End of Support

Link Layer Discovery Protocol

This section describes Link Layer Discovery Protocol (LLDP) configuration tasks. Refer to the command descriptions for information about commands used in this chapter.

Topics in this section include:

LLDP Introduction
LLDP Overview
LLDP Configuration Procedures
LLDP Configuration Commands

LLDP Introduction

Link Layer Discovery Protocol (LLDP) lets Ethernet network devices to advertise details about themselves, such as capabilities, identification, and device configurations to directly connected devices on the network that are also using LLDP.

LLDP Overview

LLDP is a discovery protocol that allows devices to advertise information about themselves to peer devices that are on the same physical LAN and store information about the network. LLDP allows a device to learn higher layer management reachability and connection endpoint information from adjacent devices.

Each switch with an active LLDP agent sends and receives messages on all physical interfaces enabled for LLDP transmission. These messages are sent periodically and are typically configured for short intervals to ensure that accurate information is always available. These messages are then stored for a configurable period of time, and contained within the received packet. The system discards the message information when it reaches the configured value. The system sends an advertisement only when a relevant change occurs in the switch. If information changes for any reason, the LLDP agent is notified and sends out and updates the new values.

LLDP Data Units

A single LLDP Data Unit (LLDPDU) is transmitted in a single 802.3 Ethernet frame. The basic LLDPDU includes a header and a series of Type-Length-Value elements (TLVs). Each TLV advertises different types of information, such as its device ID, type, or management addresses.

LLDP advertises the following TLVs by default:

port-description
system-capabilities
system-description
system-name
management-address
port-vlan

Transmission and Reception

Every device that uses LLDP has its own LLDP agent. The LLDP agent is responsible for the reception, transmission, and management of LLDP. When you enable LLDP on a port, the system enables the transmission and reception of LLDPDUs by default. However, the agent can be configured only to transmit or receive.

Transmission

When LLDP transmission is enabled, the LLDP agent advertises information about the switch to neighbors at regular intervals. Each transmitted LLDPDU contains the mandatory TLVs and any enabled optional TLVs.

Reception

When LLDP reception is enabled, the LLDP agent receives and stores advertised information from neighboring devices.

Storing LLDP Information

Whenever the switch receives a valid and current LLDP advertisement from a neighbor, it stores the information in a Simple Network Management Protocol (SNMP) Management Information Base (MIB).

Guidelines and Limitations

LLDP has the following configuration limitations:

LLDP must be enabled globally before enabling it on an interface.
LLDP is not supported on virtual interfaces.
LLDP can discover only one device per port.

LLDP Configuration Procedures

These sections describe the following configuration processes:

Enabling LLDP Globally
Enabling LLDP on an Interface
Optional LLDP Parameters
Clearing LLDP Statistics
Displaying LLDP Information

Enabling LLDP Globally

The lldp run command globally enables LLDP on the Arista switch. Once LLDP is enabled, the switch will transmit advertisements from the ports that are configured to send TLVs. The neighbor information table is populated as advertisements from the neighbors arrive on the ports.

Example

This command enables LLDP globally on the Arista switch.

switch(config)# lldp run
switch(config)#

Enabling LLDP on an Interface

When enabling LLDP, it is enabled on all interfaces by default. By using the lldp transmit and lldp receive commands, LLDP can be enabled or disabled on individual interfaces or configured to only send or only receive LLDP packets.

Examples

These commands enable interface ethernet port 3/1 to transmit LLDP packets.

switch(config)# interface ethernet 3/1
switch(config-if-Et3/1)# lldp transmit
switch(config-if-Et3/1)#

These commands enable interface ethernet port 3/1 to receive LLDP packets.

switch(config)# interface ethernet 3/1
switch(config-if-Et3/1)# lldp receive 
switch(config-if-Et3/1)#

Optional LLDP Parameters

The following sections describe these tasks:

Setting the LLDP Timer
Setting the LLDP Hold Time
Setting the LLDP Re-initialization Timer
Setting the IP Management Address to be used in the TLV
Selecting the LLDP TLVs
Configuring LLDP for Power over Ethernet

Setting the LLDP Timer

The lldp timer command specifies the time in seconds between LLDP updates sent by the switch.

Examples

This command specifies that the LLDP updates should be sent every 120 seconds.
```
switch(config)# lldp timer 120
switch(config)#
```
This command reverts the LLDP timer to its default value of 30 seconds.
```
switch(config)# no lldp timer 120
switch(config)#
```

Setting the LLDP Hold Time

The lldp hold-time command sets the amount of time a receiving device should retain the information sent by the device.

Examples

This command specifies that the receiving device should retain the information for 180 seconds before discarding it.
```
switch(config)# lldp hold-time 180
switch(config)#
```
This command reverts the LLDP hold time and to the default value of 120 seconds.
```
switch(config)# no lldp hold-time 180
switch(config)#
```

Setting the LLDP Re-initialization Timer

The lldp run command specifies the amount of time in seconds to delay the re-initialization attempt by the switch.

Example

This command specifies that the switch waits 10 seconds before attempting to re-initialize.

switch(config)# lldp timer reinitialization 10
switch(config)#

Setting the IP Management Address to be used in the TLV

The lldp management-address command specifies the IP management address or the IP address of the VRF interface in LLDP Type-Length-Value (TLV) triplets.

Example

This command specifies the IP management address to be used in the TLV.

switch(config)# lldp management-address ethernet 3/1
switch(config)#

Selecting the LLDP TLVs

The lldp tlv transmit command specifies which Type, Length, and Value (TLVs) elements include in LLDP packets. The no lldp tlv transmit command removes the TLV configuration.

Example

This command enables the system descriptions to be included in the TLVs.

switch(config)# lldp tlv transmit system-description
switch(config)#

Configuring LLDP for Power over Ethernet

Initial Power over Ethernet (PoE) power-level negotiation with a Powered Device (PD) takes place in hardware (see Configuring Power over Ethernet (PoE)). Once hardware negotiation has taken place, IEEE 802.3at Power Via MDI Type-Length-Value elements (TLVs) are included by default in LLDP packets sent to connected PDs to allow LLDP to negotiate power needs further. LLDP allows the switch to deal with more granular power requests from PDs, and also allows dynamic power-level setting. TLVs received from connected Power-Sourcing Equipment (PSE) are ignored.

Note: Power Via MDI TLVs are not sent (even when enabled) under the following circumstances:

there is a user-configured power limit on the port, or
hardware negotiation sets the power to higher than class 4 because IEEE 802.3bt, which increases the maximum power output for PoE, is not yet supported by LLDP.

To disable Power Via MDI TLVs globally, use the no lldp tlv transmit command and specify the Power Via MDI TLV. Hardware negotiation and manual power limits will remain in effect.

Example

This command disables the sending of Power Via MDI TLVs globally.

switch(config)# no lldp tlv transmit power-via-mdi
switch(config)#

To disable Power Via MDI TLVs on an individual interface, use the poe negotiation lldp disabled command. Hardware negotiation and manual power limits will remain in effect.

Example

These commands disable the sending of Power Via MDI TLVs on interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# poe negotiation lldp disabled
switch(config-if-Et5)#

New LLDP Fields Defined by IEEE 802.3at-2009

Arista switches do not support the following new LLDP/SNMP fields defined in IEEE standard 802.3at-2009:

Power type a LldpXdot3RemPowerType
Power source a LldpXdot3RemPowerSource
Power priority a LldpXdot3RemPowerPriority
PD requested power value a LldpXdot3RemPDRequestedPowerValue
PSE allocated power value a LldpXdot3RemPSEAllocatedPowerValue

Displaying LLDP Information

Viewing LLDP Global Information
Viewing LLDP Local Information
Viewing LLDP Neighbors
Viewing LLDP Traffic

Viewing LLDP Global Information

The show lldp command displays LLDP information.

Examples

This command displays global information about LLDP.

switch# show lldp
LLDP transmit interval      : 60 seconds
LLDP transmit holdtime      : 120 seconds
LLDP reinitialization delay : 2 seconds
LLDP Management Address VRF : default
Enabled optional TLVs:
  Port Description
  System Name
  System Description
  System Capabilities
  Management Address (Management0)
  IEEE802.1 Port VLAN ID
  IEEE802.3 Link Aggregation
  IEEE802.3 Maximum Frame Size
Port       Tx Enabled  Rx Enabled
Et3/1      Yes         Yes

switch#

This command displays LLDP information.

switch# show lldp ethernet interface 3/1
LLDP transmit interval      : 30 seconds
LLDP transmit holdtime      : 120 seconds
LLDP reinitialization delay : 2 seconds
LLDP Management Address VRF : default
Enabled optional TLVs:
  Port Description
  System Name
  System Description
  System Capabilities
switch#

Viewing LLDP Local Information

The show lldp local-info command displays the information contained in the LLDP TLVs to be sent about the local system.

Example

This command displays information contained in the TLVs about the local systems.

switch# show lldp local-info management 1   
Local System:
  - Chassis ID type: MAC address (4)
    Chassis ID     : 001c.730f.11a8
  - System Name: "switch.aristanetworks.com"
  - System Description: "Arista Networks EOS version 4.13.2F running on an Arista 
Networks DCS-7150S-64-CL"
  - System Capabilities : Bridge, Router
    Enabled Capabilities: Bridge

Interface Management1:
  - Port ID type: Interface name (5)
    Port ID     : "Management1"
  - Port Description: ""
  - Management Address Subtype: IPv4 (1)
    Management Address        : 172.22.30.154
    Interface Number Subtype  : ifIndex (2)
    Interface Number          : 999001
    OID String                :
  - IEEE802.1 Port VLAN ID: 0
  - IEEE802.1/IEEE802.3 Link Aggregation
    Link Aggregation Status: Not Capable (0x00)
    Port ID                : 0
  - IEEE802.3 Maximum Frame Size: 1518 bytes
switch(config)#

Viewing LLDP Neighbors

The show lldp neighbors command displays information about LLDP neighbors.

