 3 mode: a port-channel logical interface created by using the interface port-channel port-channel-number command.

- The device can act as a DHCPv6 client, server, or relay agent. The DHCPv6 client, server, and relay function are mutually exclusive on an interface.

- Beginning from Cisco IOS XE Gibraltar 16.11.1, a DHCPv6 address will contain interface identifiers that are not part of the reserved interface identifiers range specified in RFC5453.

Enabling DHCPv6 Server Function (CLI)

Use the no form of the DHCP pool configuration mode commands to change the DHCPv6 pool characteristics. To disable the DHCPv6 server function on an interface, use the no ipv6 dhcp server interface configuration command.

To enable the DHCPv6 server function on an interface, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 dhcp pool poolname

Example:

Device(config)# ipv6 dhcp pool 7

Enters DHCP pool configuration mode, and define the name for the IPv6 DHCP pool. The pool name can be a symbolic string (such as Engineering) or an integer (such as 0).

Step 4

address prefix IPv6-prefix {lifetime} {t1 t1 | infinite}

Example:

Device(config-dhcpv6)# address prefix 2001:1000::0/64 lifetime 3600

(Optional) Specifies an address prefix for address assignment.

This address must be in hexadecimal, using 16-bit values between colons.

lifetime t1 t1 —Specifies a time interval (in seconds) that an IPv6 address prefix remains in the valid state. The range is 5 to 4294967295 seconds. Specify infinite for no time interval.

Step 5

link-address IPv6-prefix

Example:

Device(config-dhcpv6)# link-address 2001:1002::0/64

(Optional) Specifies a link-address IPv6 prefix.

When an address on the incoming interface or a link-address in the packet matches the specified IPv6 prefix, the server uses the configuration information pool.

This address must be in hexadecimal, using 16-bit values between colons.

Step 6

vendor-specific vendor-id

Example:

Device(config-dhcpv6)# vendor-specific 9

(Optional) Enters vendor-specific configuration mode and specifies a vendor-specific identification number. This number is the vendor IANA Private Enterprise Number. The range is 1 to 4294967295.

Step 7

suboption number {address IPv6-address | ascii ASCII-string | hex hex-string}

Example:

Device(config-dhcpv6-vs)# suboption 1 address 1000:235D::

(Optional) Enters a vendor-specific suboption number. The range is 1 to 65535. Enter an IPv6 address, ASCII text, or a hex string as defined by the suboption parameters.

Step 8

exit

Example:

Device(config-dhcpv6-vs)# exit

Returns to DHCP pool configuration mode.

Step 9

exit

Example:

Device(config-dhcpv6)# exit

Returns to global configuration mode.

Step 10

interface interface-id

Example:

Device(config)# interface gigabitethernet 1/0/1

Enters interface configuration mode, and specifies the interface to configure.

Step 11

ipv6 dhcp server [poolname | automatic] [rapid-commit] [preference value] [allow-hint]

Example:

Device(config-if)# ipv6 dhcp server automatic

Enables DHCPv6 server function on an interface.

- poolname —(Optional) User-defined name for the IPv6 DHCP pool. The pool name can be a symbolic string (such as Engineering) or an integer (such as 0).

- automatic —(Optional) Enables the system to automatically determine which pool to use when allocating addresses for a client.

- rapid-commit —(Optional) Allows two-message exchange method.

- preference value —(Optional) Configures the preference value carried in the preference option in the advertise message sent by the server. The range is from 0 to 255. The preference value default is 0.

- allow-hint —(Optional) Specifies whether the server should consider client suggestions in the SOLICIT message. By default, the server ignores client hints.

Step 12

end

Example:

Device(config)# end

Returns to privileged EXEC mode.

Step 13

Do one of the following:

- show ipv6 dhcp pool

- show ipv6 dhcp interface

Example:

Device# show ipv6 dhcp pool

or

Device# show ipv6 dhcp interface

- Verifies DHCPv6 pool configuration.

- Verifies that the DHCPv6 server function is enabled on an interface.

Step 14

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Enabling DHCPv6 Client Function

To enable the DHCPv6 client on an interface, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface interface-id

Example:

Device(config)# interface gigabitethernet 1/0/1

Enters interface configuration mode, and specifies the interface to configure.

Step 4

ipv6 address dhcp [rapid-commit]

Example:

Device(config-if)# ipv6 address dhcp rapid-commit

Enables the interface to acquire an IPv6 address from the DHCPv6 server.

rapid-commit —(Optional) Allow two-message exchange method for address assignment.

Step 5

ipv6 dhcp client request [vendor-specific]

Example:

Device(config-if)# ipv6 dhcp client request vendor-specific

(Optional) Enables the interface to request the vendor-specific option.

Step 6

end

Example:

Device(config)# end

Returns to privileged EXEC mode.

Step 7

show ipv6 dhcp interface

Example:

Device# show ipv6 dhcp interface

Verifies that the DHCPv6 client is enabled on an interface.

Enabling the Cisco IOS DHCP Server Database

For procedures to enable and configure the Cisco IOS DHCP server database, see the “DHCP Configuration Task List” section in the “Configuring DHCP” chapter of the Cisco IOS IP Configuration Guide.

Enabling the DHCP Snooping Binding Database Agent

Beginning in privileged EXEC mode, follow these steps to enable and configure the DHCP snooping binding database agent on the switch:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip dhcp snooping database {flash[number]: /filename | ftp://user:password@host/filename | http://[[username:password]@]{hostname | host-ip}[ /directory]
/image-name.tar | rcp://user@host/filename}| tftp://host/filename

Example:

Device(config)# ip dhcp snooping database tftp://10.90.90.90/snooping-rp2

Specifies the URL for the database agent or the binding file by using one of these forms:

- flash[number]:/filename

- ftp://user:password@host/filename

- http://[[username:password]@]{hostname | host-ip}[ /directory]
/image-name.tar

- rcp://user@host/filename

- tftp://host/filename

Step 4

ip dhcp snooping database timeout seconds

Example:

Device(config)# ip dhcp snooping database timeout 300

Specifies (in seconds) how long to wait for the database transfer process to finish before stopping the process.

The default is 300 seconds. The range is 0 to 86400. Use 0 to define an infinite duration, which means to continue trying the transfer indefinitely.

Step 5

ip dhcp snooping database write-delay seconds

Example:

Device(config)# ip dhcp snooping database write-delay 15

Specifies the duration for which the transfer should be delayed after the binding database changes. The range is from 15 to 86400 seconds. The default is 300 seconds (5 minutes).

Step 6

exit

Example:

Device(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Step 7

ip dhcp snooping binding mac-address vlan vlan-id ip-address interface interface-id expiry seconds

Example:

Device# ip dhcp snooping binding 0001.1234.1234 vlan 1 172.20.50.5
interface gigabitethernet 1/1/0 expiry 1000

(Optional) Adds binding entries to the DHCP snooping binding database. The vlan-id range is from 1 to 4904. The seconds range is from 1 to 4294967295.

Enter this command for each entry that you add.

Use this command when you are testing or debugging the switch.

Step 8

show ip dhcp snooping database [detail]

Example:

Device# show ip dhcp snooping database detail

Displays the status and statistics of the DHCP snooping binding database agent.

Monitoring DHCP Snooping Information

Commands for Displaying DHCP Information

show ip dhcp snooping

Displays the DHCP snooping configuration for a switch

show ip dhcp snooping binding

Displays only the dynamically configured bindings in the DHCP snooping binding database, also referred to as a binding table.

show ip dhcp snooping database

Displays the DHCP snooping binding database status and statistics.

show ip dhcp snooping statistics

Displays the DHCP snooping statistics in summary or detail form.

show ip source binding

Display the dynamically and statically configured bindings.

Note

If DHCP snooping is enabled and an interface changes to the down state, the switch does not delete the statically configured bindings.

Enabling DHCP Server Port-Based Address Allocation

Follow these steps to globally enable port-based address allocation and to automatically generate a subscriber identifier on an interface.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip dhcp use subscriber-id client-id

Example:

Device(config)# ip dhcp use subscriber-id client-id

Configures the DHCP server to globally use the subscriber identifier as the client identifier on all incoming DHCP messages.

Step 4

ip dhcp subscriber-id interface-name

Example:

Device(config)# ip dhcp subscriber-id interface-name

Automatically generates a subscriber identifier based on the short name of the interface.

A subscriber identifier configured on a specific interface takes precedence over this command.

Step 5

interface interface-type interface-number

Example:

Device(config)# interface gigabitethernet 1/0/1

Specifies the interface to be configured, and enters interface configuration mode.

Step 6

ip dhcp server use subscriber-id client-id

Example:

Device(config-if)# ip dhcp server use subscriber-id client-id

Configures the DHCP server to use the subscriber identifier as the client identifier on all incoming DHCP messages on the interface.

Step 7

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

What to do next

After enabling DHCP port-based address allocation on the switch, use the ip dhcp pool global configuration command to preassign IP addresses and to associate them to clients.

Monitoring DHCP Server Port-Based Address Allocation

Commands for Displaying DHCP Port-Based Address Allocation Information

Command

Purpose

show interface interface id

Displays the status and configuration of a specific interface.

show ip dhcp pool

Displays the DHCP address pools.

show ip dhcp binding

Displays address bindings on the Cisco IOS DHCP server.

Feature History for DHCP

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

New Feature History

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

DHCP

DHCP provides configuration parameters to Internet hosts. DHCP consists of two components: a protocol for delivering host-specific configuration parameters from a DHCP Server to a host and a mechanism for allocating network addresses to hosts. DHCP is built on a client/server model, where designated DHCP Server hosts allocate network addresses and deliver configuration parameters to dynamically configured hosts.

Cisco IOS XE Fuji 16.9.2

DHCP Client Option 12

The DHCP Client Option 12 feature specifies the hostname of the client. While acquiring an IP address for an interface from the Dynamic Host Configuration Protocol (DHCP) server, if the client device receives the DHCP Hostname option inside the response, the hostname from that option is set. DHCP is used by DHCP clients to obtain configuration information for operation in an IP network.

Cisco IOS XE Cupertino 17.7.1

DHCP

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 4. DHCP Options Support

- Restrictions for DHCP Options Support

- Information About DHCP Options Support

- Configuring DHCP Snooping on Private VLANs

- Example: Mapping Private-VLAN Associations

- Configuration Examples for DHCP Options Support

- Feature History for DHCP Options Support

Restrictions for DHCP Options Support

When DHCP snooping is configured on a primary VLAN, you cannot configure snooping with different settings on any of its secondary VLANs. You must configure DHCP snooping for all associated VLANs on the primary VLAN. If DHCP snooping is not configured on the primary VLAN and you try to configure it on the secondary VLAN, for example, VLAN 200, this message appears:

2w5d:%DHCP_SNOOPING-4-DHCP_SNOOPING_PVLAN_WARNING:DHCP Snooping configuration may not take effect
on secondary vlan 200. DHCP Snooping configuration on secondary vlan is derived from its primary vlan.

You can use the show ip dhcp snooping command to display all VLANs, both primary and secondary, that have DHCP snooping enabled.

Information About DHCP Options Support

- DHCP Option 82 Configurable Circuit ID and Remote ID Overview

- DHCP Client Option 12

DHCP Option 82 Configurable Circuit ID and Remote ID Overview

The DHCP Option 82 Configurable Circuit ID and Remote ID feature enhances validation security by allowing you to determine what information is provided in the Option 82 Remote ID and Option 82 Circuit ID suboptions.

You can enable DHCP snooping on private VLANs. When DHCP snooping is enabled, the configuration is propagated to both a primary VLAN and its associated secondary VLANs. When DHCP snooping is enabled on a primary VLAN, it is also enabled on its secondary VLANs.

The figure below shows the packet format used when DHCP snooping is globally enabled and the ip dhcp snooping information option global configuration command is entered with the Circuit ID suboption.

Suboption Packet Formats, Circuit ID Specified

The figure below shows the packet format used when DHCP snooping is globally enabled and the ip dhcp snooping information option global configuration command is entered with the Remote ID suboption.

Suboption Packet Formats, Remote ID Specified

DHCP Client Option 12

The DHCP Client Option12 feature specifies the hostname of the client. While acquiring an IP address for an interface from the Dynamic Host Configuration Protocol (DHCP) server, if the client device receives the DHCP Hostname option inside the response, the hostname from that option is set. DHCP is used by DHCP clients to obtain configuration information for operation in an IP network.

Configuration parameters and other control information are carried in tagged data items that are stored in the options field of a DHCP message. The DHCP client provides flexibility by allowing Option 12 to be configured for a DHCP client.

Option 12 specifies the name of the client. The name might or might not be qualified with the local domain.

Configuring DHCP Snooping on Private VLANs

Perform these tasks to configure DHCP snooping on private primary and secondary VLANs:

- Configure a private, primary VLAN.

- Associate with it an isolated VLAN.

- Create an SVI interface for the primary VLAN, and associate it with the appropriate loopback IP and helper address.

- Enable DHCP snooping on the primary VLAN, which also enables it on the associated VLAN.

Note

You must also configure a server to assign the IP address, a DHCP pool, and a relay route so that snooping can be effective.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

vlan vlan-id

Example:

Device(config)# vlan 70

Enters VLAN configuration mode for the named private VLAN.

Step 4

private-vlan primary

Example:

Device(config-vlan)# private-vlan primary

Designates the VLAN as the primary private VLAN.

Step 5

private-vlan association secondary-vlan-list

Example:

Device(config-vlan)# private-vlan association 7

Configures private VLANs (PVLANs) and the association between a PVLAN and a secondary VLAN.

Step 6

exit

Example:

Device(ocnfig-vlan)# exit

Exits VLAN configuration mode and returns to global configuration mode.

Step 7

vlan vlan_ID

Example:

Device(config)# vlan 7

Enters VLAN configuration mode for the named private VLAN.

- In this example, the associated secondary VLAN is vlan 7.