Examples

This command shows information about LLDP neighbors.

switch# show lldp neighbor
Last table change time   : 0:12:33 ago
Number of table inserts  : 33
Number of table deletes  : 0
Number of table drops    : 0
Number of table age-outs : 0

Port      Neighbor Device ID             Neighbor Port ID           TTL
Et3/1     tg104.sjc.aristanetworks.com   Ethernet3/2                120

Ma1/1     dc1-rack11-tor1.sjc            1/1                        120
switch#

This command displays detailed information about the neighbor ethernet 3/1.

switch# show lldp neighbor ethernet 3/1
Last table change time   : 0:16:24 ago
Number of table inserts  : 33
Number of table deletes  : 0
Number of table drops    : 0
Number of table age-outs : 0

Port      Neighbor Device ID             Neighbor Port ID           TTL
Et3/1     tg104.sjc.aristanetworks.com   Ethernet3/2                120
switch#

Viewing LLDP Traffic

The show lldp counters command displays the LLDP traffic information for the switch.

Example

This command displays the LLDP counters on the switch.

switch# show lldp counters
Port          Tx Frames Tx Length Exceeded

Et20              69485                  0
Et21              69394                  0
Et22              69203                  0
Et23              57546                  0
Et24                  0                  0
Ma1               69665                  0
Port      Rx Frames     Rx Errors    Rx Discard  TLVs Discard  TLVs Unknown

Et20          69470             0             0             0             0
Et21          69383             0             0             0             0
Et22          69143             0             0             0             0
Et23          55370             0             0             0             0
Et24              0             0             0             0             0
Ma1           69078         69078             0         69078             0
switch#

LLDP Configuration Commands

clear lldp counters

The clear lldp counters command resets the LLDP counters to zero.

Command Mode

Privileged EXEC

Command Syntax

clear lldp counters [SCOPE]

Parameters

SCOPE Session affected by command. Options include:

no parameter command affects counters on all CLI sessions.
session clears LLDP counters for the current CLI session only.

Examples

This command resets all the LLDP counters to zero.

switch(config)# clear lldp counters
switch(config)#

This command resets only the LLDP counters for the current CLI session.
```
switch(config)# clear lldp counters session
switch(config)#
```

clear lldp table

The clear lldp table command clears neighbor information from the LLDP table.

Command Mode

Privileged EXEC

Command Syntax

clear lldp table

Example

This command clears neighbor information from the LLDP table.

switch(config)# clear lldp table
switch(config)#

lldp hold-time

The lldp hold-time command specifies the amount of time a receiving device should maintain the information sent by the device before discarding it.

Command Mode

Global Configuration

Command Syntax

lldp hold-time period

no lldp hold-time

default lldp hold-time

Parameters

period The amount of time a receiving device should hold LLDPDU information before discarding it. Value ranges from 10 to 65535 second; default value is 120 seconds.

Examples

This command sets the amount of time before the receiving device discards LLDPDU information to 180 seconds.
```
switch(config)# lldp hold-time 180
switch(config)#
```
This command restores the hold-time to its default value of 120 seconds.
```
switch(config)# no lldp hold-time 180
switch(config)#
```

lldp management-address

The lldp management-address command enables the user to add the IP management address used for LLDP Type-Length-Value (TLV).

Command Mode

Global Configuration

Command Syntax

lldp management-address [INTERFACE]

no lldp management-address [INTERFACE]

default lldp management-address [INTERFACE]

Parameters

INTERFACE Interface type and number. Options include:

all all interfaces.
ethernet e_num Ethernet interface specified by e_num.
loopback l_num Loopback interface specified by l_num.
management m_num Management interface specified by m_num.
port-channel p_num Port-Channel Interface specified by p_num.
vlan v_num VLAN interface specified by v_num.

Examples

This command specifies the IP management address to be used in the TLV.
```
switch(config)# lldp management-address ethernet 3/1
switch(config)#
```

This command removes the IP management address used in the TLV.

switch(config)# no lldp management-address ethernet 3/1
switch(config)#

This command specifies that vlan200 is used in the TLV.

switch(config)# lldp management-address vlan 200
switch(config)#

This command removes the VLAN ID used in the TLV.

switch(config)# no lldp management-address vlan 200
switch(config)#

lldp management-address vrf

The lldp management-address vrf command enables the user to add the IP address of the VRF interface used in LLDP Type-Length-Value (TLV).

Command Mode

Global Configuration

Command Syntax

lldp management-address vrf VRF_INSTANCE

no lldp management-address vrf VRF_INSTANCE

default lldp management-address vrf VRF_INSTANCE

Parameter

VRF_INSTANCE specifies the VRF instance.

Examples

This command specifies the management address VRF to be used in the TLV.
```
switch(config)# lldp management-address vrf test 1
switch(config)#
```

This command removes the management VRF used in the TLV.

switch(config)# no lldp management-address vrf test 1
switch(config)#

lldp receive

The lldp receive command enables LLDP packets on an interface. The no lldp receive command disables the acceptance of LLDP packets.

Command Mode

Interface-Ethernet configuration

Interface-Management configuration

Command Syntax

lldp receive

no lldp receive

default lldp receive

Examples

These commands enable the reception of LLDP packets on interface ethernet 4/1.

switch(config)# interface ethernet 4/1
switch(config-if-Et4/1)# lldp receive
switch(config-if-Et4/1)#

These commands disable the reception of LLDP packets on interface ethernet 4/1.

switch(config)# interface ethernet 4/1
switch(config-if-Et4/1)# no lldp receive
switch(config-if-Et4/1)#

lldp receive packet tagged drop

The lldp receive packet tagged drop command is a global configuration command and when configured, the LLDP ignores all the packets with VLAN-tag. By default, this command is disabled.

Command Mode

Global Configuration

Command Syntax

lldp receive packet tagged drop

Example

This command when configured, the LLDP ignores all the packets with VLAN-tag.

switch(config)# lldp receive packet tagged drop

lldp run

The lldp run command enables LLDP on the switch.

Command Mode

Global Configuration

Command Syntax

lldp run

no lldp run

default lldp run

Examples

This command enables LLDP globally on the switch.
```
switch(config)# lldp run
switch(config)#
```
This command disables LLDP globally on the switch.
```
switch(config)# no lldp run
switch(config)#
```

lldp timer reinitialization

The lldp timer reinitialization command sets the time delay in seconds for LLDP to initialize.

Command Mode

Global Configuration

Command Syntax

lldp timer reinitialization delay

no lldp timer reinitialization

default lldp timer reinitialization

Parameter

delay the amount of time the device should wait before re-initialization is attempted. Value ranges from 1 to 20 seconds; default value is 2 seconds.

Examples

This command specifies that the switch should wait 10 seconds before attempting to re-initialize.
```
switch(config)# lldp timer reinitialization 10
switch(config)#
```

This command restores the default initialization delay of 2 seconds.

switch(config)# no lldp timer reinitialization 10
switch(config)#

lldp timer

The lldp timer command specifies the amount of time a receiving device should maintain the information sent by the device before discarding it. The no lldp timer command removes the configured LLDP timer.

Command Mode

Global Configuration

Command Syntax

lldp timer transmission_time

no lldp timer

default lldp timer

Parameter

transmission_time the period of time at which LLDPDUs are transmitted. Values range from 5 to 32768 seconds; the default is 30 seconds.

Examples

This command configures a period of 180 seconds at which the LLDPDUs are transmitted.
```
switch(config)# lldp timer 180
switch(config)#
```
This command removes the configured period of time at which the LLDPDUs are transmitted.
```
switch(config)# no lldp timer 180
switch(config)#
```

lldp tlv transmit

The lldp tlv transmit command allows the user to specify the Type-Length-Values (TLVs) to include in LLDP packets.

Command Mode

Global Configuration

Command Syntax

lldp tlv transmit TLV_NAME

no lldp tlv transmit TLV_NAM

default lldp tlv transmit TLV_NAME

Parameters

TLV_NAME Options include:

link-aggregation specifies the link aggregation TLV.
management-address specifies the management address TLV.
max-frame-size specifies the Frame size TLV.
port-description specifies the port description TLV.
port-vlan specifies the port VLAN ID TLV.
power-via-mdi specifies the power over Ethernet TLV.
system-capabilities specifies the system capabilities TLV.
system-description specifies the system description TLV.
system-name specifies the system name TLV.

Examples

This command enables the system description TLV:

switch(config)# lldp tlv transmit system-description
switch(config)#

This command disables the system description TLV:

switch(config)# no lldp tlv transmit system-description
switch(config)#

This command enables the max-frame-size TLV:

switch(config)# lldp tlv transmit max-frame-size
switch(config)#

This command disables the max-frame-size TLV:

switch(config)# no lldp tlv transmit max-frame-size
switch(config)#

lldp transmit

The lldp transmit command enables the transit of LLDP packets on an interface.

Command Mode

Interface-Ethernet configuration

Interface-Management configuration

Command Syntax

lldp transmit

no lldp transmit

default lldp transmit

Examples

These commands enable the transmission of LLDP packets.

switch(config)# interface ethernet 4/1
switch(config-if-Et4/1)# lldp transmit
switch(config-if-Et4/1)#

These commands disable the transmission of LLDP packets.

switch(config)# interface ethernet 4/1
switch(config-if-Et4/1)# no lldp transmit
switch(config-if-Et4/1)#

poe negotiation lldp disabled

Power Via MDI TLVs are included by default in LLDP packets sent to Power over Ethernet (PoE) Powered Devices (PDs) to allow dynamic negotiation of power levels. The poe negotiation lldp disabled command disables the sending of Power Via MDI TLVs from the configuration-mode interface.

The no poe negotiation lldp disabled and default poe negotiation lldp disabled commands restore the default behavior (sending Power Via MDI TLVs) by removing the corresponding poe negotiation lldp disabled command from running-config.

To disable Power Via MDI TLVs globally, use the no lldp tlv transmit command and specify the Power Via MDI TLV.

Command Mode

Interface-Ethernet configuration

Command Syntax

poe negotiation lldp disabled

no poe negotiation lldp disabled

default poe negotiation lldp disabled

Example

These commands disable the sending of power via MDI TLVs on interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# poe negotiation lldp disabled
switch(config-if-Et5)#

show lldp counters

The show lldp counters command displays LLDP traffic information for the switch.

Command Mode

EXEC

Command Syntax

show lldp counters [INTERFACE]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the LLDP counters on the switch.

switch# show lldp counters 

Port          Tx Frames Tx Length Exceeded

Et20              69485                  0
Et21              69394                  0
Et22              69203                  0
Et23              57546                  0
Et24                  0                  0
Ma1               69665                  0

Port          Rx Frames     Rx Errors    Rx Discard  TLVs Discard  TLVs Unknown

Et20              69470             0             0             0             0
Et21              69383             0             0             0             0
Et22              69143             0             0             0             0
Et23              55370             0             0             0             0
Et24                  0             0             0             0             0
Ma1               69078         69078             0         69078             0

show lldp local-info

The show lldp local-info command displays LLDP errors and overflows.

Command Mode

EXEC

Command Syntax

show lldp local-info [INTERFACE]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the specific LLDP errors and overflows on management interface 1.

switch# show lldp local-info management 1
Local System:
  - Chassis ID type: MAC address (4)
    Chassis ID     : 001c.730f.11a8qqq
  - System Name: "switch.aristanetworks.com"
  - System Description: "Arista Networks EOS version 4.13.2F running on an Arista 
Networks DCS-7150S-64-CL"
  - System Capabilities : Bridge, Router
    Enabled Capabilities: Bridge

Interface Management1:
  - Port ID type: Interface name (5)
    Port ID     : "Management1"
  - Port Description: ""
  - Management Address Subtype: IPv4 (1)
    Management Address        : 172.22.30.154
    Interface Number Subtype  : ifIndex (2)
    Interface Number          : 999001
    OID String                :
  - IEEE802.1 Port VLAN ID: 0
  - IEEE802.1/IEEE802.3 Link Aggregation
    Link Aggregation Status: Not Capable (0x00)
    Port ID                : 0
  - IEEE802.3 Maximum Frame Size: 1518 bytes
se505.16:01:44#
switch#

show lldp neighbors

The show lldp neighbors command displays information about the switch’s LLDP neighbors.

Command Mode

EXEC

Command Syntax

show lldp neighbors [INTERFACE][INFO_LEVEL]

Parameters

INTERFACE Interface type and numbers. Options include:
- no parameter displays information for all interfaces.
- ethernet e_range Ethernet interface range specified by e_range.
- management m_range Management interface range specified by m_range.
- Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.
INFO_LEVEL amount of information that is displayed. Options include:
- no parameter Displays information for all interfaces.
- detailed LLDP information for all the adjacent LLDP devices.

Examples

This command displays the neighbor’s information about LLDP.

switch(config)# show lldp neighbors
Last table change time   : 0:12:33 ago
Number of table inserts  : 33
Number of table deletes  : 0
Number of table drops    : 0
Number of table age-outs : 0

Port      Neighbor Device ID             Neighbor Port ID      TTL
Et3/1     tg104.sjc.aristanetworks.com   Ethernet3/2           120

Ma1/1     dc1-rack11-tor1.sjc            1/1                   120
switch#

This command displays LLDP neighbor information for interface ethernet 3/1.

switch# show lldp neighbors ethernet 3/1              
Last table change time   : 0:16:24 ago
Number of table inserts  : 33
Number of table deletes  : 0
Number of table drops    : 0
Number of table age-outs : 0

Port      Neighbor Device ID             Neighbor Port ID       TTL
Et3/1     tg104.sjc.aristanetworks.com   Ethernet3/2            120
switch#

This command displays detailed LLDP neighbor information for interface ethernet 3/1.

switch# show lldp neighbors 3/1 detail

Interface Ethernet 3/1 detected 1 LLDP neighbors:

  Neighbor 001c.7300.1506/Ethernet6/25, age 8 seconds
  Discovered 5 days, 3:58:58 ago; Last changed 5 days, 3:56:57 ago
    - Chassis ID type: MAC address (4)
      Chassis ID     : 001c.7300.1506
    - Port ID type: Interface name (5)
      Port ID     : "Ethernet6/25"
    - Time To Live: 120 seconds
 - Port Description: "Ethernet6/25"
 - IEEE802.3 Power Via MDI
    Port Class               : PD
    PSE MDI Power Support    : Not Supported
    PSE MDI Power State      : Disabled
    - System Name: "Leaf-Switch1.aristanetworks.com"
    - System Description: "Arista Networks EOS version 4.10.1-SSO running on an Arista Networks DCS-7504"
    - System Capabilities : Bridge, Router
      Enabled Capabilities: Bridge
    - Management Address Subtype: IPv4 (1)
      Management Address        : 172.22.30.116
      Interface Number Subtype  : ifIndex (2)
      Interface Number          : 999999
      OID String                :
    - IEEE802.1 Port VLAN ID: 1
    - IEEE802.1/IEEE802.3 Link Aggregation
      Link Aggregation Status: Capable, Disabled (0x01)
      Port ID                : 0
    - IEEE802.3 Maximum Frame Size: 9236 bytes
switch#

show lldp

The show lldp command displays LLDP information.

Command Mode

EXEC

Command Syntax

show lldp [INTERFACE]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Examples

This command displays all LLDP information.

switch# show lldp 
LLDP transmit interval      : 60 seconds
LLDP transmit holdtime      : 120 seconds
LLDP reinitialization delay : 2 seconds
LLDP Management Address VRF : test

Enabled optional TLVs:
  Port Description
  System Name
  System Description
  System Capabilities
  Management Address (Management0)
  IEEE802.1 Port VLAN ID
  IEEE802.3 Link Aggregation
  IEEE802.3 Maximum Frame Size

Port       Tx Enabled  Rx Enabled
Et3/1      Yes         Yes

switch#

This command displays specific information about LLDP for interface ethernet 3/1.

switch# show lldp ethernet 3/1
LLDP transmit interval      : 30 seconds
LLDP transmit holdtime      : 120 seconds
LLDP reinitialization delay : 2 seconds
LLDP Management Address VRF : default

Enabled optional TLVs:
  Port Description
  System Name
  System Description
  System Capabilities
switch#

This command displays specific information about LLDP for management interface 1/1.

switch# show lldp management 1/1
LLDP transmit interval      : 60 seconds
LLDP transmit holdtime      : 120 seconds
LLDP reinitialization delay : 2 seconds
LLDP Management Address VRF : default

Enabled optional TLVs:
  Port Description
  System Name
  System Description
  System Capabilities
  Management Address (Management0)
  IEEE802.1 Port VLAN ID
  IEEE802.3 Link Aggregation
  IEEE802.3 Maximum Frame Size

Port       Tx Enabled  Rx Enabled
Ma1/1      Yes         Yes
switch#

Virtual LANs (VLANs)

This chapter describes Arista’s Virtual LANs (VLANs) implementation and MAC address tables.

Sections in this chapter include:

VLAN Introduction
VLAN Conceptual Overview
VLAN Configuration Procedures
VLAN Configuration Commands

VLAN Introduction

Arista switches support industry standard 802.1q VLANs. Arista EOS provides tools to manage and extend VLANs throughout the data center network.

VLAN Conceptual Overview

VLAN Definition

A Virtual Local Area Network (VLAN) allows a group of devices to communicate as if they were in the same network regardless of their physical location. VLANs are Layer 2 structures based on the 802.1Q standard.

These parameters are associated with a VLAN:

VLAN number (1-4094): VLAN numbers uniquely identify the VLAN within a network. VLAN 1 exists by default; all other VLANs only exist after configuring.
VLAN name (optional): The VLAN name is a text string that describes the VLAN.
VLAN state (active or suspended): The state specifies the VLAN transmission status within the switch. In the suspended state, VLAN traffic is blocked on all switch ports. The default state is active.

VLANs define Layer 2 broadcast domains in a Layer 2 network, in which each device can receive broadcast frames sent by any other within the domain. Switches accommodating multiple broadcast domains serve as multi-port bridges where each broadcast domain is a distinct virtual bridge. Traffic does not pass directly between different VLANs within a switch or between two switches.

VLAN Switching

Ethernet and port channel interfaces are configured as switched ports by default. Switched ports are configurable as members of one or more VLANs. Switched ports ignore all IP-level configuration commands, including IP address assignments.

VLAN Trunking and Trunk Groups

Trunking extends multiple VLANs beyond the switch through a common interface or port channel.

A trunk group is the set of physical interfaces that comprise the trunk and the collection of VLANs whose traffic is carried on the trunk. The traffic of a VLAN that belongs to one or more trunk groups is carried only on ports that are members of trunk groups to which the VLAN belongs, i.e., VLANs configured in a trunk group are pruned of all ports that are not associated with the trunk group. See the Trunk Ports example section for further details.

Note: Be cautious when using allowed VLAN lists or trunk groups to ensure that the VLAN topology is consistent with any Layer-2 control protocol topology, or unpredictable results can occur.

VLAN traffic is carried through Ethernet or LAG ports. A port’s switchport mode defines the number of VLANs for which the port can carry traffic.

Access ports carry traffic for one VLAN – the access VLAN. Access ports associate untagged frames with the access VLAN. Access ports drop tagged frames that are not tagged with the access VLAN.
Trunk ports carry traffic for multiple VLANs. Tag frames specify the VLAN for which trunk ports process packets.

Q-in-Q Trunking

A Q-in-Q network is a multi-tier layer 2 VLAN network. A typical Q-in-Q network is composed of a service provider network (tier 1) where each node connects to a customer network (tier 2).

802.1ad is a networking standard that supports Q-in-Q networks by allowing multiple 802.1Q tags in an Ethernet frame.