Step 8

private-vlan isolated

Example:

Device(config-vlan)# private-vlan isolated

Designates the VLAN as an isolated private VLAN.

Step 9

exit

Example:

Device(config-vlan)# exit

Exits VLAN configuration mode and returns to global configuration mode.

Step 10

interface vlan primary-vlan_id

Example:

Device(config)# interface vlan 70

Creates a dynamic Switch Virtual Interface (SVI) on the primary VLAN, and enters interface configuration mode.

Step 11

ip unnumbered loopback

Example:

Device(config-if)# ip unnumbered loopback1

Specifies IP unnumbered loopback.

Step 12

private-vlan mapping [secondary-vlan-list | add secondary-vlan-list | remove secondary-vlan-list ]

Example:

Device(config-if)# private-vlan mapping 7

Creates a mapping between the primary and the secondary VLANs so that they share the same primary VLAN SVI.

Step 13

exit

Example:

Device(config-if)# exit

Exits interface configuration mode and returns to global configuration mode.

Step 14

ip dhcp snooping vlan primary-vlan_id

Example:

Device(config)# ip dhcp snooping vlan 70

Enables DHCP snooping on the primary and associated VLANs.

Step 15

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Example: Mapping Private-VLAN Associations

The following interface configuration example shows how to map the private-VLAN associations. The user-configurable circuit ID “aabb11” is inserted on the secondary VLAN, vlan 7.

Device> enable
Device# configure terminal
Device(config-if)# interface GigabitEthernet 9/0/1
Device(config-if)# switchport
Device(config-if)# switchport private-vlan host-association 70 7
Device(config-if)# switchport mode private-vlan host
Device(config-if)# no mls qos trust
Device(config-if)# spanning-tree portfast
Device(config-if)# exit
Device(config)# ip dhcp snooping vlan 7 information option format-type circuit-id string aabb11
Device(config)# end

The following example shows how to define a DHCP class “C1” and specify the hex string of the corresponding class at the server by using the hex string that matches the circuit-ID value entered in the interface configuration example. That is, the hex string 00000000000000000000000000000006616162623131 mask fffffffffffffffffffffffffffffff0000000000000 matches the circuit ID aabb11.

Device> enable
Device# configure terminal
Device(config)# ip dhcp class C1
Device(config-dhcp-class)# relay agent information
Device(config-dhcp-class-relayinfo)# relay-information hex 00000000000000000000000000000006616162623131
mask fffffffffffffffffffffffffffffff0000000000000
Device(config-dhcp-class-relayinfo)# end

Configuration Examples for DHCP Options Support

Feature History for DHCP Options Support

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

DHCP Client Option 12

The DHCP Client Option 12 feature specifies the hostname of the client. While acquiring an IP address for an interface from the Dynamic Host Configuration Protocol (DHCP) server, if the client device receives the DHCP Hostname option inside the response, the hostname from that option is set. DHCP is used by DHCP clients to obtain configuration information for operation in an IP network.

DHCP Option 82 Configurable Circuit ID and Remote ID

Provides naming choices in the Option 82 Remote ID and Option 82 Circuit ID suboptions.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 5. DHCPv6 Options Support

- Information About DHCPv6 Options Support

- How to Configure DHCPv6 Options Support

- Example: Configuring CAPWAP Access Points

- Verifying DHCPv6 Options Support

- Additional References for DHCPv6 Options Support

- Feature History for DHCPv6 Options Support

Information About DHCPv6 Options Support

- CAPWAP Access Controller DHCPv6 Option

- DNS Search List Option

- DHCPv6 Client Link-Layer Address Option

- DHCP Relay Agent

CAPWAP Access Controller DHCPv6 Option

The Control And Provisioning of Wireless Access Points (CAPWAP) protocol allows lightweight access points to use DHCPv6 to discover a wireless controller to which it can connect. CAPWAP is a standard, interoperable protocol that enables a controller to manage a collection of wireless access points.

Wireless access points use the DHCPv6 option 52 (RFC 5417) to supply the IPv6 management interface addresses of the primary, secondary, and tertiary wireless controllers.

Both stateless and stateful DHCPv6 addressing modes are supported. In stateless mode, access points obtain IPv6 address using the Stateless Address AutoConfiguration (SLAAC), while additional network information (not obtained from router advertisements) is obtained from a DHCPv6 server. In stateful mode, access points obtain both IPv6 addressing and additional network information exclusively from the DHCPv6 server. In both modes, a DHCPv6 server is required to provide option 52 if Wireless Controller discovery using DHCPv6 is required.

When the MAX_PACKET_SIZE exceeds 15, and option 52 is configured, the DHCPv6 server does not send DHCP packets.

DNS Search List Option

DNS Search List (DNSSL) is a list of Domain Name System (DNS) suffix domain names used by IPv6 hosts when they perform DNS query searches for short, unqualified domain names. The DNSSL option contains one or more domain names. All domain names share the same lifetime value, which is the maximum time in seconds over which this DNSSL may be used. If different lifetime values are required, multiple DNSSL options can be used. There can bea maximum of 5 DNSSLs.

DHCP messages with long DNSSL names are discarded by the device.

Note

If DNS information is available from multiple Router Advertisements (RAs) and/or from DHCP, the host must maintain an ordered list of this DNS information.

RFC 6106 specifies IPv6 Router Advertisement (RA) options to allow IPv6 routers to advertise a DNS Search List (DNSSL) to IPv6 hosts for an enhanced DNS configuration.

The DNS lifetime range should be between the maximum RA interval and twice the maximum RA interval, as displayed in the following example:

(max ra interval) <= dns lifetime <= (2*(max ra interval))

The maximum RA interval can have a value between 4 and 1800 seconds (the default is 240 seconds). The following example shows an out-of-range lifetime:

Device(config-if)# ipv6 nd ra dns-search-list sss.com 3600
! Lifetime configured out of range for the interface that has the  default maximum RA interval.!

DHCPv6 Client Link-Layer Address Option

The DHCPv6 Client Link-Layer Address Option (RFC 6939) defines an optional mechanism and the related DHCPv6 option to allow first-hop DHCPv6 relay agents (relay agents that are connected to the same link as the client) to provide the client's link-layer address in DHCPv6 messages that are sent towards the server.

The Client Link-Layer Address option is only exchanged between relay agents and servers. DHCPv6 clients are not aware of the use of the Client Link-Layer Address option. The DHCPv6 client must not send the Client Link-Layer Address option, and must ignore the Client Link-Layer Address option if received.

Each DHCPv6 client and server is identified by a DHCP unique identifier (DUID). The DUID is carried in the client identifier and server identifier options. The DUID is unique across all DHCP clients and servers, and it is stable for any specific client or server. DHCPv6 uses DUIDs based on link-layer addresses for both the client and server identifier. The device uses the MAC address from the lowest-numbered interface to form the DUID. The network interface is assumed to be permanently attached to the device.

DHCP Relay Agent

A DHCP relay agent is a Layer 3 device that forwards DHCP packets between clients and servers. Relay agents forward requests and replies between clients and servers when they are not on the same physical subnet. Relay agent forwarding is different from the normal Layer 2 forwarding, in which IP datagrams are switched transparently between networks. Relay agents receive DHCP messages and generate new DHCP messages to send on output interfaces.

How to Configure DHCPv6 Options Support

This section provides information about how to configure DHCPv6 options support:

- Configuring CAPWAP Access Points

- Configuring DNS Search List Using IPv6 Router Advertisement Options

Configuring CAPWAP Access Points

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 dhcp pool poolname

Example:

Device(config)# ipv6 dhcp pool pool1

Configures a DHCPv6 server configuration information pool and enters DHCPv6 pool configuration mode.

Step 4

capwap-ac address ipv6-address

Example:

Device(config-dhcpv6)# capwap-ac address 2001:DB8::1

Configures CAPWAP access controller address.

Step 5

end

Example:

Device(config-dhcpv6)# end

Exits DHCPv6 pool configuration mode and returns to privileged EXEC mode.

Configuring DNS Search List Using IPv6 Router Advertisement Options

Perform this task to configure the DNS search list using IPv6 router advertisement options:

Note

The domain name configuration should follow RFC 1035. If not, the configuration will be rejected. For example, the following domain name configuration will result in an error:

Device(config-if)# ipv6 nd ra dns-search-list domain example.example.com infinite-lifetime

Note

The ipv6 nd ra dns-search-list domain command can only be configured on physical interfaces that are configured as routed ports in layer 3 mode. This is done by running the no switchport command in interface configuration mode.

Use the no ipv6 nd ra dns-search-list domain domain-name command in interface configuration mode to delete a single DNS search list under an interface.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface interface-type interface-number

Example:

Device(config)# interface GigabitEthernet 0/2/0

Configures an interface and enters interface configuration mode.

Step 4

no switchport

Example:

Device(config-if)# no switchport

For physical ports only, enters Layer 3 mode.

Step 5

ipv6 nd prefix ipv6-prefix/prefix-length

Example:

Device(config-if)# ipv6 nd prefix 2001:DB8::1/64 1111 222

Configures IPv6 prefixes that are included in IPv6 Neighbor Discovery (ND) router advertisements.

Step 6

ipv6 nd ra lifetime seconds

Example:

Device(config-if)# ipv6 nd ra lifetime 9000

Configures the device lifetime value in IPv6 router advertisements on an interface.

Step 7

ipv6 nd ra dns-search-list domain domain-name[ lifetime [ lifetime-value | infinite]]

Example:

Device(config-if)# ipv6 nd ra dns-search-list domain example.example.com lifetime infinite

Configures the DNS search list. You can specify the life time of the search list.

Note

For releases earlier than Cisco IOS XE Giraltar 16.12.1, this command existed as ipv6 nd ra dns search list list-name infinite-lifetime

Step 8

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

Example: Configuring CAPWAP Access Points

The following example shows how to configure a CAPWAP access point:

Device> enable
Device# configure terminal
Device(config)# ipv6 dhcp pool pool1
Device(config-dhcpv6)# capwap-ac address 2001:DB8::1
Device(config-dhcpv6)# end
Device#

Verifying DHCPv6 Options Support

Verifying Option 52 Support

The following sample output from the show ipv6 dhcp pool command displays the DHCPv6 configuration pool information:

Device# show ipv6 dhcp pool

DHCPv6 pool: svr-p1
Static bindings:
Binding for client 000300010002FCA5C01C
IA PD: IA ID 00040002,
Prefix: 2001:db8::3/72
preferred lifetime 604800, valid lifetime 2592000
IA PD: IA ID not specified; being used by 00040001
Prefix: 2001:db8::1/72
preferred lifetime 240, valid lifetime 54321
Prefix: 2001:db8::2/72
preferred lifetime 300, valid lifetime 54333
Prefix: 2001:db8::3/72
preferred lifetime 280, valid lifetime 51111
Prefix from pool: local-p1, Valid lifetime 12345, Preferred lifetime 180
DNS server: 1001::1
DNS server: 1001::2
CAPWAP-AC Controller address: 2001:DB8::1
Domain name: example1.com
Domain name: example2.com
Domain name: example3.com
Active clients: 2

The following example shows how to enable debugging for DHCPv6:

Device# debug ipv6 dhcp detail

IPv6 DHCP debugging is on (detailed)

Additional References for DHCPv6 Options Support

Standards and RFCs

Standards/RFC

Title

RFC 6106

IPv6 Router Advertisement Options for DNS Configuration

RFC 54171

Control And Provisioning of Wireless Access Points (CAPWAP) Access Controller DHCP Option

RFC 6939

Client Link-Layer Address Option in DHCPv6

Feature History for DHCPv6 Options Support

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

CAPWAP Access Controller DHCPv6 Option-52

The CAPWAP protocol allows lightweight access points to use DHCPv6 to discover a Wireless Controller to which it can connect. CAPWAP is a standard, interoperable protocol that enables a controller to manage a collection of wireless access points.

DHCPv6 Client Link-Layer Address Option

The DHCPv6 Client Link-Layer Address Option (RFC 6939) defines an optional mechanism and the related DHCPv6 option to allow first-hop DHCPv6 relay agents (relay agents that are connected to the same link as the client) to provide the client's link-layer address in the DHCPv6 messages being sent towards the server.

DNS Search List

DNS Search List (DNSSL) is a list of Domain Name System (DNS) suffix domain names used by IPv6 hosts when they perform DNS query searches for short, unqualified domain names. The DNSSL option contains one or more domain names.

Cisco IOS XE Gibraltar 16.12.1

DHCPv6 Relay Chaining and Route Insertion

DHCPv6 Relay Chaining and Route Insertion feature allows DHCPv6 messages to be relayed through multiple relay agents.

DHCPv6 Client Link-Layer Address Option - Command Changes

The syntax of ipv6 nd ra dns search list command was modified to ipv6 nd ra dns-search-list domain . The show ipv6 nd ra dns-search-list command was introduced.

IPv6 Support for RFC 6106 and RFC 5417

IPv6 support was introduced for Router Advertisement Options for DNS Configuration (RFC 6106), and Control And Provisioning of Wireless Access Points (CAPWAP) Access Controller DHCP Option (RFC 5417).

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 6. DHCPv6 Relay Source Configuration

- Restrictions for Configuring a DHCPv6 Relay Source

- Information About DHCPv6 Relay Source Configuration

- Configuring a DHCPv6 Relay Source

- Example: Configuring a DHCPv6 Relay Source on an Interface

- Additional References for DHCPv6 Relay Source Configuration

- Feature History for DHCPv6 Relay Source Configuration

Restrictions for Configuring a DHCPv6 Relay Source

- If the configured interface is shut down, or if all of its IPv6 addresses are removed, the relay will revert to its standard behavior.

- The command line interface (CLI) will report an error if the user attempts to specify an interface that has no IPv6 addresses configured.

- The interface configuration takes precedence over the global configuration if both have been configured.