Each interface in a customer network is assigned to a customer-VLAN (c-VLAN). Packets in c-VLANs contain 802.1q tags that switch traffic within the network. c-VLANs access the service provider VLAN (s-VLAN) through a provider switch. Customer switch ports connect to an s-VLAN through provider switch edge ports, which are configured as dot1q ports and operate as follows:

Inbound traffic (from customer switches): adds an s-VLAN tag, then forwards packets to the provider network.
Outbound traffic (to customer switches): removes the s-VLAN tag, then forwards packets to the customer network.

TPID (Configurable Ethertypes)

By default, VLAN-tagged packets carry a Tag Protocol Identifier (TPID) of 0x8100. On some Arista platforms, however, the TPID of a switchport can be modified in accordance with IEEE 802.1ad to allow for the use of 802.1q TPIDs other than 0x8100. Well known and standard tags include:

0x8100 customer VLAN.

0x88a8 service VLAN tag used in provider bridging.
0x9100 service VLAN tag used in provider bridging (common, but not standardized).

Other non-standard TPID values may also be configured for interoperability with legacy equipment or non-standard systems. Values range from 0x600 (1536) through 0xFFFF (65535).

Non-default TPID values are most commonly used for provider bridging on a network-to-network interface.

VLAN Routing

Each VLAN can be associated with a Switch Virtual Interface (SVI), also called a VLAN interface. The VLAN interface functions in a routed network (Layer 3) with an assigned IP subnet address. Connecting different VLANs requires Layer 3 networking.

VLAN Interfaces

A Switched Virtual Interface (SVI) connects to the VLAN segment on the switch to provide Layer 3 processing for packets from the VLAN. An SVI can be activated only after it is connected to a VLAN. SVIs are typically configured for a VLAN to a default gateway for a subnet to facilitate traffic routing with other subnets.

In a Layer 3 network, each VLAN SVI is associated with an IP subnet, with all stations in the subnet members of the VLAN. Traffic between different VLANs is routed when IP routing is enabled.

Internal VLANs

A routed port is an Ethernet or port channel interface that functions as a Layer 3 interface. Routed ports do not bridge frames nor switch VLAN traffic. Routed ports have IP addresses assigned to them and packets are routed directly to and from the port.

The switch allocates an internal VLAN for an interface when it is configured as a routed port. The internal VLAN is assigned a previously unused VLAN ID. The switch prohibits the subsequent configuration of VLANs and VLAN interfaces with IDs corresponding to allocated internal VLANs.

Support for Private VLAN

Private VLAN is a feature that segregates a regular VLAN broadcast domain while maintaining all ports in the same IP subnet. There are three types of VLAN within a private VLAN:

Primary VLAN: Ports in the primary VLAN can send and or receive traffic from ports in all the corresponding PVLANs. There is only one primary VLAN in a private VLAN.
Community VLAN: This is a secondary VLAN. Hosts in a community VLAN forward traffic to each other as well as ports in the primary VLAN. There are multiple community VLANs in a private VLAN.
Isolated VLAN: This is a secondary VLAN. Hosts in an isolated VLAN only forward traffic to ports in the primary VLAN. Hosts within an isolated VLAN can not communicate with each other using bridging. There are multiple isolated VLANs in a private VLAN.

Limitations

On DCS-7280R, DCS-7280R2, DCS-7500R, DCS-7500R2, DCS-7020R

Private VLAN and Algomatch features are mutually exclusive. Disable algomatch with the hardware access-list mechanism tcam command . Note that this requires a reload of the system to take effect.
L2 and L3 multicast traffic is not supported.

On All Platforms except 7300X3, CCS-720XP, DCS-7050X3

Private VLAN and IPv4/IPv6 uRPF features are mutually exclusive.

On All Platforms

Tunnel termination on PVLAN ports is not supported.
Ingress IPv4/IPv6 RACLs on the primary VLAN are not honored for packets ingressing through ports in secondary VLANs.
Only isolated private VLAN trunks and normal trunk ports are supported. It allows trunk ports to forward and receive traffic for all primary and or secondary VLANs. An isolated trunk translates traffic coming in on a primary VLANto the lowest valued secondary VLAN on the trunk port.
Private VLAN is not supported on L2 subinterfaces.
Hardware accelerated Sflow is not supported on Private VLAN ports.
VLAN Mapping and or Translation is not supported with Private VLAN.

Show Commands

Use the show vlan private-vlan command to display the primary and secondary defined VLANs:

switch# show vlan private-vlan
Primary Secondary Type         Ports
------- --------- ----------- ------------------------
100      101      community    Et1, Et6
100      102      isolated     Et1, Et7, Et8
200      201      community    Et10, Et9

Use the show vlan 100,101,102,200,201 command to diplay which interfaces are member of which VLANs:

# show vlan 100,101,102,200,201
VLAN  Name          Status    Ports
----- ------------- --------- -------------------------------
100   VLAN0100      active    Et1, Et6+, Et7+, Et8+
101   VLAN0101      active    Et1+, Et6
102   VLAN0102      active    Et1+, Et7, Et8
200   VLAN0200      active    Et10
201   VLAN0201      active    Et10+, Et9

+ indicates a private VLAN promoted port

Promoted ports are displayed to indicate they are part of the same broadcast domain as the indicated VLAN. Interfaces in a primary VLAN are included in the display of all its associated secondary VLANs. Interfaces in secondary VLANs are included in the display of both its primary VLAN and its own domain.

On DCS-7280R, DCS-7280R2, DCS-7500R, DCS-7500R2, DCS-7020R

Use the show platform sand pvlan interfaces command to display the status of the interfaces to configure a private VLAN.

switch# show platform sand pvlan interfaces
Interface          Secondary      Primary     State
                        VLAN         VLAN
-----------------  ----------  ----------  ---------
Ethernet6                 101         100    enabled
Ethernet7                 102         100    enabled
Ethernet8                 102         100    enabled
Po1                       102         100    enabled
Ethernet9                 201         200     failed
Po2                       202         200     failed

In this output, the Secondary VLAN column indicates the VLAN which is configured on the interface. The Primary VLAN column indicates the primary VLAN to which the secondary VLAN belongs to. The State field has three possible values - enabled, failed, configured. The enabled state indicates that the private VLAN is configured and enabled on that interface. The failed state indicates that the private VLAN configuration has failed for that interface The configured state indicates that private VLAN is configured on that interface but has not taken effect. When port channels are configured in a private VLAN, it is enabled only if entries for all the member interfaces are successfully programmed in the hardware. If the hardware entries for any one of the member interfaces fails, the entries for other member interfaces are also removed from the hardware and the state is marked as failed.

VLAN Translation

VLAN translation allows you to map packets from one VLAN to another. This can be carried out only on packets having a dot1q header (tagged frames). The translation rewrites the Vlan ID field (VID) in dot1q headers on packets passing through a switched port without changing any other fields.

VLAN translation also supports the ability to translate packets with a dot1q header to the internal VLAN for a routed port. The VLAN in the incoming packets is mapped to the internal VLAN of the routed port and packets egressing the routed port are encapsulated with a dot1q header for the specified VLAN. For egress packets, no priority information is added to the dot1q header and the priority from the incoming encapsulation will be retained.

When configuring the VLAN translation mode, consider the following:

VLAN translation is only supported for tagged packets.
BPDUs from STP, LLDP and other protocols are not affected by this mapping.
VLAN translation is not applicable for access ports.
Untagged packets entering the switch on the trunk native VLAN are not mapped.
TPID and VLAN priority does not get re-written during the translation.

VLAN Configuration Procedures

These sections describe basic VLAN configuration tasks.

Creating and Configuring VLANs
Configuring VLAN Switching
Creating and Configuring VLAN Interfaces
Allocating Internal VLANs
Private VLAN Configuration
Configuring VLAN Translation
Configuring VLAN Counters

Creating and Configuring VLANs

The CLI provides two methods of creating VLANs.

Explicitly through the vlan command.
Implicitly through the switchport access vlan command.

The switchport access vlan command generates a warning message when it creates a VLAN.

To create a VLAN, use the vlan command in global configuration mode. Valid VLAN numbers range between 1 and 4094. To create multiple VLANs, specify a range of VLAN numbers.

To edit an existing VLAN, enter the vlan command with the number of the existing VLAN.

Examples

This command creates VLAN 45 and enters VLAN configuration mode for the new VLAN.
```
switch(config)# vlan 45
switch(config-vlan-45)#
```

Use the name (VLAN configuration mode) command to assign a name to a VLAN.

These commands assign the name Marketing to VLAN 45.

switch(config)# vlan 45
switch(config-vlan-45)# name Marketing
switch(config-vlan-45)# show vlan 45

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------
45   Marketing                        active    Et1

switch(config-vlan-45)#

To change the state of a VLAN, use the state command in VLAN configuration mode.

These commands suspend VLAN 45. VLAN traffic is blocked on all switch ports.

switch(config)# vlan 45
switch(config-vlan-45)# state suspend
switch(config-vlan-45)# show vlan 45

VLAN Name                             Status    Ports
---- -------------------------------- --------- ------
45   Marketing                        suspended

switch(config-vlan-45)#

These commands activate VLAN 45.

switch(config)# vlan 45 
switch(config-vlan-45)# state active
switch(config-vlan-45)# show vlan 45

VLAN Name                             Status    Ports
---- -------------------------------- --------- ------
45   Marketing                        active    Et1

switch(config-vlan-45)#

VLAN Policy

The VLAN policy configuration command enables a switch to configure a VLAN policy when it receives a packet with unknown destination MAC address on a VLAN. The mac address forwarding command provides three options to configure a VLAN policy:

Flood the Layer 2 miss packets on the VLAN
Drop the Layer 2 miss packets
Log the Layer 2 miss packets to the CPU (while still flooding them on the VLAN)

The default behavior is to flood the L2 miss packets on all ports of the VLAN.

VLAN policy configuration is supported on the Arista 7010, 7050 (excluding 7050SX3-48YC12, 7050CX3-32S, 7050QX2-32S, 7050SX2-72Q, 7050SX2-128, 7050TX2-128), 7060, 7250, and the 7300 series platforms.

VLAN policy is not supported in the following cases:

STP, LLDP, and LACP packets
VLAN policy configurations on VXLAN-enabled VLAN
On a VLAN if IGMP snooping is configured with Multicast miss action is set to drop, then all multicast packets received on that VLAN are dropped.

Examples

These commands create a vlan 333 and then set the unicast policy to ‘drop’ and the multicast policy to ‘log’ for the specific vlan 333.

switch(config)# vlan 333
switch(config-vlan-333)# mac address forwarding unicast miss action drop
switch(config-vlan-333)# mac address forwarding multicast miss action log

These commands display the VLAN policy that was defined when vlan 333 is created.

switch(config)# show vlan 333 mac address forwarding

VLAN  UcMissAction  McMissAction
----  ------------  ------------
 333  flood         flood

These commands display the VLAN policy type that was defined when vlan 333 is configured with the ‘drop’ unicast policy and the ‘log’ multicast policy.

switch(config)# show vlan 333 mac address forwarding

VLAN  UcMissAction  McMissAction
----  ------------  ------------
 333  drop          log

switch(config)# show vlan mac address forwarding
 
VLAN  UcMissAction  McMissAction
----  ------------  ------------
   1  flood         flood
 333  drop          log

Configuring VLAN Switching

The following describe the configuration of VLAN ports.

Access Ports

Access ports carry traffic for one VLAN, as designated by a switchport access vlan command. Access ports associate untagged frames with the access VLAN. Tagged frames received by the interface are dropped unless they are tagged with the access VLAN.

To configure an interface group as an access port, use the switchport mode command.

Examples

These commands configure interface ethernet 1 as an access port.

switch(config)# interface ethernet 1
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)#

To specify the port’s access VLAN, use the switchport access vlan command.
These commands configure vlan 15 as the access VLAN for interface ethernet 5.
```
switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport access vlan 15
switch(config-if-Et5)#
```

These commands configure interface Ethernet 1 through 3 as access ports that process untagged frames as vlan 5 traffic.

switch(config)# interface Ethernet 1-3
switch(config-if-Et1-3)# switchport mode access
switch(config-if-Et1-3)# switchport access vlan 5
switch(config-if-Et1-3)# show interfaces ethernet 1-3 vlans
Port       Untagged Tagged
Et1        None     23,25
Et2        18       -
Et3        None     14
switch(config-if-Et1-3)#

Trunk Ports

Trunk ports carry traffic for multiple VLANs. Messages use tagged frames to specify the VLAN for which trunk ports process traffic.

The vlan trunk list specifies the VLANs for which the port handles tagged frames. The port drops any packets tagged for VLANs not in the VLAN list.
The native vlan is the VLAN where the port switches untagged frames.

To configure an interface group as a trunk port, use the switchport mode command.

Example

These commands configure interface ethernet 8 as a trunk port.

switch(config)# interface ethernet 8
switch(config-if-Et8)# switchport mode trunk
switch(config-if-Et8)#

By default all VLANs are permitted on a port configured with ‘switchport mode trunk’. To limit the port’s VLAN trunk list, use the switchport trunk allowed vlan command. Only VLANs in the allowed list will be permitted.

Examples

These commands configure VLAN 15, 20, 21, 22, 40, and 75 as the explicitly permitted VLAN trunk list for ethernet interface 12-16.

switch(config)# interface ethernet 12-16
switch(config-if-Et12-16)# switchport trunk allowed vlan 15,20-22,40,75
switch(config-if-Et12-16)#

These commands explicitly permit VLAN 100 through 120 to the VLAN trunk list for interface ethernet 14.

switch(config)# interface ethernet 14
switch(config-if-Et14)# switchport trunk allowed vlan add 100-120
switch(config-if-Et14)#

To specify the port’s native VLAN, use the switchport trunk native vlan command.
These commands configure vlan 12 as the native VLAN trunk for interface ethernet 10.
```
switch(config)# interface ethernet 10
switch(config-if-Et10)# switchport trunk native vlan 12
switch(config-if-Et10)#
```
By default, ports send native VLAN traffic with untagged frames. The switchport trunk native vlan command can also configure the port to send native VLAN traffic with tag frames.
These commands configure interface ethernet 10 to send native VLAN traffic as tagged.
```
switch(config)# interface ethernet 10
switch(config-if-Et10)# switchport trunk native vlan tag
switch(config-if-Et10)#
```

These commands configure interface ethernet 12 as a trunk with vlan 15 as the native VLAN. The port’s trunk list includes all VLANs except 201-300.

switch(config)# interface ethernet 12
switch(config-if-Et12)# switchport mode trunk
switch(config-if-Et12)# switchport trunk native vlan 15
switch(config-if-Et12)# switchport trunk allowed vlan except 201-300
switch(config-if-Et12)#

Assume that all ports on the switch are configured with switchport mode trunk similar to Ethernet 1 and 2 shown below:
```
!
interface ethernet 1
    switchport mode trunk
!
interface ethernet 2
    switchport mode trunk
!
```

Further assume that vlan 30 is not configured as part of a trunk group.

switch# show vlan
VLAN  Name                             Status    Ports
----- -------------------------------- --------- ----------
1     default                          active    Et1, Et2
30    vlan30                           active    Et1, Et2

Now configure vlan 30 as part of trunk group 30:

switch(config)# vlan 30
switch(config-vlan-30)# trunk group 30

This updates the VLAN membership for vlan 30.

switch# show vlan
VLAN  Name                             Status    Ports
----- -------------------------------- --------- -----------
1     default                          active    Et1, Et2
30    vlan30                           active

Note: Vlan 30 is no longer on Et1, Et2 i.e. it has been ‘pruned’ due to the trunk group command in the vlan configuration.

To permit vlan 30 on Et1, you need to associate the interface with the trunk group as follows:

switch(config-if-Et1)# switchport trunk group 30

Now we see Et1 included in the vlan 30 list

switch# show vlan
VLAN  Name                             Status    Ports
----- -------------------------------- --------- ----------
1     default                          active    Et1, Et2
30    vlan30                           active    Et1

The trunk group command is not additive to the allowed VLAN command.

interface ethernet 1
        switchport mode trunk
        switchport trunk allowed vlan 10
        switchport trunk group trunk30

Vlan 30 will not be permitted on the interface as it is not listed in the allowed 
vlan list.

Dot1q Tunnel Ports

Dot1q (802.1Q) is a tunneling protocol that encapsulates traffic from multiple customer (c-tag) VLANs in an additional single outer service provider (s-tag) VLAN for transit across a larger network structure that includes traffic from all customers. Tunneling eliminates the service provider requirement that every VLAN be configured from multiple customers, avoiding overlapping address space issues.

Tunneling preserves the inner VLANs through the tunneled network; these inner VLANs are ignored by intermediate devices that make forwarding decisions based only on the outermost VLAN tag (S-Tag)

A dot1q-tunnel port sits at the edge of the tunneled network. Unlike regular access ports, a dot1q-tunnel port does not drop traffic that arrives with 802.1Q tags in place; it ignores existing 802.1Q information and associates arriving traffic (with or without 802.1Q headers) with a new tunnel VLAN ID.

Packets arriving at a tunnel port are encapsulated with an additional 802.1Q tag that can be trunked between multiple devices like any traditional VLAN. When exiting a dot1-tunnel port, the S-Tag is removed to revert the customer traffic to its original tagged or untagged state.

To configure an interface group as a dot1q tunnel port, use the switchport mode command.

Example

These commands configure interface ethernet 12 as a dot1q tunnel port.

switch(config)# interface ethernet 12
switch(config-if-Et12)# switchport mode dot1q-tunnel
switch(config-if-Et12)#

To specify the dot1q-tunnel port’s access VLAN, use the switchport access vlan command. The port then handles all inbound traffic as untagged VLAN traffic.

Example

These commands configure vlan 60 as the access VLAN for interface ethernet 12.

switch(config)# interface ethernet 12
switch(config-if-Et12)# switchport access vlan 60
switch(config-if-Et12)#

TPID Configuration

The default Tag Protocol IDentifier (TPID, also called dot1q ethertype) on all switch ports is 0x8100. To configure a different TPID on a port, use the switchport dot1q ethertype command. This feature is available only on 7280E and 7500E platforms.

Note: If dot1q tunneling is enabled on the interface, a TPID configured on the interface becomes irrelevant.

Example

In this provider bridging example, interface ethernet 1 is the user network interface and interface ethernet 2 is the network-to-network interface. These commands configure dot1q tunneling on interface ethernet 1 and set the TPID of interface ethernet 2 to 0x9100.

switch(config)# interface ethernet 1
switch(config-if-Et1)# switchport mode dot1q-tunnel
switch(config-if-Et1)# interface ethernet 2
switch(config-if-Et2)# switchport mode trunk
switch(config-if-Et2)# switchport dot1q ethertype 0x9100
switch(config-if-Et2)#

In the above configuration, packets from Et1 to Et2 will undergo dot1q-tunneling (stacking of an additional dot1q tag), with an outer TPID of 0x9100 at egress, while packets with outer TPID 0x9100 going from Et2 to Et1 will have the outer tag removed at egress.

Layer 2 802.1Q Encapsulation

Layer 2 traffic encapsulation is enabled on the configuration mode interface for a specified VLAN through l2-protocol encapsulation dot1q vlan.

Example

These commands enable traffic encapsulation for vlan 200 traffic passing through interface ethernet 5/2.

switch(config)# interface ethernet 5/2
switch(config-if-Et5/2)# l2-protocol encapsulation dot1q vlan 200

Port VLAN Scaling on DCS-7160

Port VLAN scaling allows the user to configure a subset of ports in the scale mode. The switchport vlan forwarding command forwards packets between the ports belonging to VLAN in the interface configuration mode. Port-VLAN table is used for storing the configuration on a per port/VLAN combination. The scaling configuration is applicable on a per-port basis and supports a maximum of 128 ports.