Information About DHCPv6 Relay Source Configuration

The DHCPv6 server sends its replies to the source address of relayed messages. Normally, a DHCPv6 relay uses the address of the server-facing interface used to send messages as the source. However, in some networks, it may be desirable to configure a more stable address (such as a loopback interface) and have the relay use that interface as the source address of relayed messages. The DHCPv6 Relay Source Configuration feature provides this capability.

The figure below shows a simple network with a single client, relay, and server. The relay and server communicate over 2001:DB8:1::/64, and the relay has a client-facing interface on 2001:DB8:2::/64. The relay also has a loopback interface configured with address 2001:DB8:3:1/64.

DHCPv6 Relay Source Configuration—Simple Network

When the relay receives a request from the client, the relay includes an address from the client-facing interface (Ethernet 1/0) in the link-address field of a relay-forward message. This address is used by the server to select an address pool. The relay then sends the relay-forward message toward the server. By default, the address of the server-facing (Ethernet 0/0) interface is used as the IPv6 source, and the server will send any reply to that address.

If the relay source interface is explicitly configured, the relay will use that interface’s primary IPv6 address as the IPv6 source for messages it forwards. For example, configuring Loopback 0 as the source would cause the relay to use 2001:DB8:3:1/64 as the IPv6 source address for messages relayed toward the server.

Configuring a DHCPv6 Relay Source

Perform the following tasks to configure a DHCPv6 relay source:

- Configuring a DHCPv6 Relay Source on an Interface

- Configuring a DHCPv6 Relay Source Globally

Configuring a DHCPv6 Relay Source on an Interface

Perform this task to configure an interface to use as the source when relaying messages.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface loopback 0

Specifies an interface type and number, and enters interface configuration mode.

Step 4

ipv6 dhcp relay source-interface interface-type interface-number

Example:

Device(config-if)# ipv6 dhcp relay source-interface loopback 0

Configures an interface to use as the source when relaying messages received on this interface.

Step 5

end

Example:

Device(config-if)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring a DHCPv6 Relay Source Globally

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 dhcp relay source-interface interface-type interface-number

Example:

Device(config)# ipv6 dhcp relay source-interface loopback 0

Configures an interface to use as the source when relaying messages.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Example: Configuring a DHCPv6 Relay Source on an Interface

The following example show how to configure the Loopback 0 interface to be used as the relay source:

Device> enable
Device# configure terminal
Device(config)# interface loopback 0
Device(config-if)# ipv6 dhcp relay source-interface loopback 0
Device(config-if)# end

Additional References for DHCPv6 Relay Source Configuration

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

Feature History for DHCPv6 Relay Source Configuration

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

DHCPv6 Relay Source Configuration

In some networks that use DHCPv6, it may be desirable to configure a stable address (such as a loopback interface) and have the relay use that interface as the source address of relayed messages. The DHCPv6 relay source configuration feature provides this capability.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 7. Configuring IPv6 over IPv4 GRE Tunnels

- Information About Configuring IPv6 over IPv4 GRE Tunnels

- Configuring GRE IPv6 Tunnels

- Configuration Example: Tunnel Destination Address for IPv6 Tunnel

- Additional References

- Feature History for IPv6 over IPv4 GRE Tunnels

Information About Configuring IPv6 over IPv4 GRE Tunnels

The following sections provide information about configuring IPv6 over IPv4 GRE tunnels:

- Overlay Tunnels for IPv6

- GRE IPv4 Tunnel Support for IPv6 Traffic

Overlay Tunnels for IPv6

Overlay tunneling encapsulates IPv6 packets in IPv4 packets for delivery across an IPv4 infrastructure (a core network or the figure below). By using overlay tunnels, you can communicate with isolated IPv6 networks without upgrading the IPv4 infrastructure between them. Overlay tunnels can be configured between border devices or between a border device and a host; however, both tunnel endpoints must support both the IPv4 and IPv6 protocol stacks.

Overlay Tunnels

Note

Overlay tunnels reduce the maximum transmission unit (MTU) of an interface by 20 octets (assuming that the basic IPv4 packet header does not contain optional fields). A network that uses overlay tunnels is difficult to troubleshoot. Therefore, overlay tunnels that connect isolated IPv6 networks should not be considered a final IPv6 network architecture. The use of overlay tunnels should be considered as a transition technique toward a network that supports both the IPv4 and IPv6 protocol stacks or just the IPv6 protocol stack.

IPv6 supports GRE type of overlay tunneling. IPv6 over IPv4 GRE Tunnels can carry IPv6, Connectionless Network Service (CLNS), and many other types of packets.

GRE IPv4 Tunnel Support for IPv6 Traffic

IPv6 traffic can be carried over IPv4 GRE tunnels using the standard GRE tunneling technique that is designed to provide the services to implement any standard point-to-point encapsulation scheme. As in IPv6 manually configured tunnels, GRE tunnels are links between two points, with a separate tunnel for each link. The tunnels are not tied to a specific passenger or transport protocol but, in this case, carry IPv6 as the passenger protocol with the GRE as the carrier protocol and IPv4 or IPv6 as the transport protocol.

The primary use of GRE tunnels is for stable connections that require regular secure communication between two edge devices or between an edge device and an end system. The edge devices and the end systems must be dual-stack implementations.

Configuring GRE IPv6 Tunnels

Perform this task to configure a GRE tunnel on an IPv6 network. GRE tunnels can be configured to run over an IPv6 network layer and to transport IPv6 packets in IPv6 tunnels and IPv4 packets in IPv6 tunnels.

To configure GRE IPv6 tunnels, perform this procedure:

Before you begin

When GRE IPv6 tunnels are configured, IPv6 addresses are assigned to the tunnel source and the tunnel destination. The tunnel interface can have either IPv4 or IPv6 addresses assigned (this is not shown in the task). The host or router at each end of a configured tunnel must support both the IPv4 and IPv6 protocol stacks.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface tunnel tunnel-number

Example:

Device(config)# interface tunnel 0

Specifies a tunnel interface and number, and enters interface configuration mode.

Step 4

ipv6 address ipv6-prefix / prefix-length [eui-64 ]

Example:

Device(config-if)# ipv6 address 3ffe:b00:c18:1::3/127

Specifies the IPv6 network assigned to the interface and enables IPv6 processing on the interface.

Step 5

tunnel source {ip-address | ipv6-address | interface-type interface-number }

Example:

Device(config-if)# tunnel source ethernet 0

Specifies the source IPv4 address or the source interface type and number for the tunnel interface.

- If an interface is specified, the interface must be configured with an IPv4 address.

Step 6

tunnel destination {host-name | ip-address | ipv6-address }

Example:

Device(config-if)# tunnel destination 2001:DB8:1111:2222::1/64

Specifies the destination IPv6 address or hostname for the tunnel interface.

Step 7

tunnel mode {aurp | cayman | dvmrp | eon | gre | gre multipoint | gre ipv6 | ipip [decapsulate-any ] | iptalk | ipv6 | mpls | nos

Example:

Device(config-if)# tunnel mode gre ipv6

Specifies a GRE IPv6 tunnel.

Note

The tunnel mode gre ipv6 command specifies GRE as the encapsulation protocol for the tunnel.

Configuration Example: Tunnel Destination Address for IPv6 Tunnel

Device> enable
Device# configure terminal
Device(config)# interface Tunnel 0
Device(config-if)# ipv6 address 2001:1:1::1/48
Device(config-if)# tunnel source GigabitEthernet 0/0/0
Device(config-if)# tunnel destination 10.0.0.2
Device(config-if)# tunnel mode gre ipv6
Device(config-if)# exit
!
Device(config)# interface GigabitEthernet0/0/0
Device(config-if)# ip address 10.0.0.1 255.255.255.0
Device(config-if)# exit
!
Device(config)# ipv6 unicast-routing
Device(config)# router isis
Device(config-router)# net 49.0000.0000.000a.00

Additional References

Related Documents

Related Topic

Document Title

For complete syntax and usage information for the commands used in this chapter.

Command Reference (Catalyst 9200 Series Switches)

Feature History for IPv6 over IPv4 GRE Tunnels

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

IPv6 over IPv4 GRE Tunnels

GRE tunnels are links between two points, with a separate tunnel for each link. The tunnels are not tied to a specific passenger or transport protocol, but in this case carry IPv6 as the passenger protocol with the GRE as the carrier protocol and IPv4 or IPv6 as the transport protocol.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 8. Configuring HSRP

- Information About Hot Standby Router Protocol

- How to Configure Hot Standby Router Protocol

- Verifying HSRP Configurations

- Configuration Examples for Hot Standby Router Protocol

- Additional References for Configuring HSRP

- Feature History for HSRP

Information About Hot Standby Router Protocol

The following sections provide information about Hot Standby Router Protocol (HSRP)

- HSRP Overview

- HSRP Versions

- Multiple HSRP

- HSRP and Switch Stacks

- Configuring HSRP for IPv6

- HSRP IPv6 Virtual MAC Address Range

- HSRP IPv6 UDP Port Number

HSRP Overview

HSRP is Cisco's standard method of providing high network availability by providing first-hop redundancy for IP hosts on an IEEE 802 LAN configured with a default gateway IP address. HSRP routes IP traffic without relying on the availability of any single router. It enables a set of router interfaces to work together to present the appearance of a single virtual router or default gateway to the hosts on a LAN. When HSRP is configured on a network or segment, it provides a virtual Media Access Control (MAC) address and an IP address that is shared among a group of configured routers. HSRP allows two or more HSRP-configured routers to use the MAC address and IP network address of a virtual router. The virtual router does not exist; it represents the common target for routers that are configured to provide backup to each other. One of the routers is selected to be the active router and another to be the standby router, which assumes control of the group MAC address and IP address should the designated active router fail.

Note

Routers in an HSRP group can be any router interface that supports HSRP, including routed ports and switch virtual interfaces (SVIs).

HSRP provides high network availability by providing redundancy for IP traffic from hosts on networks. In a group of router interfaces, the active router is the router of choice for routing packets; the standby router is the router that takes over the routing duties when an active router fails or when preset conditions are met.

HSRP is useful for hosts that do not support a router discovery protocol and cannot switch to a new router when their selected router reloads or loses power. When HSRP is configured on a network segment, it provides a virtual MAC address and an IP address that is shared among router interfaces in a group of router interfaces running HSRP. The router selected by the protocol to be the active router receives and routes packets destined for the group's MAC address. For n routers running HSRP, there are n +1 IP and MAC addresses assigned.

HSRP detects when the designated active router fails, and a selected standby router assumes control of the Hot Standby group's MAC and IP addresses. A new standby router is also selected at that time. Devices running HSRP send and receive multicast UDP-based hello packets to detect router failure and to designate active and standby routers. When HSRP is configured on an interface, Internet Control Message Protocol (ICMP) redirect messages are automatically enabled for the interface.

You can configure multiple Hot Standby groups among switches and switch stacks that are operating in Layer 3 to make more use of the redundant routers.

To do so, specify a group number for each Hot Standby command group you configure for an interface. For example, you might configure an interface on switch 1 as an active router and one on switch 2 as a standby router and also configure another interface on switch 2 as an active router with another interface on switch 1 as its standby router.

The following figure shows a segment of a network configured for HSRP. Each router is configured with the MAC address and IP network address of the virtual router. Instead of configuring hosts on the network with the IP address of Router A, you configure them with the IP address of the virtual router as their default router. When Host C sends packets to Host B, it sends them to the MAC address of the virtual router. If for any reason, Router A stops transferring packets, Router B responds to the virtual IP address and virtual MAC address and becomes the active router, assuming the active router duties. Host C continues to use the IP address of the virtual router to address packets destined for Host B, which Router B now receives and sends to Host B. Until Router A resumes operation, HSRP allows Router B to provide uninterrupted service to users on Host C's segment that need to communicate with users on Host B's segment and also continues to perform its normal function of handling packets between the Host A segment and Host B.

Typical HSRP Configuration

HSRP Versions

Cisco IOS XE Fuji 16.9.x and later support these Hot Standby Router Protocol (HSRP) versions:

The switch supports these HSRP versions:

- HSRPv1- Version 1 of the HSRP, the default version of HSRP. It has these features:

- The HSRP group number can be from 0 to 255.

- HSRPv1 uses the multicast address 224.0.0.2 to send hello packets, which can conflict with Cisco Group Management Protocol (CGMP) leave processing. You cannot enable HSRPv1 and CGMP at the same time; they are mutually exclusive.

- HSRPv2- Version 2 of the HSRP has these features:

- HSRPv2 uses the multicast address 224.0.0.102 to send hello packets. HSRPv2 and CGMP leave processing are no longer mutually exclusive, and both can be enabled at the same time.

- HSRPv2 has a different packet format than HRSPv1.

A switch running HSRPv1 cannot identify the physical router that sent a hello packet because the source MAC address of the router is the virtual MAC address.

HSRPv2 has a different packet format than HSRPv1. A HSRPv2 packet uses the type-length-value (TLV) format and has a 6-byte identifier field with the MAC address of the physical router that sent the packet.

If an interface running HSRPv1 gets an HSRPv2 packet, the type field is ignored.

Multiple HSRP

The switch supports Multiple HSRP (MHSRP), an extension of HSRP that allows load sharing between two or more HSRP groups. You can configure MHSRP to achieve load-balancing and to use two or more standby groups (and paths) from a host network to a server network.

In the figure below, half the clients are configured for Router A, and half the clients are configured for Router B. Together, the configuration for Routers A and B establishes two HSRP groups. For group 1, Router A is the default active router because it has the assigned highest priority, and Router B is the standby router. For group 2, Router B is the default active router because it has the assigned highest priority, and Router A is the standby router. During normal operation, the two routers share the IP traffic load. When either router becomes unavailable, the other router becomes active and assumes the packet-transfer functions of the router that is unavailable.

Note

For MHSRP, you need to enter the standby preempt interface configuration command on the HSRP interfaces so that if a router fails and then comes back up, preemption restores load sharing.

MHSRP Load Sharing

HSRP and Switch Stacks

HSRP hello messages are generated by the active switch. If HSRP fails on the active switch, a flap in the HSRP active state might occur. This is because HSRP hello messages are not generated while a new active switch is elected and initialized, and the standby router might become active after the active switch fails.