Note: The configuration is applicable to trunk ports only.

Example

This command enables VLAN scaling on a port with an interface ethernet 2.

switch# config terminal
switch(config)# interface ethernet 2
switch(config-if-Et2)# switchport vlan forwarding accept all

This command disables VLAN scaling on a port.

switch# config
switch(config)# interface ethernet 2
switch(config-if-Et2)# no switchport vlan forwarding accept all

Creating and Configuring VLAN Interfaces

The interface vlan command places the switch in VLAN-interface configuration mode for modifying an SVI. An SVI provides a management address point and Layer 3 processing for packets from all VLAN ports.

Example

This command enters VLAN-interface configuration mode for vlan 12. The command also creates vlan 12 interface if it was not previously created.

switch# config t
switch(config)# interface vlan 12
switch(config-if-Vl12)#

Allocating Internal VLANs

The vlan internal order command specifies the VLANs that the switch allocates as internal VLANs when configuring routed ports and the order of their allocation. By default, the switch allocates VLANs in ascending order. The default allocation range is between VLAN 1006 and VLAN 4094.

The no switchport command converts an Ethernet or port channel interface into a routed port, disabling Layer 2 switching for the interface.

Examples

This command configures the switch to allocate internal VLANs in ascending order starting with 1006.
```
switch(config)# vlan internal order ascending
switch(config)#
```
This command configures the switch to allocate internal VLANs in descending order starting with 4094.
```
switch(config)# vlan internal order descending
switch(config)#
```
This command configures the switch to allocate internal VLANs in descending order from 4094 through 4000.
```
switch(config)# vlan internal order descending range 4000 4094
switch(config)#
```

Private VLAN Configuration

On DCS-7280R, DCS-7280R2, DCS-7500R, DCS-7500R2, DCS-7020R

On systems with algomatch hardware, the access-list mechanism must explicitly be set to TCAM using the following command. Ignore this step when on non-algomatch hardware based systems.
```
switch(config)# hardware access-list mechanism tcam
```
To enable the private VLAN feature, you must also enable the forwarding-ID feature.
```
switch(config)# platform sand l2 forwarding-id sharing
```

On All Platforms

Any regular VLAN can act as a primary without any extra configuration. The only requirement is that the VLAN must be active. Use the following command to configure a VLAN as active or inactive:
```
switch(config)# vlan 100
```
```
switch(config)# no vlan 100
```
```
switch(config)# default vlan 100
```
Configure VLANs as secondary inside the VLAN configuration mode. Use the configuration to specify the primary VLAN as isolated and the type of secondary VLAN:
```
switch(config)# vlan 20
switch(config-vlan-20)# private-vlan isolated primary vlan 10
switch(config)# vlan 30
switch(config-vlan-30)# private-vlan community primary vlan 10
```
Figure 1. Support for Private VLAN
Interfaces are assigned to primary or secondary VLANs in the same way as regular VLANs. It works with both access and trunk ports. The following shows the standard switchport command configuring an access interface to the secondary VLAN configured before:
```
switch(config)# interface ethernet 1/1
switch(config-if-Et1/1)# switchport access vlan 20
```
Trunk ports forward any traffic within the allowed VLANs configured on the interface, whether they are primary or secondary VLANs. To configure trunk ports to translate traffic from primary VLAN to secondary (this maps to the lowest secondary VLAN if multiple are allowed) configure the following on the trunk port:
```
switch(config)# interface ethernet 1/1
switch(config-if-Et1/1)# switchport trunk private-vlan secondary
```

Steps to Unconfigure

On all Platforms

To unconfigure a private VLAN, use the following command. This reverts the VLAN back to a regular VLAN. At this point, the broadcast domain for this VLAN adjusts and all hosts start to be learned in the regular VLAN, as opposed to the primary VLAN. The MAC table entries previously learned on the primary VLAN are not used anymore for forwarding.
```
switch(config-vlan-20)# no private-vlan
```

To restore trunk port behavior to allow traffic on all primary and secondary VLANs:

switch(config)# interface ethernet1/1
switch(config-if-Et1/1)# no switchport trunk private-vlan secondary

On DCS-7280R, DCS-7280R2, DCS-7500R, DCS-7500R2, DCS-7020R

To unconfigure forwarding-id sharing:

switch(config)# no platform sand l2 forwarding-id sharing
Note: This configuration needs the device to be rebooted to take effect.

Configuring VLAN Translation

VLAN translation changes the VLAN ID of specified packets entering or leaving a port. The following sections describe the configuration of VLAN translation.

Per-port VLAN Translation on Switched Ports

The switchport vlan translation command allows translation of the VLAN tag of traffic entering or exiting a switched port.

To use VLAN translation on a switched port, the port must be configured as a trunk port using the switchport mode command.

Examples

This command configures interface ethernet 5 as a trunk port.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport mode trunk
switch(config-if-Et5)#

By default, the translation is bidirectional: packets ingressing an interface through vlan A are internally mapped to vlan B; vlan B packets egressing the same interface are mapped to vlan A.

These commands map interface ethernet 5 traffic with dot1q tag 50 to bridging vlan 60.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport vlan translation 50 60
switch(config-if-Et5)#

These commands provides multiple 1:1 VLAN mappings under an interface.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport vlan translation 50 60
switch(config-if-Et5)# switchport vlan translation 61 71
switch(config-if-Et5)# switchport vlan translation 62 72
switch(config-if-Et5)#

These commands translate only incoming packets.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport vlan translation in 50 60
switch(config-if-Et5)#

These commands translate only egress packets.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport vlan translation out 60 50
switch(config-if-Et5)#

Dropping VLAN Translations

Dropping Mismatched VLAN Translations on a Routed Port

On routed ports, the encapsulation dot1q vlan command, permitted only on routed ports, configures the VLAN on the interface to act as the native VLAN. This command maps packets ingressing with the specified VLAN ID to the internal VLAN ID of the routed port. All traffic egressing out of the routed port tagged with the VLAN ID specified in the command.

Example

These commands translate between vlan 50 and the internal VLAN for interface ethernet 5 (a routed port).

switch(config)# interface ethernet 5
switch(config-if-Et5)# no switchport
switch(config-if-Et5)#encapsulation dot1q vlan 50
switch(config-if-Et5)#

Dropping Unmatched VLAN Translations on an Interface

Configure an Ethernet interface to drop unmatched VLAN translation packets from ingress and egress ports.

Example

Use the following commands to drop invalid VLAN translations from Ethernet1:

switch(config)# interface Ethernet1
switch(config-if-Et2)# switchport vlan translation out required
switch(config-if-Et2)# switchport vlan translation in required

Double VLAN Translation

Double VLAN translation creates mappings between an inner and outer VLAN ID pair of a double-tagged packet and a single bridging VLAN. On ingress, specified double-tagged packets are mapped to the bridging VLAN, and on egress packets with the ID of the bridging VLAN are double tagged as specified. By default, the translation is bidirectional, but it can be applied only on ingress or egress.

Example

These commands causes packets entering interface ethernet 3/1 with an outer VLAN ID of 1000 and an inner VLAN ID of 100 to be processed in bridging vlan 200.

switch(config)# interface ethernet 3/1
switch(config-if-Et3/1)# switchport vlan translation in 1000 inner 100 200
switch(config-if-Et3/1)#

Configuring VLAN Counters

Add VLAN ingress and egress counters that provide the ability to count packets and bytes ingressing or egressing a bridge domain for a VLAN.

Note: Only R Series platforms support this configuration.

Use the following commands to add VLAN ingress and egress counters to the switch:

switch(config)# hardware counter feature vlan in
switch(config)# hardware counter feature vlan out

To display the configuration, use the show hardware counter.

switch(config)# show hardware counter feature
Feature         Direction  Counter Resource (Engine) Status   Detail
--------------- ---------- ------------------------- -------- ------------------------------
Queue           out        Jericho2C+: 16            up       Not user-configurable.
VLAN            out        Jericho2C+: 2             up
VLAN            in         Jericho2C+: 1             up
VOQ             in         Jericho2C+: 0, 8          up       Not user-configurable.

Verify the counter status using the show vlan counters command.

switch# show vlan counters
Vlan                 InOctets          InPkts
Vlan1                       0               0
Vlan100                   186               2
Vlan200                     0               0
Vlan300                    64               1
       
       
Vlan                OutOctets         OutPkts
Vlan1                       0               0
Vlan100                     0               0
Vlan200                   114               1
Vlan300                    70               1

To clear the counter status, use the following command:

switch(config)# clear vlan counters
switch(config)# show vlan counters
            
Vlan                 InOctets          InPkts
Vlan1                       0               0
Vlan100                     0               0
Vlan200                     0               0
Vlan300                     0               0
            
            
Vlan                OutOctets         OutPkts
Vlan1                       0               0
Vlan100                     0               0
Vlan200                     0               0
Vlan300                     0               0

VLAN Configuration Commands

Global VLAN Configuration Commands

interface vlan
vlan
vlan internal order

VLAN Configuration Mode Commands

mac address forwarding
name (VLAN configuration mode)
state
trunk group

Layer 2 Interface (Ethernet and Port Channel) Configuration Commands

switchport access vlan
switchport dot1q ethertype
switchport mode
switchport trunk allowed vlan
switchport trunk group
switchport trunk native vlan
switchport vlan forwarding
switchport vlan translation
switchport vlan translation required

VLAN Interface Configuration Mode Commands

autostate
encapsulation dot1q vlan
l2-protocol encapsulation dot1q vlan
pvlan mapping

Show Commands

show dot1q-tunnel
show interfaces switchport
show interfaces switchport backup-link
show interfaces switchport vlan mapping
show interfaces trunk
show interfaces vlans
show pvlan mapping interfaces
show vlan
show vlan brief count
show vlan counters
show vlan dynamic
show vlan internal allocation policy
show vlan internal usage
show vlan trunk group

autostate

When autostate is enabled, the VLAN interface will be up when:

the corresponding VLAN exists and is in the active state.
one or more Layer 2 ports in the VLAN are up and in spanning-tree forwarding state.
the VLAN interface exists and is not in a shutdown state.

Autostate is enabled by default. When autostate is disabled, the VLAN interface is forced to be active.

The no autostate command disables autostate on the configuration mode interface. The no autostate command is stored to running-config.
The autostate command enables the autostate function on the configuration mode VLAN SVI by removing the corresponding no autostate statement from running-config.
The default autostate command restores the autostate default state of enabled by removing the corresponding no autostate statement from running-config.

Command Mode

Interface-VLAN Configuration

Command Syntax

autostate

no autostate

default autostate

Guidelines

Autostate should be disabled on SVIs configured as an MLAG local interface.

Examples

These commands disable autostate on vlan 100.

switch(config)# interface vlan 100
switch(config-if-Vl100)# no autostate
switch(config-if-Vl100)#

These commands enable autostate on vlan 100.

switch(config)# interface vlan 100
switch(config-if-Vl100)# autostate
switch(config-if-Vl100)#

encapsulation dot1q vlan

Routed Port VLAN Translation

In the configuration mode for an Ethernet or port channel interface, the encapsulation dot1q vlan translates packets with a dot1q header to the internal VLAN for a routed port. The VLAN in the incoming packets is mapped to the internal VLAN of the routed port, and packets egressing the routed port are encapsulated with a dot1q header for the specified VLAN. For egress packets, no priority information is added to the dot1q header and the priority from the incoming encapsulation will be retained.

Subinterface VLAN Assignment

When used in the configuration mode for an Ethernet or port channel subinterface, however, the encapsulation dot1q vlan command assigns a dot1q tag to the subinterface. Traffic ingressing on the parent interface with that dot1q tag will then be sent to the configured subinterface. See Subinterfaces and Subinterface Configuration for details.

The no encapsulation dot1q vlan and default encapsulation dot1q vlan commands restore the default VLAN to the configuration mode interface by removing the corresponding encapsulation dot1q vlan command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-port-channel Configuration

Subinterface-Ethernet Configuration

Subinterface-port-channel Configuration

Command Syntax

encapsulation dot1q vlan vlan_id

no encapsulation dot1q vlan

default encapsulation dot1q vlan

Parameter

vlan_id For VLAN translation, the ID of the external VLAN to be translated; for subinterface configuration, the VLAN of the subinterface. Values range from 1 to 4094.

Examples

These commands translate between vlan 50 and the internal VLAN for interface ethernet 5 (a routed port).

switch(config)# interface ethernet 5
switch(config-if-Et5)# no switchport
switch(config-if-Et5)# encapsulation dot1q vlan 50
switch(config-if-Et5)#

These commands assign packets ingressing on interface ethernet 1/1 with vlan ID 100 to subinterface ethernet 1/1.1.

switch(config)# interface ethernet1/1.1
switch(config-if-Et1/1.1)# no switchport
switch(config-if-Et1/1.1)# encapsulation dot1q vlan 100
switch(config-if-Et1/1.1)#

interface vlan

The interface vlan command places the switch in VLAN-interface configuration mode for modifying parameters of the Switch Virtual Interface (SVI). An SVI provides Layer 3 processing for packets from all ports associated with the VLAN. There is no physical interface for the VLAN.

When entering configuration mode to modify existing SVIs, the command can specify multiple interfaces. The command creates an SVI if the specified interface does not exist prior to issuing the command. When creating an SVI, the command can only specify a single interface.

The no interface vlan command deletes the specified SVI interfaces from running-config. The default interface vlan commands remove all configuration statements for the specified SVI interfaces from running-config without deleting the interfaces.

Command Mode

Global Configuration

Command Syntax

interface vlan v_range

no interface vlan v_range

default interface vlan v_range

Parameter

v_range VLAN interfaces (number, range, or comma-delimited list of numbers and ranges). VLAN number ranges from 1 to 4094.

Restrictions

Internal VLANs: A VLAN interface cannot be created or configured for internal VLAN IDs. The switch rejects any interface vlan command that specifies an internal VLAN ID.

Example

This example creates an SVI for vlan 12:

switch# config
switch(config)# interface vlan 12
switch(config-if-Vl12)#

l2-protocol encapsulation dot1q vlan

The l2-protocol encapsulation dot1q vlan command enables Layer 2 802.1Q traffic encapsulation on the configuration mode interface for a specified VLAN. The default VLAN for all interfaces is VLAN 1.

The no l2-protocol encapsulation dot1q vlan and default l2-protocol encapsulation dot1q vlan commands disable the specified encapsulation on the configuration mode interface by removing the corresponding l2-protocol encapsulation dot1q vlan command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

l2-protocol encapsulation dot1q vlan vlan_id

no l2-protocol encapsulation dot1q vlan

default l2-protocol encapsulation dot1q vlan

Parameter

vlan_id the ID of the native VLAN. Values range from 1 to 4094.

Example

These commands enable 802.1Q encapsulation of traffic on vlan 200.

switch(config)# interface ethernet 5/2
switch(config-if-Et5/2)# l2-protocol encapsulation dot1q vlan 200
switch(config-if-Et5/2)# show active
interface Ethernet5/2
   l2-protocol encapsulation dot1q vlan 200
switch(config-if-Et5/2)#

mac address forwarding

The mac address forwarding command enables a switch to configure a VLAN policy when it receives a packet with an unknown destination MAC address on a VLAN. The command provides three options to configure a VLAN policy:

Flood the Layer 2 miss packets on the VLAN
Drop the Layer 2 miss packets
Log the Layer 2 miss packets to the CPU (while still flooding them on the VLAN)

The default state is to flood the L2 miss packets on all ports of the VLAN.

The show vlan command displays information about the VLAN policy that is being configured.

The no form and the default form of the command removes the previously configured VLAN policy on the VLAN.

Command Mode

VLAN Configuration

Command Syntax

mac address forwarding [unicast | multicast] miss action [drop | flood | log]

no mac address forwarding [unicast | multicast] miss action [drop | flood | log]

default mac address forwarding [unicast | multicast] miss action [drop | flood | log]

Parameters

unicast the unicast type of transmission.
multicast the multicast type of transmission.
drop the selected packets are dropped.
flood the selected packets are flooded in the specific VLAN.
log the selected packets are sent to the CPU for logging purpose.

Guidelines

VLAN policy configuration is supported on the Arista 7010, 7050 (excluding 7050SX3-48YC12, 7050CX3-32S, 7050QX2-32S, 7050SX2-72Q, 7050SX2-128, 7050TX2-128), 7060, 7250, and the 7300 series platforms.

VLAN policy is not supported in the following cases:

STP, LLDP, and LACP packets
VLAN policy configurations on VXLAN-enabled VLAN
On a VLAN if IGMP snooping is configured with Multicast miss action is set to drop, then all multicast packets received on that VLAN are dropped.

Examples

These commands create a vlan 333 and then set the unicast policy to drop and the multicast policy to log for the specific vlan 333.

switch(config)# vlan 333
switch(config-vlan-333)# mac address forwarding unicast miss action drop
switch(config-vlan-333)# mac address forwarding multicast miss action log

These commands display the VLAN policy that was defined when vlan 333 is created.

switch(config)# show vlan 333 mac address forwarding

VLAN  UcMissAction  McMissAction
----  ------------  ------------
 333  flood         flood

These commands display the VLAN policy type that was defined when vlan 333 is configured with the drop unicast policy and the log multicast policy.

switch(config)# show vlan 333 mac address forwarding

VLAN  UcMissAction  McMissAction
----  ------------  ------------
 333  drop          log

switch(config)#show vlan mac address forwarding

VLAN  UcMissAction  McMissAction
----  ------------  ------------
   1  flood         flood
 333  drop          log

name (VLAN configuration mode)

The name command configures the VLAN name. The name can have up to 32 characters. The default name for VLAN 1 is default. The default name for all other VLANs is VLANxxxx, where xxxx is the VLAN number. The default name for vlan 55 is VLAN0055. The show vlan command displays the VLAN name.

The name command accepts all characters except the space.

The no name and default name commands restore the default name by removing the name command from running-config.

Command Mode

VLAN Configuration

Command Syntax

name label_text

no name

default name

Parameter

label_text character string assigned to name attribute. Maximum length is 32 characters. The space character is not permitted in the name string.

Example

These commands assign corporate_100 as the name for vlan 25, then displays the VLAN name.

switch(config)# vlan 25
switch(config-vlan-25)# name corporate_100
switch(config-vlan-25)# show vlan 25
VLAN  Name                             Status    Ports
----- -------------------------------- --------- ---------
25    corporate_100                    active

switch(config-vlan-25)#

pvlan mapping

The pvlan mapping command maps a Switch Virtual Interface (SVI) available in the primary VLAN to the secondary VLAN or VLANs in the VLAN configuration mode. The show pvlan mapping interfaces command displays the list of mapped VLANs.

The no pvlan mapping and default pvlan mapping commands restore the default state of the private VLAN mapping.

Command Mode

VLAN Configuration

Command Syntax

pvlan mapping {add | remove | vlan ID}

no pvlan mapping {add | remove | vlan ID}

default pvlan mapping {add | remove | vlan ID}

Parameters

add adding VLANs to the PVLAN mapping of the current VLAN interface.
remove removing VLANs from the PVLAN mapping of the current VLAN interface.
vlan ID The secondary VLAN IDs of the private VLAN mapping. The IDs range from 1 to 4094.

Related Commands

show pvlan mapping interfaces

Example

These commands assign a secondary VLAN ID of 50 to the primary VLAN.

switch(config)# vlan 25
switch(config-vlan-25)# pvlan mapping 50
switch(config-vlan-25)#

show dot1q-tunnel

The show dot1q-tunnel command displays the ports that are configured in dot1q-tunnel switching mode. The switchport mode command configures the switching mode for the configuration mode interface.