Configuring HSRP for IPv6

Switches running the support the Hot Standby Router Protocol (HSRP) for IPv6. HSRP provides routing redundancy for routing IPv6 traffic not dependent on the availability of any single router. IPv6 hosts learn of available routers through IPv6 neighbor discovery router advertisement messages. These messages are multicast periodically or are solicited by hosts.

An HSRP IPv6 group has a virtual MAC address that is derived from the HSRP group number and a virtual IPv6 link-local address that is, by default, derived from the HSRP virtual MAC address.

Periodic messages are sent for the HSRP virtual IPv6 link-local address when the HSRP group is active. These messages stop after a final one is sent when the group leaves the active state.

Note

When configuring HSRP for IPv6, you must enable HSRP version 2 (HSRPv2) on the interface.

HSRP IPv6 Virtual MAC Address Range

HSRP IPv6 uses a different virtual MAC address block than does HSRP for IP:

0005.73A0.0000 through 0005.73A0.0FFF (4096 addresses)

HSRP IPv6 UDP Port Number

Port number 2029 has been assigned to HSRP IPv6.

How to Configure Hot Standby Router Protocol

The following sections provide configuration information about HSRP.

- Default HSRP Configuration

- HSRP Configuration Guidelines

- Enabling HSRP

- Enabling and Verifying an HSRP Group for IPv6 Operation

- Configuring HSRP Priority

- Configuring MHSRP

- Configuring HSRP Authentication and Timers

- Enabling HSRP Support for ICMP Redirect Messages

- Configuring HSRP Groups and Clustering

Default HSRP Configuration

Default HSRP Configuration

Feature

Default Setting

HSRP version

Version 1

HSRP groups

None configured

Standby group number

0

Standby MAC address

System assigned as: 0000.0c07.acXX, where XX is the HSRP group number

Standby priority

100

Standby delay

0 (no delay)

Standby track interface priority

10

Standby hello time

3 seconds

Standby holdtime

10 seconds

HSRP Configuration Guidelines

- HSRPv2 and HSRPv1 are mutually exclusive. HSRPv2 is not interoperable with HSRPv1 on an interface and the reverse.

- In the procedures, the specified interface must be one of these Layer 3 interfaces:

- Routed port: A physical port configured as a Layer 3 port by entering the no switchport command in interface configuration mode.

- SVI: A VLAN interface created by using the interface vlan vlan_id in global configuration mode, and by default a Layer 3 interface.

- Etherchannel port channel in Layer 3 mode: A port-channel logical interface created by using the interface port-channel port-channel-number in global configuration mode, and binding the Ethernet interface into the channel group.

- All Layer 3 interfaces must have IP addresses assigned to them.

- HSRP millisecond timers are not supported.

Enabling HSRP

The standby ip interface configuration command activates HSRP on the configured interface. If an IP address is specified, that address is used as the designated address for the Hot Standby group. If no IP address is specified, the address is learned through the standby function. You must configure at least one Layer 3 port on the LAN with the designated address. Configuring an IP address always overrides another designated address currently in use.

When the standby ip command is enabled on an interface and proxy ARP is enabled, if the interface's Hot Standby state is active, proxy ARP requests are answered using the Hot Standby group MAC address. If the interface is in a different state, proxy ARP responses are suppressed.

Procedure

Step 1

configure terminal

Example:

Device(config)# configure terminal

Enters global configuration mode.

Step 2

interface interface-id

Example:

Device(config)# interface gigabitethernet1/0/1

Enters interface configuration mode, and enter the Layer 3 interface on which you want to enable HSRP.

Step 3

standby version {1 | 2}

Example:

Device(config-if)# standby version 1

(Optional) Configures the HSRP version on the interface.

- 1- Selects HSRPv1.

- 2- Selects HSRPv2.

If you do not enter this command or do not specify a keyword, the interface runs the default HSRP version, HSRP v1.

Step 4

standby [group-number] ip [ip-address [secondary]]

Example:

Device(config-if)# standby 1 ip

Creates (or enable) the HSRP group using its number and virtual IP address.

- (Optional) group-number- The group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number.

- (Optional on all but one interface) ip-address- The virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces.

- (Optional) secondary - The IP address is a secondary hot standby router interface. If neither router is designated as a secondary or standby router and no priorities are set, the primary IP addresses are compared and the higher IP address is the active router, with the next highest as the standby router.

Step 5

end

Example:

Device(config-if)# end

Returns to privileged EXEC mode

Step 6

show standby [interface-id [group]]

Example:

Device# show standby

Verifies the configuration of the standby groups.

Step 7

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Enabling and Verifying an HSRP Group for IPv6 Operation

In this task, when you enter the standby ipv6 command, a link-local address is generated from the link-local prefix, and a modified EUI-64 format interface identifier is generated in which the EUI-64 interface identifier is created from the relevant HSRP virtual MAC address.

A link-local address is an IPv6 unicast address that can be automatically configured on any interface using the link-local prefix FE80::/10 (1111 1110 10) and the interface identifier in the modified EUI-64 format. Link-local addresses are used in the stateless autoconfiguration process. Nodes on a local link can use link-local addresses to communicate; the nodes do not need site-local or globally unique addresses to communicate.

In IPv6, a device on the link advertises in RA messages any site-local and global prefixes, and its willingness to function as a default device for the link. RA messages are sent periodically and in response to router solicitation messages, which are sent by hosts at system startup.

A node on the link can automatically configure site-local and global IPv6 addresses by appending its interface identifier (64 bits) to the prefixes (64 bits) included in the RA messages. The resulting 128-bit IPv6 addresses configured by the node are then subjected to duplicate address detection to ensure their uniqueness on the link. If the prefixes advertised in the RA messages are globally unique, then the IPv6 addresses configured by the node are also guaranteed to be globally unique. Router solicitation messages, which have a value of 133 in the Type field of the ICMP packet header, are sent by hosts at system startup so that the host can immediately autoconfigure without needing to wait for the next scheduled RA message.

To enabling and verifying an HSRP group for IPv6, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 unicast-routing

Example:

Device(config)# ipv6 unicast-routing

Enables the forwarding of IPv6 unicast datagrams.

- The ipv6 unicast-routing command must be enabled for HSRP for IPv6 to work.

Step 4

interface type number

Example:

Device(config)# interface GigabitEthernet 0/0/0

Specifies an interface type and number, and places the device in interface configuration mode.

Step 5

standby [group-number ] ipv6 {link-local-address | autoconfig }

Example:

Device(config-if)# standby 1 ipv6 autoconfig

Activates the HSRP in IPv6.

Step 6

standby [group-number ] preempt [delay minimum seconds | reload seconds | sync seconds ]

Example:

Device(config-if)# standby 1 preempt

Configures HSRP preemption and preemption delay.

Step 7

standby [group-number ] priority priority

Example:

Device(config-if)# standby 1 priority 110

Configures HSRP priority.

Step 8

exit

Example:

Device(config-if)# exit

Returns the device to privileged EXEC mode.

Step 9

show standby [type number [group ]] [all | brief ]

Example:

Device# show standby

Displays HSRP information.

Step 10

show ipv6 interface [brief ] [interface-type interface-number ] [prefix ]

Example:

Device# show ipv6 interface GigabitEthernet 0/0/0

Displays the usability status of interfaces configured for IPv6.

Configuring HSRP Priority

The standby priority, standby preempt, and standby track interface configuration commands are all used to set characteristics for finding active and standby routers and behavior regarding when a new active router takes over.

When configuring HSRP priority, follow these guidelines:

- Assigning a priority allows you to select the active and standby routers. If preemption is enabled, the router with the highest priority becomes the active router. If priorities are equal, the current active router does not change.

- The highest number (1 to 255) represents the highest priority (most likely to become the active router).

- When setting the priority, preempt, or both, you must specify at least one keyword (priority, preempt, or both)

- The priority of the device can change dynamically if an interface is configured with the standby track command and another interface on the router goes down.

- The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and is useful for tracking interfaces that are not configured for HSRP. When a tracked interface fails, the hot standby priority on the device on which tracking has been configured decreases by 10. If an interface is not tracked, its state changes do not affect the hot standby priority of the configured device. For each interface configured for hot standby, you can configure a separate list of interfaces to be tracked.

- The standby track interface-priority interface configuration command specifies how much to decrement the hot standby priority when a tracked interface goes down. When the interface comes back up, the priority is incremented by the same amount.

- When multiple tracked interfaces are down and interface-priority values have been configured, the configured priority decrements are cumulative. If tracked interfaces that were not configured with priority values fail, the default decrement is 10, and it is noncumulative.

- When routing is first enabled for the interface, it does not have a complete routing table. If it is configured to preempt, it becomes the active router, even though it is unable to provide adequate routing services. To solve this problem, configure a delay time to allow the router to update its routing table.

Beginning in privileged EXEC mode, use one or more of these steps to configure HSRP priority characteristics on an interface:

Procedure

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface interface-id

Example:

Device(config)# interface gigabitethernet1/0/1

Enters interface configuration mode, and enter the HSRP interface on which you want to set priority.

Step 3

standby [group-number] priority priority

Example:

Device(config-if)# standby 120 priority 50

Sets a priority value used in choosing the active router. The range is 1 to 255; the default priority is 100. The highest number represents the highest priority.
(Optional) group-number—The group number to which the command applies.

Use the no form of the command to restore the default values.

Step 4

standby [group-number] preempt [delay [minimum seconds] [reload seconds] [sync seconds]]

Example:

Device(config-if)# standby 1 preempt delay 300

Configures the router to preempt, which means that when the local router has a higher priority than the active router, it becomes the active router.

- (Optional) group-number-The group number to which the command applies.

- (Optional) delay minimum—Set to cause the local router to postpone taking over the active role for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

- (Optional) delay reload—Set to cause the local router to postpone taking over the active role after a reload for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over after a reload).

- (Optional) delay sync—Set to cause the local router to postpone taking over the active role so that IP redundancy clients can reply (either with an ok or wait reply) for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

Use the no form of the command to restore the default values.

Step 5

standby [group-number] track type number [interface-priority]

Example:

Device(config-if)# standby track interface gigabitethernet1/1/1

Configures an interface to track other interfaces so that if one of the other interfaces goes down, the device's Hot Standby priority is lowered.

- (Optional) group-number- The group number to which the command applies.

- type- Enter the interface type (combined with interface number) that is tracked.

- number- Enter the interface number (combined with interface type) that is tracked.

- (Optional) interface-priority- Enter the amount by which the hot standby priority for the router is decremented or incremented when the interface goes down or comes back up. The default value is 10.

Step 6

end

Example:

Device(config-if)# end

Returns to privileged EXEC mode.

Step 7

show running-config

Verifies the configuration of the standby groups.

Step 8

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring MHSRP

To enable MHSRP and load-balancing, you configure two routers as active routers for their groups, with virtual routers as standby routers as shown in the MHSRP Load Sharing figure in the Multiple HSRP section. You need to enter the standby preempt interface configuration command on each HSRP interface so that if a router fails and comes back up, the preemption occurs and restores load-balancing.

Router A is configured as the active router for group 1, and Router B is configured as the active router for group 2. The HSRP interface for Router A has an IP address of 10.0.0.1 with a group 1 standby priority of 110 (the default is 100). The HSRP interface for Router B has an IP address of 10.0.0.2 with a group 2 standby priority of 110.

Group 1 uses a virtual IP address of 10.0.0.3 and group 2 uses a virtual IP address of 10.0.0.4.

- Configuring Router A

- Configuring Router B

Configuring Router A

Procedure

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface type number

Example:

Device(config)# interface gigabitethernet1/0/1

Configures an interface type and enters interface configuration mode.

Step 3

no switchport

Example:

Device(config)# no switchport

Switches an interface that is in Layer 2 mode into Layer 3 mode for Layer 3 configuration.

Step 4

ip address ip-address mask

Example:

Device(config-if)# ip address 10.0.0.1 255.255.255.0

Specifies an IP address for an interface.

Step 5

standby [group-number] ip [ip-address [secondary]]

Example:

Device(config-if)# standby 1 ip 10.0.0.3

Creates the HSRP group using its number and virtual IP address.

- (Optional) group-number- The group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number.

- (Optional on all but one interface) ip-address- The virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces.

- (Optional) secondary - The IP address is a secondary hot standby router interface. If neither router is designated as a secondary or standby router and no priorities are set, the primary IP addresses are compared and the higher IP address is the active router, with the next highest as the standby router.

Step 6

standby [group-number] priority priority

Example:

Device(config-if)# standby 1 priority 110

Sets a priority value used in choosing the active router. The range is 1 to 255; the default priority is 100. The highest number represents the highest priority.
(Optional) group-number—The group number to which the command applies.

Use the no form of the command to restore the default values.

Step 7

standby [group-number] preempt [delay [minimum seconds] [reload seconds] [sync seconds]]

Example:

Device(config-if)# standby 1 preempt delay 300

Configures the router to preempt, which means that when the local router has a higher priority than the active router, it becomes the active router.

- (Optional) group-number-The group number to which the command applies.

- (Optional) delay minimum—Set to cause the local router to postpone taking over the active role for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

- (Optional) delay reload—Set to cause the local router to postpone taking over the active role after a reload for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over after a reload)

.

- (Optional) delay sync—Set to cause the local router to postpone taking over the active role so that IP redundancy clients can reply (either with an ok or wait reply) for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

Use the no form of the command to restore the default values.

Step 8

standby [group-number] ip [ip-address [secondary]]

Example:

Device(config-if)# standby 2 ip 10.0.0.4

Creates the HSRP group using its number and virtual IP address.

- (Optional) group-number- The group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number.

- (Optional on all but one interface) ip-address- The virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces.

- (Optional) secondary - The IP address is a secondary hot standby router interface. If neither router is designated as a secondary or standby router and no priorities are set, the primary IP addresses are compared and the higher IP address is the active router, with the next highest as the standby router.

Step 9

standby [group-number] preempt [delay [minimum seconds] [reload seconds] [sync seconds]]

Example:

Device(config-if)# standby 2 preempt delay 300

Configures the router to preempt, which means that when the local router has a higher priority than the active router, it becomes the active router.

- (Optional) group-number-The group number to which the command applies.

- (Optional) delay minimum—Set to cause the local router to postpone taking over the active role for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

- (Optional) delay reload—Set to cause the local router to postpone taking over the active role after a reload for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over after a reload).

- (Optional) delay sync—Set to cause the local router to postpone taking over the active role so that IP redundancy clients can reply (either with an ok or wait reply) for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

Use the no form of the command to restore the default values.

Step 10

end

Example:

Device(config-if)# end

Returns to privileged EXEC mode.

Step 11

show running-config

Verifies the configuration of the standby groups.

Step 12

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring Router B

Procedure

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface type number

Example:

Device(config)# interface gigabitethernet1/0/1

Configures an interface type and enters interface configuration mode.

Step 3

no switchport

Example:

Device(config)# no switchport

Switches an interface that is in Layer 2 mode into Layer 3 mode for Layer 3 configuration.

Step 4

ip address ip-address mask

Example:

Device(config-if)# ip address 10.0.0.2 255.255.255.0

Specifies an IP address for an interface.

Step 5

standby [group-number] ip [ip-address [secondary]]

Example:

Device(config-if)# standby 1 ip 10.0.0.3

Creates the HSRP group using its number and virtual IP address.

- (Optional) group-number- The group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number.

- (Optional on all but one interface) ip-address- The virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces.

- (Optional) secondary - The IP address is a secondary hot standby router interface. If neither router is designated as a secondary or standby router and no priorities are set, the primary IP addresses are compared and the higher IP address is the active router, with the next highest as the standby router.

Step 6

standby [group-number] priority priority

Example:

Device(config-if)# standby 2 priority 110

Sets a priority value used in choosing the active router. The range is 1 to 255; the default priority is 100. The highest number represents the highest priority.
(Optional) group-number—The group number to which the command applies.

Use the no form of the command to restore the default values.

Step 7

standby [group-number] preempt [delay [minimum seconds] [reload seconds] [sync seconds]]

Example:

Device(config-if)# standby 1 preempt delay 300

Configures the router to preempt, which means that when the local router has a higher priority than the active router, it becomes the active router.

- (Optional) group-number-The group number to which the command applies.

- (Optional) delay minimum—Set to cause the local router to postpone taking over the active role for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

- (Optional) delay reload—Set to cause the local router to postpone taking over the active role after a reload for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over after a reload).

- (Optional) delay sync—Set to cause the local router to postpone taking over the active role so that IP redundancy clients can reply (either with an ok or wait reply) for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

Use the no form of the command to restore the default values.

Step 8

standby [group-number] ip [ip-address [secondary]]

Example:

Device(config-if)# standby 2 ip 10.0.0.4

Creates the HSRP group using its number and virtual IP address.

- (Optional) group-number- The group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number.

- (Optional on all but one interface) ip-address- The virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces.

- (Optional) secondary - The IP address is a secondary hot standby router interface. If neither router is designated as a secondary or standby router and no priorities are set, the primary IP addresses are compared and the higher IP address is the active router, with the next highest as the standby router.

Step 9

standby [group-number] preempt [delay [minimum seconds] [reload seconds] [sync seconds]]

Example:

Device(config-if)# standby 2 preempt delay 300

Configures the router to preempt, which means that when the local router has a higher priority than the active router, it becomes the active router.

- (Optional) group-number-The group number to which the command applies.

- (Optional) delay minimum—Set to cause the local router to postpone taking over the active role for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over)

.

- (Optional) delay reload—Set to cause the local router to postpone taking over the active role after a reload for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over after a reload).

- (Optional) delay sync—Set to cause the local router to postpone taking over the active role so that IP redundancy clients can reply (either with an ok or wait reply) for the number of seconds shown. The range is 0 to 3600 seconds (1 hour); the default is 0 (no delay before taking over).

Use the no form of the command to restore the default values.

Step 10

end

Example:

Device(config-if)# end

Returns to privileged EXEC mode.

Step 11

show running-config

Verifies the configuration of the standby groups.

Step 12

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring HSRP Authentication and Timers

You can optionally configure an HSRP authentication string or change the hello-time interval and hold-time interval.

When configuring these attributes, follow these guidelines:

- The authentication string is sent unencrypted in all HSRP messages. You must configure the same authentication string on all routers and access servers on a cable to ensure interoperation. Authentication mismatch prevents a device from learning the designated Hot Standby IP address and timer values from other routers configured with HSRP.

- Routers or access servers on which standby timer values are not configured can learn timer values from the active or standby router. The timers configured on an active router always override any other timer settings.

- All routers in a Hot Standby group should use the same timer values. Normally, the holdtime is greater than or equal to 3 times the hellotime.

Beginning in privileged EXEC mode, use one or more of these steps to configure HSRP authentication and timers on an interface:

Procedure

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface interface-id

Example:

Device(config) # interface gigabitethernet1/0/1

Enters interface configuration mode, and enter the HSRP interface on which you want to set priority.

Step 3

standby [group-number] authentication string

Example:

Device(config-if) # standby 1 authentication word

(Optional) authentication string—Enter a string to be carried in all HSRP messages. The authentication string can be up to eight characters in length; the default string is cisco.
(Optional) group-number—The group number to which the command applies.

Step 4

standby [group-number] timers hellotime holdtime

Example:

Device(config-if) # standby 1 timers 5 15

(Optional) Configure the time interval to send and receive hello packets.

- group-number—The group number to which the command applies.

- hellotime —Set the interval between successive hello packets in seconds. The range is 1 to 255 seconds. The default is 3.

- holdtime—Set the interval to wait for a hello packet from a neighbor device before declaring the neighbor device as inactive. The range is 1 to 255 seconds. The default is 10.

Step 5

end

Example:

Device(config-if)# end

Returns to privileged EXEC mode.

Step 6

show running-config

Verifies the configuration of the standby groups.

Step 7

copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Enabling HSRP Support for ICMP Redirect Messages

ICMP redirect messages are automatically enabled on interfaces configured with HSRP. ICMP is a network layer Internet protocol that provides message packets to report errors and other information relevant to IP processing. ICMP provides diagnostic functions, such as sending and directing error packets to the host. This feature filters outgoing ICMP redirect messages through HSRP, in which the next hop IP address might be changed to an HSRP virtual IP address. For more information, see the Cisco IOS IP Configuration Guide, Release 12.4.

Configuring HSRP Groups and Clustering

When a device is participating in an HSRP standby routing and clustering is enabled, you can use the same standby group for command switch redundancy and HSRP redundancy. Use the cluster standby-group HSRP-group-name [routing-redundancy] global configuration command to enable the same HSRP standby group to be used for command switch and routing redundancy. If you create a cluster with the same HSRP standby group name without entering the routing-redundancy keyword, HSRP standby routing is disabled for the group.

Verifying HSRP Configurations

From privileged EXEC mode, use this command to display HSRP settings:

show standby [ interface-id [ group]] [ brief] [ detail]

You can display HSRP information for the whole switch, for a specific interface, for an HSRP group, or for an HSRP group on an interface. You can also specify whether to display a concise overview of HSRP information or detailed HSRP information. The default display is detail . If there are a large number of HSRP groups, using the show standby command without qualifiers can result in an unwieldy display.

Example

Switch #show standby
VLAN1 - Group 1
Local state is Standby, priority 105, may preempt
Hellotime 3 holdtime 10
Next hello sent in 00:00:02.182
Hot standby IP address is 172.20.128.3 configured
Active router is 172.20.128.1 expires in 00:00:09
Standby router is local
Standby virtual mac address is 0000.0c07.ac01
Name is bbb

VLAN1 - Group 100
Local state is Standby, priority 105, may preempt
Hellotime 3 holdtime 10
Next hello sent in 00:00:02.262
Hot standby IP address is 172.20.138.51 configured
Active router is 172.20.128.1 expires in 00:00:09
Active router is local
Standby router is unknown expired
Standby virtual mac address is 0000.0c07.ac64
Name is test

Configuration Examples for Hot Standby Router Protocol

The following sections provide various configuration examples for HSRP.

- Enabling HSRP: Example

- Example: Configuration and Verification for an HSRP Group

- Configuring HSRP Priority: Example

- Configuring MHSRP: Example

- Configuring HSRP Authentication and Timer: Example

- Configuring HSRP Groups and Clustering: Example

Enabling HSRP: Example

This example shows how to activate HSRP for group 1 on an interface. The IP address used by the hot standby group is learned by using HSRP.

Note

This procedure is the minimum number of steps required to enable HSRP. Other configurations are optional.

Switch # configure terminal
Switch(config) # interface gigabitethernet1/0/1
Switch(config-if)# no switchport
Switch(config-if)# standby 1 ip
Switch(config-if)# end
Switch # show standby

Example: Configuration and Verification for an HSRP Group

The following example shows configuration and verification for an HSRP group for IPv6 that consists of Device1 and Device2. The show standby command is issued for each device to verify the device's configuration:

Device 1 configuration

interface FastEthernet0/0.100
description DATA VLAN for PCs
encapsulation dot1Q 100
ipv6 address 2001:DB8:CAFE:2100::BAD1:1010/64
standby version 2
standby 101 priority 120
standby 101 preempt delay minimum 30
standby 101 authentication ese
standby 101 track Serial0/1/0.17 90
standby 201 ipv6 autoconfig
standby 201 priority 120
standby 201 preempt delay minimum 30
standby 201 authentication ese
standby 201 track Serial0/1/0.17 90
Device1# show standby
FastEthernet0/0.100 - Group 101 (version 2)
State is Active
2 state changes, last state change 5w5d
Active virtual MAC address is 0000.0c9f.f065
Local virtual MAC address is 0000.0c9f.f065 (v2 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.296 secs
Authentication text "ese"
Preemption enabled, delay min 30 secs
Active router is local
Priority 120 (configured 120)
Track interface Serial0/1/0.17 state Up decrement 90
IP redundancy name is "hsrp-Fa0/0.100-101" (default)
FastEthernet0/0.100 - Group 201 (version 2)
State is Active
2 state changes, last state change 5w5d
Virtual IP address is FE80::5:73FF:FEA0:C9
Active virtual MAC address is 0005.73a0.00c9
Local virtual MAC address is 0005.73a0.00c9 (v2 IPv6 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.428 secs
Authentication text "ese"
Preemption enabled, delay min 30 secs
Active router is local
Standby router is FE80::20F:8FFF:FE37:3B70, priority 100 (expires in 7.856 sec)
Priority 120 (configured 120)
Track interface Serial0/1/0.17 state Up decrement 90
IP redundancy name is "hsrp-Fa0/0.100-201" (default)

Device 2 configuration

interface FastEthernet0/0.100
description DATA VLAN for Computers
encapsulation dot1Q 100
ipv6 address 2001:DB8:CAFE:2100::BAD1:1020/64
standby version 2
standby 101 preempt
standby 101 authentication ese
standby 201 ipv6 autoconfig
standby 201 preempt
standby 201 authentication ese
Device2# show standby
FastEthernet0/0.100 - Group 101 (version 2)
State is Standby
7 state changes, last state change 5w5d
Active virtual MAC address is 0000.0c9f.f065
Local virtual MAC address is 0000.0c9f.f065 (v2 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.936 secs
Authentication text "ese"
Preemption enabled
MAC address is 0012.7fc6.8f0c
Standby router is local
Priority 100 (default 100)
IP redundancy name is "hsrp-Fa0/0.100-101" (default)
FastEthernet0/0.100 - Group 201 (version 2)
State is Standby
7 state changes, last state change 5w5d
Virtual IP address is FE80::5:73FF:FEA0:C9
Active virtual MAC address is 0005.73a0.00c9
Local virtual MAC address is 0005.73a0.00c9 (v2 IPv6 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.936 secs
Authentication text "ese"
Preemption enabled
Active router is FE80::212:7FFF:FEC6:8F0C, priority 120 (expires in 7.548 sec)
MAC address is 0012.7fc6.8f0c
Standby router is local
Priority 100 (default 100)
IP redundancy name is "hsrp-Fa0/0.100-201" (default)

Configuring HSRP Priority: Example

This example activates a port, sets an IP address and a priority of 120 (higher than the default value), and waits for 300 seconds (5 minutes) before attempting to become the active router:

Switch # configure terminal
Switch(config) # interface gigabitethernet1/0/1
Switch(config-if)# no switchport
Switch(config-if)# standby ip 172.20.128.3
Switch(config-if)# standby priority 120 preempt delay 300
Switch(config-if)# end
Switch # show standby

Configuring MHSRP: Example

This example shows how to enable the MHSRP configuration shown in the figure MHSRP Load Sharing

Router A Configuration

Switch # configure terminal
Switch(config) # interface gigabitethernet1/0/1
Switch(config-if)# no switchport
Switch(config-if)# ip address 10.0.0.1 255.255.255.0
Switch(config-if)# standby ip 10.0.0.3
Switch(config-if)# standby 1 priority 110
Switch(config-if)#  standby 1 preempt
Switch(config-if)# standby 2 ip 10.0.0.4
Switch(config-if)#  standby 2 preempt
Switch(config-if)# end

Router B Configuration

Switch # configure terminal
Switch(config) # interface gigabitethernet1/0/1
Switch(config-if)# no switchport
Switch(config-if)# ip address 10.0.0.2 255.255.255.0
Switch(config-if)# standby ip 10.0.0.3
Switch(config-if)#  standby 1 preempt
Switch(config-if)# standby 2 ip 10.0.0.4
Switch(config-if)# standby 2 priority 110
Switch(config-if)#  standby 2 preempt
Switch(config-if)# end

Configuring HSRP Authentication and Timer: Example

This example shows how to configure word as the authentication string required to allow Hot Standby routers in group 1 to interoperate:

Switch # configure terminal
Switch(config) # interface gigabitethernet1/0/1
Switch(config-if)# no switchport
Switch(config-if)# standby 1 authentication word
Switch(config-if)# end

This example shows how to set the timers on standby group 1 with the time between hello packets at 5 seconds and the time after which a router is considered down to be 15 seconds:

Switch # configure terminal
Switch(config) # interface gigabitethernet1/0/1
Switch(config-if)# no switchport
Switch(config-if)# standby 1 ip
Switch(config-if)# standby 1 timers 5 15
Switch(config-if)# end

Configuring HSRP Groups and Clustering: Example

This example shows how to bind standby group my_hsrp to the cluster and enable the same HSRP group to be used for command switch redundancy and router redundancy. The command can only be executed on the cluster command switch. If the standby group name or number does not exist, or if the switch is a cluster member switch, an error message appears.

Switch # configure terminal
Switch(config) # cluster standby-group my_hsrp routing-redundancy
Switch(config-if)# end

Additional References for Configuring HSRP

Related Documents

Related Topic

Document Title

For complete syntax and usage information for the commands used in this chapter.

Command Reference (Catalyst 9200 Series Switches)

Standards and RFCs

Standard/RFC

Title

RFC 2281

Cisco Hot Standby Router Protocol

Feature History for HSRP

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

HSRP

HSRP is Cisco's standard method of providing high network availability by providing first-hop redundancy for IP hosts on an IEEE 802 LAN configured with a default gateway IP address.

Cisco IOS XE Fuji 16.9.2

HSRP for IPv6

HSRP is an FHRP designed to allow for transparent failover of the first-hop IPv6 router.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 9. VRRPv3 Protocol Support

- Restrictions for VRRPv3 Protocol Support

- Information About VRRPv3 Protocol Support

- How to Configure VRRPv3 Protocol Support

- Configuration Examples for VRRPv3 Protocol Support

- Additional References

- Feature History for VRRPv3 Protocol Support

Restrictions for VRRPv3 Protocol Support

- VRRPv3 is not intended as a replacement for existing dynamic protocols. VRRPv3 is designed for use over multi-access, multicast, or broadcast capable Ethernet LANs.

- VRRPv3 is supported on Ethernet, Fast Ethernet, Bridge Group Virtual Interface (BVI), and Gigabit Ethernet interfaces, and on VLANs.

- Because of the forwarding delay that is associated with the initialization of a BVI interface, you must not configure the VRRPv3 advertise timer to a value lesser than the forwarding delay on the BVI interface. If you configure the VRRPv3 advertise timer to a value equal to or greater than the forwarding delay on the BVI interface, the setting prevents a VRRP device on a recently initialized BVI interface from unconditionally taking over the primary role. Use the bridge forward-time command to set the forwarding delay on the BVI interface. Use the vrrp timers advertise command to set the VRRP advertisement timer.

- Full network redundancy can only be achieved if VRRP operates over the same network path as the VRRS Pathway redundant interfaces. For full redundancy, the following restrictions apply:

- VRRS pathways should not share a different physical interface as the parent VRRP group or be configured on a sub-interface having a different physical interface as the parent VRRP group.

- VRRS pathways should not be configured on Switch Virtual Interface (SVI) interfaces as long as the associated VLAN does not share the same trunk as the VLAN on which the parent VRRP group is configured.

- Interface link-local IP address and VRRP group virtual link-local IP address should be different for VRRP features to work properly.

Information About VRRPv3 Protocol Support

The following sections provide information about VRRPv3 protocol support.

- VRRPv3 Benefits

- VRRP Device Priority and Preemption

- VRRP Advertisements

VRRPv3 Benefits

Support for IPv4 and IPv6

VRRPv3 supports IPv4 and IPv6 address families while VRRPv2 only supports IPv4 addresses.

Note

When VRRPv3 is in use, VRRPv2 is unavailable. For VRRPv3 to be configurable, the fhrp version vrrp v3 command must be used in global configuration mode

Redundancy

VRRP enables you to configure multiple devices as the default gateway device, which reduces the possibility of a single point of failure in a network.

Load Sharing

You can configure VRRP in such a way that traffic to and from LAN clients can be shared by multiple devices, thereby sharing the traffic load more equitably between available devices.

Multiple Virtual Devices

VRRP supports up to 255 virtual devices (VRRP groups) on a device physical interface, subject to restrictions in scaling. Multiple virtual device support enables you to implement redundancy and load sharing in your LAN topology. In scaled environments, VRRS Pathways should be used in combination with VRRP control groups.

Multiple IP Addresses

The virtual device can manage multiple IP addresses, including secondary IP addresses. Therefore, if you have multiple subnets configured on an Ethernet interface, you can configure VRRP on each subnet.

Note

To utilize secondary IP addresses in a VRRP group, a primary address must be configured on the same group.

Preemption

The redundancy scheme of VRRP enables you to preempt a virtual device backup that has taken over for a failing primary virtual device with a higher priority virtual device backup that has become available.

Note

Preemption of a lower priority primary device is enabled with an optional delay.

Advertisement Protocol

VRRP uses a dedicated Internet Assigned Numbers Authority (IANA) standard multicast address for VRRP advertisements. For IPv4, the multicast address is 224.0.0.18. For IPv6, the multicast address is FF02:0:0:0:0:0:0:12. This addressing scheme minimizes the number of devices that must service the multicasts and allows test equipment to accurately identify VRRP packets on a segment. The IANA has assigned VRRP the IP protocol number 112.

Suport for SSO

Beginning from Cisco IOS XE Bengaluru 17.6.1, VRRPv3 supports Stateful Switchover (SSO). For VRRPv3 to support SSO, the fhrp sso command should be enabled. You can disable SSO support using the no fhrp sso command.

VRRP Device Priority and Preemption

An important aspect of the VRRP redundancy scheme is VRRP device priority. Priority determines the role that each VRRP device plays and what happens if the primary virtual device fails.

If a VRRP device owns the IP address of the virtual device and the IP address of the physical interface, this device will function as a primary virtual device.

Priority also determines if a VRRP device functions as a virtual device backup and the order of ascendancy to becoming a primary virtual device if the primary virtual device fails. You can configure the priority of each virtual device backup with a value of 1 through 254 using the priority command (use the vrrp address-family command to enter the VRRP configuration mode and access the priority option).

For example, if device A, the primary virtual device in a LAN topology, fails, an election process takes place to determine if virtual device backups B or C should take over. If devices B and C are configured with the priorities of 101 and 100, respectively, device B is elected to become primary virtual device because it has the higher priority. If devices B and C are both configured with the priority of 100, the virtual device backup with the higher IP address is elected to become the primary virtual device.

By default, a preemptive scheme is enabled whereby a higher priority virtual device backup that becomes available takes over from the virtual device backup that was elected to become primary virtual device. You can disable this preemptive scheme using the no preempt command (use the vrrp address-family command to enter the VRRP configuration mode, and enter the no preempt command). If preemption is disabled, the virtual device backup that is elected to become primary virtual device remains the primary until the original primary virtual device recovers and becomes primary again.

Note

Preemption of a lower priority primary device is enabled with an optional delay.

VRRP Advertisements

The primary virtual device sends VRRP advertisements to other VRRP devices in the same group. The advertisements communicate the priority and state of the primary virtual device. The VRRP advertisements are encapsulated into either IPv4 or IPv6 packets (based on the VRRP group configuration) and sent to the appropriate multicast address assigned to the VRRP group. For IPv4, the multicast address is 224.0.0.18. For IPv6, the multicast address is FF02:0:0:0:0:0:0:12. The advertisements are sent every second by default and the interval is configurable.

Cisco devices allow you to configure millisecond timers, which is a change from VRRPv2. You need to manually configure the millisecond timer values on both the primary and the backup devices. The primary advertisement value displayed in the show vrrp command output on the backup devices is always 1 second because the packets on the backup devices do not accept millisecond values.

You must use millisecond timers where absolutely necessary and with careful consideration and testing. Millisecond values work only under favorable circumstances. The use of the millisecond timer values is compatible with third party vendors, as long as they also support VRRPv3. You can specify a timer value between 100 milliseconds and 40000 milliseconds.

How to Configure VRRPv3 Protocol Support

The following sections provide configuration information about VRRPv3 protocol support.

- Creating and Customizing a VRRP Group

- Configuring the Delay Period Before FHRP Client Initialization

Creating and Customizing a VRRP Group

To create a VRRP group, perform the following task. Steps 6 to 14 denote customizing options for the group, and they are optional:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

fhrp version vrrp v3

Example:

Device(config)# fhrp version vrrp v3

Enables the ability to configure VRRPv3 and VRRS.

Step 4

interface type number

Example:

Device(config)# interface GigabitEthernet 0/0/0

Enters interface configuration mode.

Step 5

vrrp group-id address-family {ipv4 | ipv6}

Example:

Device(config-if)# vrrp 3 address-family ipv4

Creates a VRRP group and enters VRRP configuration mode.

Step 6

address ip-address [primary | secondary]

Example:

Device(config-if-vrrp)# address 100.0.1.10 primary

Specifies a primary or secondary address for the VRRP group.

Note

VRRPv3 for IPv6 requires that a primary virtual link-local IPv6 address is configured to allow the group to operate. After the primary link-local IPv6 address is established on the group, you can add the secondary global addresses.

Step 7

description group-description

Example:

Device(config-if-vrrp)# description group 3

(Optional) Specifies a description for the VRRP group.

Step 8

match-address

Example:

Device(config-if-vrrp)# match-address

(Optional) Matches secondary address in the advertisement packet against the configured address.

Note

Secondary address matching is enabled by default.

Step 9

preempt delay minimum seconds

Example:

Device(config-if-vrrp)# preempt delay minimum 30

(Optional) Enables preemption of lower priority primary device with an optional delay.

Note

Preemption is enabled by default.

Step 10

priority priority-level

Example:

Device(config-if-vrrp)# priority 3

(Optional) Specifies the priority value of the VRRP group.

The priority of a VRRP group is 100 by default.

Step 11

timers advertise interval

Example:

Device(config-if-vrrp)# timers advertise 1000

(Optional) Sets the advertisement timer in milliseconds.

The advertisement timer is set to 1000 milliseconds by default.

Step 12

vrrpv2

Example:

Device(config-if-vrrp)# vrrpv2

(Optional) Enables support for VRRPv2 configured devices in compatibility mode.

Step 13

vrrs leader vrrs-leader-name

Example:

Device(config-if-vrrp)# vrrs leader leader-1

(Optional) Specifies a leader's name to be registered with VRRS and to be used by followers.

Note

A registered VRRS name is unavailable by default.

Step 14

shutdown

Example:

Device(config-if-vrrp)# shutdown

(Optional) Disables VRRP configuration for the VRRP group.

Note

VRRP configuration is enabled for a VRRP group by default.

Step 15

end

Example:

Device(config)# end

Returns to privileged EXEC mode.

Configuring the Delay Period Before FHRP Client Initialization

To configure the delay period before the initialization of all FHRP clients on an interface, perform the following task:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

fhrp version vrrp v3

Example:

Device(config)# fhrp version vrrp v3

Enables the ability to configure VRRPv3 and VRRS.

Step 4

interface type number

Example:

Device(config)# interface GigabitEthernet 0/0/0

Enters interface configuration mode.

Step 5

fhrp delay {[minimum] [reload] seconds}

Example:

Device(config-if)# fhrp delay minimum 5

Specifies the delay period for the initialization of FHRP clients after an interface comes up.

The range is 0-3600 seconds.

Step 6

end

Example:

Device(config)# end

Returns to privileged EXEC mode.

Configuration Examples for VRRPv3 Protocol Support

The following sections provide configuration examples for VRRPv3 protocol support.

- Example: Enabling VRRPv3 on a Device

- Example: Creating and Customizing a VRRP Group

- Example: Configuring the Delay Period Before FHRP Client Initialization

- Example: VRRP Status, Configuration, and Statistics Details

Example: Enabling VRRPv3 on a Device

The following example shows how to enable VRRPv3 on a device:

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config-if-vrrp)# end

Example: Creating and Customizing a VRRP Group

The following example shows how to create and customize a VRRP group:

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config)# interface GigabitEthernet 1/0/1
Device(config-if)# vrrp 3 address-family ipv4
Device(config-if-vrrp)# address 100.0.1.10 primary
Device(config-if-vrrp)# description group 3
Device(config-if-vrrp)# match-address
Device(config-if-vrrp)# preempt delay minimum 30
Device(config-if-vrrp)# end

Note

In the above example, the fhrp version vrrp v3 command is used in the global configuration mode.

Example: Configuring the Delay Period Before FHRP Client Initialization

The following example shows how to configure the delay period before FHRP client initialization :

Device> enable
Device# configure terminal
Device(config)# fhrp version vrrp v3
Device(config)# interface GigabitEthernet 1/0/1
Device(config-if)# fhrp delay minimum 5
Device(config-if-vrrp)# end

Note

In the above example, a five-second delay period is specified for the initialization of FHRP clients after the interface comes up. You can specify a delay period between 0 and 3600 seconds.

Example: VRRP Status, Configuration, and Statistics Details

The following is a sample output of the status, configuration and statistics details for a VRRP group:

Device> enable
Device# show vrrp detail

GigabitEthernet1/0/1 - Group 3 - Address-Family IPv4
Description is "group 3"
State is MASTER
State duration 53.901 secs
Virtual IP address is 100.0.1.10
Virtual MAC address is 0000.5E00.0103
Advertisement interval is 1000 msec
Preemption enabled, delay min 30 secs (0 msec remaining)
Priority is 100
Master Router is 10.21.0.1 (local), priority is 100
Master Advertisement interval is 1000 msec (expires in 832 msec)
Master Down interval is unknown
VRRPv3 Advertisements: sent 61 (errors 0) - rcvd 0
VRRPv2 Advertisements: sent 0 (errors 0) - rcvd 0
Group Discarded Packets: 0
VRRPv2 incompatibility: 0
IP Address Owner conflicts: 0
Invalid address count: 0
IP address configuration mismatch : 0
Invalid Advert Interval: 0
Adverts received in Init state: 0
Invalid group other reason: 0
Group State transition:
Init to master: 0
Init to backup: 1 (Last change Sun Mar 13 19:52:56.874)
Backup to master: 1 (Last change Sun Mar 13 19:53:00.484)
Master to backup: 0
Master to init: 0
Backup to init: 0

Device# exit

Additional References

Related Documents

Related Topic

Document Title

FHRP commands

First Hop Redundancy Protocols Command Reference

Configuring VRRPv2

Configuring VRRP

VRRPv3 Commands

For complete syntax and usage information for the commands used in this chapter.

Standards and RFCs

Standard/RFC

Title

RFC5798

Virtual Router Redundancy Protocol

Feature History for VRRPv3 Protocol Support

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Bengaluru 17.6.1

SSO Support for VRRPv3

Beginning from 17.6.1, VRRPv3 supports Stateful Switchover (SSO). For VRRPv3 to support SSO, the fhrp sso command should be enabled. SSO can be disabled using the no fhrp sso command.

Cisco IOS XE Fuji 16.9.2

VRRPv3 Protocol Support

VRRP enables a group of devices to form a single virtual device to provide redundancy. The LAN clients can then be configured with the virtual device as their default gateway. The virtual device, representing a group of devices, is also known as a VRRP group. The VRRPv3 Protocol Support feature provides the capability to support IPv4 and IPv6 addresses.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 10. Configuring Enhanced Object Tracking

- Information About Enhanced Object Tracking

- How to Configure Enhanced Object Tracking

- Monitoring Enhanced Object Tracking

- Feature History for Enhanced Object Tracking

Information About Enhanced Object Tracking

The following sections provide information about enhanced object tracking.

- Enhanced Object Tracking Overview

- Tracking Interface Line-Protocol or IP Routing State

- Tracked Lists

- Tracking Other Characteristics

- IP SLAs Object Tracking

- Static Route Object Tracking

Enhanced Object Tracking Overview

Before the introduction of the Enhanced Object Tracking feature, Hot Standby Router Protocol (HSRP) had a simple tracking mechanism that allowed you to track the interface line-protocol state only. If the line-protocol state of the interface went down, the HSRP priority of the router was reduced, allowing another HSRP router with a higher priority to become active.

The Enhanced Object Tracking feature separates the tracking mechanism from HSRP and creates a separate standalone tracking process that can be used by processes other than HSRP. This feature allows the tracking of other objects in addition to the interface line-protocol state.

A client process such as HSRP, Virtual Router Redundancy Protocol (VRRP), or Gateway Load Balancing Protocol (GLBP), can register its interest in tracking objects and then be notified when the tracked object changes state.

Each tracked object has a unique number that is specified in the tracking command-line interface (CLI). Client processes use this number to track a specific object. The tracking process periodically polls the tracked object for value changes and sends any changes (as up or down values) to interested client processes, either immediately or after a specified delay. Several clients can track the same object, and can take different actions when the object changes state.

You can also track a combination of objects in a list by using either a weight threshold or a percentage threshold to measure the state of the list. You can combine objects using Boolean logic. A tracked list with a Boolean “AND” function requires that each object in the list be in an up state for the tracked object to be up. A tracked list with a Boolean “OR” function needs only one object in the list to be in the up state for the tracked object to be up.

Tracking Interface Line-Protocol or IP Routing State

You can track either the interface line protocol state or the interface IP routing state. When you track the IP routing state, these three conditions are required for the object to be up:

- IP routing must be enabled and active on the interface.

- The interface line-protocol state must be up.

- The interface IP address must be known.

If all three of these conditions are not met, the IP routing state is down.

Tracked Lists

You can configure a tracked list of objects with a Boolean expression, a weight threshold, or a percentage threshold. A tracked list contains one or more objects. An object must exist before it can be added to the tracked list.

- You configure a Boolean expression to specify calculation by using either “AND” or “OR” operators.

- When you measure the tracked list state by a weight threshold, you assign a weight number to each object in the tracked list. The state of the tracked list is determined by whether or not the threshold was met. The state of each object is determined by comparing the total weight of all objects against a threshold weight for each object.

- When you measure the tracked list by a percentage threshold, you assign a percentage threshold to all objects in the tracked list. The state of each object is determined by comparing the assigned percentages of each object to the list.

Tracking Other Characteristics

You can also use the enhanced object tracking for tracking other characteristics.

- You can track the reachability of an IP route by using the track ip route reachability global configuration command.

- You can use the track ip route metric threshold global configuration command to determine if a route is above or below threshold.

- You can use the track resolution global configuration command to change the metric resolution default values for routing protocols.

- You can use the track timer tracking configuration command to configure the tracking process to periodically poll tracked objects.

Use the show track privileged EXEC command to verify enhanced object tracking configuration.

IP SLAs Object Tracking

Cisco IOS IP Service Level Agreements (IP SLAs) is a network performance measurement and diagnostics tool that uses active monitoring by generating traffic to measure network performance. Cisco IP SLAs operations collects real-time metrics that you can use for network troubleshooting, design, and analysis.

Object tracking of IP SLAs operations allows clients to track the output from IP SLAs objects and use this information to trigger an action. Every IP SLAs operation maintains an SNMP operation return-code value, such as OK or OverThreshold, that can be interpreted by the tracking process. You can track two aspects of IP SLAs operation: state and reachability. For state, if the return code is OK, the track state is up; if the return code is not OK, the track state is down. For reachability, if the return code is OK or OverThreshold, reachability is up; if not OK, reachability is down.

Static Route Object Tracking

Static routing support using enhanced object tracking provides the ability for the device to use ICMP pings to identify when a pre-configured static route or a DHCP route goes down. When tracking is enabled, the system tracks the state of the route and informs the client when that state changes. Static route object tracking uses Cisco IP SLAs to generate ICMP pings to monitor the state of the connection to the primary gateway.

How to Configure Enhanced Object Tracking

The following sections provide configuration information about enhanced object tracking.

- Configuring Tracking for Line State Protocol or IP Routing State on an Interface

- Configuring Tracked Lists

- Configuring HSRP Object Tracking

- Configuring IP SLAs Object Tracking

- Configuring Static Route Object Tracking

Configuring Tracking for Line State Protocol or IP Routing State on an Interface

Follow these steps to track the line-protocol state or IP routing state of an interface:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

track object-number interface interface-id line-protocol

Example:

Device(config)# track 33 interface gigabitethernet 1/0/1 line-protocol

(Optional) Creates a tracking list to track the line-protocol state of an interface and enter tracking configuration mode.

- The object-number identifies the tracked object and can be from 1 to 500.

- Theinterface interface-id is the interface being tracked.

Step 4

delay { object-number up seconds [down seconds] | [up seconds] down seconds}

(Optional) Specifies a period of time in seconds to delay communicating state changes of a tracked object. The range is from 1 to 180 seconds.

Step 5

exit

Returns to global configuration mode.

Step 6

track object-number interface interface-id ip routing

Example:

Device(config)# track 33 interface gigabitethernet 1/0/1 ip routing

(Optional) Creates a tracking list to track the IP routing state of an interface and enter tracking configuration mode. IP route tracking tracks an IP route in the routing table and the ability of an interface to route IP packets.

- The object-number identifies the tracked object and can be from 1 to 500.

- Theinterface interface-id is the interface being tracked.

Step 7

delay { object-number up seconds [down seconds] | [up seconds] down seconds}

(Optional) Specifies a period of time in seconds to delay communicating state changes of a tracked object. The range is from 1 to 180 seconds.

Step 8

end

Returns to privileged EXEC mode.

Step 9

show trackobject-number

Verifies that the specified objects are being tracked.

Configuring Tracked Lists

The following sections provide configuration information about tracked lists.

- Configuring a Tracked List with a Weight Threshold

- Configuring a Tracked List with a Percentage Threshold

Configuring a Tracked List with a Weight Threshold

To track by weight threshold, configure a tracked list of objects, specify that weight is used as the threshold, and configure a weight for each of its objects. The state of each object is determined by comparing the total weight of all objects that are up against a threshold weight for each object.

You cannot use the Boolean “NOT” operator in a weight threshold list.

Follow these steps to configure a tracked list of objects by using a weight threshold and to configure a weight for each object:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

track track-number list threshold {weight}

Example:

Device(config)# track 4 list threshold weight

Configures a tracked list object, and enters tracking configuration mode. The track-number can be from 1 to 500.

- threshold—Specifies the state of the tracked list based on a threshold.

- weight— Specifies that the threshold is based on weight.

Step 4

object object-number [weight weight-number]

Example:

Device(config)#object 2 weight 15

Specifies the object to be tracked. The range is from 1 to 500. The optionalweightweight-number specifies the threshold weight for the object. The range is from 1 to 255.

Note

An object must exist before you can add it to a tracked list.

Step 5

threshold weight {up number | [down number]}

Example:

Device(config-track)# threshold weight up 30 down 10

(Optional) Specifies the threshold weight.

- upnumber— The range is from 1 to 255.

- downnumber— (Optional)The range depends on the number selected for the upnumber . If you configure the upnumber as 25, the range shown for the down number is 0 to 24.

Step 6

delay { up seconds [down seconds] | [up seconds] down seconds}

(Optional) Specifies a period of time in seconds to delay communicating state changes of a tracked object. The range is from 1 to 180 seconds.

Step 7

end

Returns to privileged EXEC mode.

Step 8

show track object-number

Verify that the specified objects are being tracked.

Step 9

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring a Tracked List with a Percentage Threshold

To track by percentage threshold, configure a tracked list of objects, specify that a percentage will be used as the threshold, and specify a percentage for all objects in the list. The state of the list is determined by comparing the assigned percentage of each object to the list.

You cannot use the Boolean “NOT” operator in a percentage threshold list.

Follow these steps to configure a tracked list of objects by using a percentage threshold:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

track track-number list threshold {percentage}

Example:

Device(config)# track 4 list threshold percentage

Configures a tracked list object, and enters tracking configuration mode. The track-number can be from 1 to 500.

- threshold—Specifies the state of the tracked list based on a threshold.

- percentage— Specifies that the threshold is based on percentage.

Step 4

object object-number

Example:

Device(config)# object 1

Specifies the object to be tracked. The range is from 1 to 500.

Note

An object must exist before you can add it to a tracked list.

Step 5

threshold percentage {up number | [downnumber]}

Example:

Device(config)# threshold percentage up 51 down 10

(Optional) Specifies the threshold percentage.

- upnumber— The range is from 1 to 100.

- downnumber— (Optional)The range depends on the number selected for the upnumber . If you configure the upnumber as 25, the range shown for the down number is 0 to 24.

Step 6

delay { up seconds [down seconds] | [up seconds] down seconds}

(Optional) Specifies a period of time in seconds to delay communicating state changes of a tracked object. The range is from 1 to 180 seconds.

Step 7

end

Returns to privileged EXEC mode.

Step 8

show track object-number

Verify that the specified objects are being tracked.

Step 9

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring HSRP Object Tracking

Follow these steps to configure a standby HSRP group to track an object and change the HSRP priority based on the object state:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

track object-number {interface interface-id {line-protocol | ip routing} | ip route ip address/prefix-length {metric threshold | reachability} list {boolean {and | or}} | {threshold {weight | percentage}}}

(Optional) Create a tracking list to track the configured state and enter tracking configuration mode.

- The object-number identifies the tracked object and can be from 1 to 500.

- Enterinterface interface-id to select an interface to track.

- Enterline-protocol to track the interface line protocol state or enter ip routing to track the interface IP routing state .

- Enterip route ip-address/prefix-length to track the state of an IP route.

- Entermetric threshold to track the threshold metric or enter reachability to track if the route is reachable.

The default up threshold is 254 and the default down threshold is 255.

- Enter list to track objects grouped in a list.

Note

Repeat this step for each interface to be tracked.

Step 4

exit

Return to global configuration mode.

Step 5

interface { interface-id

Enter interface configuration mode.

Step 6

standby [group-number] ip [ip-address secondary]]

Creates (or enables) the HSRP group by using its number and virtual IP address.

- (Optional) group-number —Enters a group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number.

- (Optional on all but one interface) ip-address —Specifies the virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces.

- (Optional) secondary —Specifies that the IP address is a secondary hot standby router interface. If this keyword is omitted, the configured address is the primary IP address.

Step 7

standby [group-number] track [object-number [decrement priority-decrement]]

Configures HSRP to track an object and change the hot standby priority based on the state of the object.

- (Optional) group-number —Enters the group number to which the tracking applies.

- object-number —Enters a number representing the object to be tracked. The range is from 1 to 500; the default is 1.

- (Optional) secondary —Specifies that the IP address is a secondary hot standby router interface. If this keyword is omitted, the configured address is the primary IP address.

- (Optional)decrementpriority-decrement —Specifies the amount by which the hot standby priority for the router is decremented (or incremented) when the tracked object goes down (or comes back up). The range is from 1 to 255; the default is 10.

Step 8

end

Returns to privileged EXEC mode.

Step 9

show standby

Verifies the standby router IP address and tracking states.

Step 10

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring IP SLAs Object Tracking

Follow these steps to track the state of an IP SLAs operation or the reachability of an IP SLAs IP host:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

track object-number ip sla operation-number {state | reachability}

Example:

Device(config)# track 2 ip sla 123 state

Enters tracking configuration mode to track the state of an IP SLAs operation.

- object-number range is from 1 to 500.

- operation-number range is from 1 to 2147483647.

Step 4

delay { upseconds [down seconds] | [up seconds] down seconds}

(Optional) Specifies a period of time in seconds to delay communicating state changes of a tracked object. The range is from 1 to 180 seconds.

Step 5

end

Returns to privileged EXEC mode.

Step 6

show track object-number

Verifies that the specified objects are being tracked.

Step 7

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring Static Route Object Tracking

The following sections provide configuration information about static route object tracking.

- Configuring a Primary Interface for Static Routing

- Configuring a Primary Interface for DHCP

- Configuring IP SLAs Monitoring Agent

- Configuring a Routing Policy and a Default Route

Configuring a Primary Interface for Static Routing

Follow these steps to configure a primary interface for static routing:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface interface-id

Selects a primary or secondary interface and enters interface configuration mode.

Step 4

description string

Adds a description to the interface.

Step 5

ip address ip-address mask [secondary]

Sets the primary or secondary IP address for the interface.

Step 6

exit

Returns to global configuration mode.

Configuring a Primary Interface for DHCP

Follow these steps to configure a primary interface for DHCP:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface interface-id

Selects a primary or secondary interface and enters interface configuration mode.

Step 4

description string

Adds a description to the interface.

Step 5

ip dhcp client route track number

Configures the DCHP client to associate any added routes with the specified track number. Valid numbers are from 1 to 500.

Step 6

exit

Returns to global configuration mode.

Configuring IP SLAs Monitoring Agent

You can configure an IP SLAs agent to ping an IP address using a primary interface and a track object to monitor the state of the agent.

Follow these steps to configure network monitoring with Cisco IP SLAs:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ip sla operation number

Begins configuring a Cisco IP SLAs operation and enters IP SLA configuration mode.

Step 4

icmp-echo { destination ip-address | destination hostname [source - ipaddr {ip-address | hostname source-interface interface-id]

Configures a Cisco IP SLAs end-to-end ICMP echo response time operation and enter IP SLAs ICMP echo configuration mode.

Step 5

timeout milliseconds

Sets the amount of time for which the operation waits for a response from its request packet.

Step 6

frequency seconds

Sets the rate at which the operation is sent into the network.

Step 7

threshold milliseconds

Sets the rising threshold (hysteresis) that generates a reaction event and stores history information for the operation.

Step 8

exit

Exits IP SLAs ICMP echo configuration mode.

Step 9

ip sla schedule operation-number [life {forever | seconds}] start-time time | pending | now | after time] ageout seconds] [recurring]

Example:

Device(config)# track 2 200 state

Configures the scheduling parameters for a single IP SLAs operation.

- object-number range is from 1 to 500.

- operation-number range is from 1 to 2147483647.

Step 10

track object-number rtr operation-number state reachability

Tracks the state of a Cisco IOS IP SLAs operation and enter tracking configuration mode.

Step 11

end

Returns to privileged EXEC mode.

Step 12

show track object-number

Verifies that the specified objects are being tracked.

Step 13

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring a Routing Policy and a Default Route

Follow these steps to configure a routing policy for backup static routing by using object tracking.

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

access-list access-list-number

Defines an extended IP access list. Configure any optional characteristics.

Step 4

route-map map tag [permit | deny] [sequence-number]

Enters route-map configuration mode and define conditions for redistributing routes from one routing protocol to another.

Step 5

match ip address {access-list number [permit|deny] [sequence-number]

Distribute any routes that have a destination network number address that is permitted by a standard or extended access list or performs policy routing on packets. You can enter multiple numbers or names.

Step 6

set ip next-hop dynamic dhcp

For DHCP networks only. Sets the next hop to the gateway that was most recently learned by the DHCP client.

Step 7

set interface interface-id

For static routing networks only. Indicates where to send output packets that pass a match clause of a route map for policy routing.

Step 8

exit

Returns to global configuration mode.

Step 9

ip local policy route-map map tag

Identifies a route map to use for local policy routing.

Step 10

ip route prefix mask {ip address | interface-id [ip address]} [distance] [name] [permanent | track track-number] [tag tag]

For static routing networks only. Establishes static routes. Entering tracktrack-number specifies that the static route is installed only if the configured track object is up.

Step 11

end

Returns to privileged EXEC mode.

Step 12

show ip route track table

Displays information about the IP route track table.

Step 13

copy running-config startup-config

Example:

Device# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Monitoring Enhanced Object Tracking

Use the privileged EXEC or user EXEC commands in the table below, to display enhanced object tracking information.

Commands for Displaying Tracking Information

Command

Purpose

show ip route track table

Displays information about the IP route track table.

show track [object-number]

Displays information about the all tracking lists or the specified list.

show track brief

Displays VTP status and configuration for all interfaces or the specified interface.

show track interface [brief]

Displays information about tracked interface objects.

show track ip [object-number] [brief] route

Displays information about tracked IP-route objects

show track resolution

Displays the resolution of tracked parameters.

show track timer

Displays tracked polling interval timers.

Feature History for Enhanced Object Tracking

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

Enhanced Object Tracking

Enhanced object tracking allows advanced tracking compared to HSRP that allows interface line-protocol state tracking only.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 11. Configuring TCP MSS Adjustment

- Restrictions for TCP MSS Adjustment

- Information about TCP MSS Adjustment

- How to Configure TCP MSS Adjustment

- Configuration Examples for TCP MSS Adjustment

- Feature History for TCP MSS Adjustment

Restrictions for TCP MSS Adjustment

- Subinterfaces do not support TCP MSS Adjust.

- TCP MSS adjustment configuration works only if applied on an ingress interface. This configuration does not work if applied on an egress interface.

Information about TCP MSS Adjustment

The Transmission Control Protocol (TCP) Maximum Segment Size (MSS) Adjustment feature enables the configuration of the maximum segment size for transient packets that traverse a router, specifically TCP segments with the SYN bit set. Use the ip tcp adjust-mss command in interface configuration mode to specify the MSS value on the intermediate router of the SYN packets to avoid truncation.

When a host (usually a PC) initiates a TCP session with a server, it negotiates the IP segment size by using the MSS option field in the TCP SYN packet. The value of the MSS field is determined by the MTU configuration on the host. The default MSS value for a PC is 1500 bytes.

The PPP over Ethernet (PPPoE) standard supports an MTU of only 1492 bytes. The disparity between the host and PPPoE MTU size can cause the router in between the host and the server to drop 1500-byte packets and terminate TCP sessions over the PPPoE network. Even if the path MTU (which detects the correct MTU across the path) is enabled on the host, sessions may be dropped because system administrators sometimes disable the ICMP error messages that must be relayed from the host in order for path MTU to work.

The ip tcp adjust-mss command helps prevent TCP sessions from being dropped by adjusting the MSS value of the TCP SYN packets.

The ip tcp adjust-mss command is effective only for TCP connections passing through the router.

In most cases, the optimum value for the max-segment-size argument of the ip tcp adjust-mss command is 1452 bytes. This value plus the 20-byte IP header, the 20-byte TCP header, and the 8-byte PPPoE header add up to a 1500-byte packet that matches the MTU size for the Ethernet link.

Note

TCP MSS adjustment-based traffic is always software switched.

Supported Interfaces

TCP MSS Adjust is supported only on the following interfaces:

- Physical Layer 3 interface

- SVI

- Layer 3 port channel

- Layer 3 GRE tunnel

How to Configure TCP MSS Adjustment

The following sections provide configuration information for TCP MSS adjustment.

- Configuring the MSS Value for Transient TCP SYN Packets

- Configuring the MSS Value for IPv6 Traffic

Configuring the MSS Value for Transient TCP SYN Packets

Before you begin

Perform this task to configure the MSS for transient packets that traverse a router, specifically TCP segments with the SYN bit set.

We recommend that you use ip tcp adjust-mss 1452 command.

Procedure

Step 1

enable

Example:

Device>enable

Enables privileged EXEC mode.

Enter your password if prompted

Step 2

configure terminal

Example:

Device#config terminal

Enters the global configuration mode.

Step 3

interface type number

Example:

Device(config)#interface GigabitEthernet 1/0/0

Configures an interface type and enters interface configuration mode.

Step 4

ip tcp adjust-mss max-segment-size

Example:

Device(config-if)#ip tcp adjust-mss 1452

Adjusts the MSS value of TCP SYN packets going through a router.

The max-segment-size argument is the maximum segment size, in bytes. The range is from 500 to 1460.

Step 5

end

Example:

Device(config-if)#end

Exits to global configuration mode.

Configuring the MSS Value for IPv6 Traffic

Procedure

Step 1

enable

Example:

Device>enable

Enables privileged EXEC mode.

Enter your password if prompted

Step 2

configure terminal

Example:

Device#config terminal

Enters the global configuration mode.

Step 3

interface type number

Example:

Device(config)#interface GigabitEthernet 1/0/0

Configures an interface type and enters interface configuration mode.

Step 4

ipv6 tcp adjust-mss max-segment-size

Example:

Device(config-if)#ipv6 tcp adjust-mss 1440

Adjusts the MSS value of TCP DF packets going through a device.

The max-segment-size argument is the maximum segment size, in bytes. The range is from 40 to 1440.

Step 5

end

Example:

Device(config-if)#end

Exits interface configuration mode and returns to privileged EXEC mode.

Configuration Examples for TCP MSS Adjustment

The following sections provide configuration examples for TCP MSS adjustment.

- Example: Configuring the TCP MSS Adjustment for IPv6 traffic

Example: Configuring the TCP MSS Adjustment for IPv6 traffic

Device>enable
Device#configure terminal
Device(config)#interface GigabitEthernet 0/0/0
Device(config)#ipv6 tcp adjust-mss 1440
Device(config)#end

Feature History for TCP MSS Adjustment

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

Transmission Control Protocol (TCP) Maximum Segment Size (MSS) Adjustment

The TCP MSS Adjustment feature enables the configuration of the maximum segment size for transient packets that traverse a router, specifically TCP segments with the SYN bitset. This feature helps prevent TCP sessions from being dropped by adjusting the MSS value of the TCP SYN packets.

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.

Chapter 12. Enhanced IPv6 Neighbor Discovery Cache Management

- Enhanced IPv6 Neighbor Discovery Cache Management

- Customizing the Parameters for IPv6 Neighbor Discovery

- Examples: Customizing Parameters for IPv6 Neighbor Discovery

- Additional References

- Feature History for IPv6 Neighbor Discovery

Enhanced IPv6 Neighbor Discovery Cache Management

Neighbor discovery protocol enforces the neighbor unreachability detection process to detect failing nodes, or devices, and the changes to link-layer addresses. Neighbor unreachability detection process maintains the reachability information for all the paths between hosts and neighboring nodes, including host-to-host, host-to-device, and device-to-host communication.

The neighbor cache maintains mapping information about the IPv6 link-local or global address to the link-layer address. The neighbor cache also maintains the reachability state of the neighbor using the neighbor unreachability detection process. Neighbors can be in one of the following five possible states:

- DELAY: Neighbor resolution is pending, and traffic might flow to this neighbor.

- INCOMPLETE: Address resolution is in progress, and the link-layer address is not yet known.

- PROBE: Neighbor resolution is in progress, and traffic might flow to this neighbor.

- REACHABLE: Neighbor is known to be reachable within the last reachable time interval.

- STALE: Neighbor requires resolution, and traffic may flow to this neighbor.

Use the ipv6 nd na glean command to configure the neighbor discovery protocol to glean an entry from an unsolicited neighbor advertisement.

Use the ipv6 nd nud retry command to configure the neighbor discovery protocol to maintain a neighbor discovery cache entry for a neighbor during a network disruption.

Use the ipv6 nd cache expire refresh command to configure the neighbor discovery protocol to maintain a neighbor discovery cache entry even when no traffic flows to the neighbor.

Customizing the Parameters for IPv6 Neighbor Discovery

To customize the parameters for IPv6 neighbor discovery, perform this procedure:

Procedure

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password, if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface gigabitethernet 1/1/4

Specifies an interface type and identifier. Enters the interface configuration mode.

Step 4

ipv6 nd nud retry base interval max-attempts [final-wait-time]

Example:

Device(config-if)# ipv6 nd nud retry 1 1000 3

Configures the number of times neighbor unreachability detection resends neighbor solicitations.

Step 5

ipv6 nd cache expire expire-time-in-seconds [refresh]

Example:

Device(config-if)# ipv6 nd cache expire 7200

Configures the length of time before an IPv6 neighbor discovery cache entry expires.

Step 6

ipv6 nd na glean

Example:

Device(config-if)# ipv6 nd na glean

Configures the length of time before an IPv6 neighbor discovery cache entry expires.

Step 7

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

Step 8

show ipv6 interface

Example:

Device# show ipv6 interface

(Optional) Displays the usability status of interfaces that are configured for IPv6 along with neighbor discovery cache management.

Examples: Customizing Parameters for IPv6 Neighbor Discovery

The following example shows that IPv6 neighbor advertisement gleaning is enabled and the IPv6 neighbor discovery cache expiry is set to 7200 seconds (2 hours):

Device> enable
Device# configure terminal
Device(config)# interface Port-channel 189
Device(config-if)# no ip address
Device(config-if)# ipv6 address 2001:BD8::/64
Device(config-if)# ipv6 nd reachable-time 2700000
Device(config-if)# ipv6 nd na glean
Device(config-if)# ipv6 nd cache expire 7200
Device(config-if)# no ipv6 redirects
Device(config-if)# end

Additional References

Related Documents

Related Topic

Document Title

For complete syntax and usage information for the commands used in this chapter.

See the IP Addressing Services section of Command Reference (Catalyst 9200 Series Switches)

For information on IPv6 Neighbor Discovery Inspection

See the Security section of Software Configuration Guide (Catalyst 9200 Switches)

Feature History for IPv6 Neighbor Discovery

This table provides release and related information for the features explained in this module.

These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Fuji 16.9.2

Enhanced IPv6 Neighbor Discovery Cache Management

Neighbor discovery protocol enforces neighbor unreachability detection, which can detect failing nodes or routers, and changes to link-layer addresses.

Cisco IOS XE Cupertino 17.7.1

Enhanced IPv6 Neighbor Discovery Cache Management

Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.