Command Mode

EXEC

Command Syntax

show dot1q-tunnel [INTERFACE]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
loopback l_range Loopback interface specified by l_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.
vlan v_range VLAN interface range specified by v_range.
VXLAN vx_range VXLAN interface range specified by vx_range.
Valid range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the ports that are configured in dot1q-tunnel switching mode.

switch> show dot1q-tunnel
dot1q-tunnel mode LAN Port (s)
------------------------------
Po4
Po21
Po22
switch>

show interfaces switchport backup-link

The show interfaces switchport backup-link command displays interfaces that are configured as switchport backup pairs and the operational status of each interface. For each pair, the command displays the names, roles, status, and VLAN traffic of each interface.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] switchport backup-link

show interfaces switchport backup-link [module {Fabric f_num | Linecard lc_num | Supervisor svr_num | Switchcard | 1-2 | 3-6 }]

Parameters

INTERFACE Interface type and numbers. Options include:
- no parameter Display information for all interfaces.
- ethernet e_range Ethernet interface range specified by e_range.
- loopback l_range Loopback interface specified by l_range.
- management m_range Management interface range specified by m_range.
- port-channel p_range Port-Channel Interface range specified by p_range.
- vlan v_range VLAN interface range specified by v_range.
  Valid e_range, l_range, m_range, p_range, and v_range formats include number, number range, or comma-delimited list of numbers and ranges.
module Displays interfaces of the specified module. Options include:
- Fabric f_num Displays interfaces of the specified fabric module. Value ranges from 1 to 6.
- Linecard lc_num Displays interfaces of the specified linecard module. Value ranges from 3 to 6.
- Supervisor svr_num Displays interfaces of the specified supervisor module. Accepted values are 1 and 2.
- Switchcard Displays interfaces of switchcard modules.
- 1-2 Displays interfaces of the specified supervisor module.
- 3-6 Displays interfaces of the specified linecard module.

Display Values

State Operational status of the interface. Values include:
- Up Spanning tree mode is backup, interface status is up.
- Down Spanning tree mode is backup, interface status is down.
- Inactive Configuration The spanning tree mode is not backup.
Forwarding vlans VLANs forwarded by the interface. Depends on interface operation status and prefer option specified by the switchport backup command.

Examples

This command displays the configured switchport primary-backup pairs.

switch> show interfaces switchport backup-link
Switch backup interface pair: Ethernet3/17, Ethernet3/8
Primary Interface: Ethernet3/17     State:  Inactive Configuration
Backup Interface:  Ethernet3/8      State:  Inactive Configuration
Preemption delay: 0 milliseconds
Mac move burst size: 0
Mac move burst interval: 20 milliseconds
Mac move destination: ff:ff:ff:ff:ff:ff

This command displays interfaces of the module for linecard 4.

switch(config)# show int switchport backup-link module Linecard 4
Switch backup interface pair: Ethernet4/19/1, Ethernet4/19/2
Primary Interface: Ethernet4/19/1   State:  Inactive Configuration
Backup Interface:  Ethernet4/19/2   State:  Inactive Configuration
Preemption delay: 0 milliseconds
Mac move burst size: 0
Mac move burst interval: 20 milliseconds
Mac move destination: ff:ff:ff:ff:ff:ff

show interfaces switchport vlan mapping

The show interfaces switchport vlan mapping command displays mapping information of the configured VLANs in an interface mode.

Command Mode

EXEC

Command Syntax

show interfaces switchport vlan mapping

Examples

This command displays mapping information of the configured VLAN IDs.

switch# show interfaces switchport vlan mapping
--------------
Ethernet3
                                   Direction   Direction
Original Vlan  New Vlan  Status    Configured  Active
-------------- --------- --------- ----------- -----------
10             100       Active    In/Out      In/Out
11             200       Active    In          In
300            12        Active    Out         Out

This command displays dual tag mapping information of the configured VLAN IDs.

switch(config)# show interfaces switchport vlan mapping
--------------
Ethernet3/1
Direction     Direction
Outer Tag     Inner Tag     VLAN ID     Status      Configured    Active Dot1  qTunnel
-----------   -----------   ---------   ---------   -----------   -----------  -----------
1000          100           200         active        In/Out        In/Out      -

1001          101           201         active        In            In          -

1002          102           202         active        Out           Out          -

This command displays dual tag mapping information of the configured VLAN IDs.

switch(config)# show interfaces switchport vlan mapping
--------------
Ethernet1/1
                                                   Direction     Direction 
Outer Tag    Inner Tag     VLAN ID     Status      Configured    Active         
----------- -----------   ---------   ---------   -----------   ----------- 
70            -             300         Active      In/Out        In/Out             
10            50            100         Active      In/Out        In/Out            
20            60            100         Active      In            In                
30            40            200         Active      Out           Out

show interfaces switchport

The show interfaces switchport command displays the switching configuration and operational status of the specified ports.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] switchport

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display the switching status for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
loopback l_range Loopback interface specified by l_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.
vlan v_range VLAN interface range specified by v_range.
Valid e_range, l_range, m_range, p_range, and v_range formats include number, number range, or comma-delimited list of numbers and ranges.

Examples

This command displays the switching status for all interfaces.

switch(config)# show interface switchport
Default switchport mode: access

Name: Et5/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
MAC Address Learning: enabled
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: ALL
Static Trunk Groups: 
Dynamic Trunk Groups: 

Name: Et5/2
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
MAC Address Learning: enabled
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: ALL
Static Trunk Groups: 
Dynamic Trunk Groups: 

[...]

switch(config)#

This command displays the switching status of port channel interfaces 21 and 22.

switch> show interface port-channel 21-22 switchport
Name: Po21
Switchport: Enabled
Administrative Mode: tunnel
Operational Mode: tunnel
Access Mode VLAN: 1 (inactive)
Trunking Native Mode VLAN: 100 (VLAN0100)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: ALL
Trunk Groups: foo

Name: Po22
Switchport: Enabled
Administrative Mode: tunnel
Operational Mode: tunnel
Access Mode VLAN: 1 (inactive)
Trunking Native Mode VLAN: 1 (inactive)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: ALL
Trunk Groups:

switch>

This command displays the configured status of VLAN scaling for the interface ethernet 2/1 port.

switch# show interface Ethernet 2/1 switchport 
Name: Ethernet 2/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
MAC Address Learning: enabled
Dot1q ethertype/TPID: 0x8100 (active)
Dot1q VLAN Tag: Allowed
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: ALL
Static Trunk Groups: 
Dynamic Trunk Groups: 
Source interface filtering: enabled
VLAN forwarding mode: allConfiguredVlans

switch>

show interfaces trunk

The show interfaces trunk command displays configuration and status information for interfaces configured in switchport trunk mode.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] trunk

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.
Valid e_range, m_range, and p_range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the trunk status for all interfaces configured in switchport trunk mode.

switch> show interfaces trunk
Port            Mode            Status          Native vlan
Po1             trunk           trunking        1
Po2             trunk           trunking        1

Port            Vlans allowed
Po1             1-15
Po2             16-30

Port            Vlans allowed and active in management domain
Po1             1-10
Po2             21-30


Port            Vlans in spanning tree forwarding state
Po1             1-10
Po2             21-30

switch>

show interfaces vlans

The show interfaces vlans command displays a table that lists the VLANs that are carried by the specified interfaces. Interfaces that do not carry VLANs are not listed in the table. The table lists the untagged (native or access) and tagged VLANs for each interface.

Command Mode

EXEC

Command Syntax

show interfaces [INT_NAME] vlans

Parameters

INT_NAME Interface type and number. Values include:

ethernet e_num Ethernet interface specified by e_num.
management m_num Management interface specified by m_num.
port-channel p_num Port-Channel Interface specified by p_num.

Example

This command displays the VLANs carried by all L2 ports.

switch> show interfaces vlans
Port       Untagged Tagged
Et9        3910     -
Et11       3912     -
Et16       500      -
Et17       3908     -
Et18       3908     -
Po1        1        101-102,500,721,3000,
Po2        101      -
Po4        3902     -
Po5        3903     -
Po6        3992     -
Po7        661      -
Po8        3911     -

show pvlan mapping interfaces

The show pvlan mapping interfaces command displays information about the private VLAN mapping interfaces.

Command Mode

EXEC

Command Syntax

show pvlan mapping interfaces

Example

This command displays information about the private VLAN mapping interfaces.

switch(config)# int vlan 50
switch(config-if-Vl50)# pvlan mapping 70
switch(config-if-Vl50)# show pvlan mapping interfaces 
Interface    Secondary Vlans
---------    ---------------        
Vlan50       70

show vlan

The show vlan command displays the VLAN ID, name, status, and member ports of all configured VLANs. The command only displays active ports by default; by specifying configured-ports, the command displays all ports that are members of a configured VLAN regardless of their activity status, including Ethernet ports that are members of a port channel.

Command Mode

EXEC

Command Syntax

show vlan [VLAN_LIST] [PORT_ACTIVITY]

Parameters

VLAN_LIST List of VLANs displayed by command. Options include:
- no parameter all VLANs.
- v_range VLANs specified by v_range.
- id v_range VLANs specified by v_range.
- name v_name VLANs specified by the VLAN name v_name.
  v_range formats include number, number range, or comma-delimited list of numbers and ranges.
PORT_ACTIVITY Ports listed in table. Options include:
- no parameter table displays only active ports (same as active-configuration option).
- active-configuration table displays only active ports.
- configured-ports table displays all configured ports.

Display Values

VLAN The VLAN ID.
Name The name of the VLAN.
Status The status of the VLAN.
Ports The ports that are members of the VLAN.

Examples

This command displays status and ports of VLANs 1-1000.

switch> show vlan 1-1000
VLAN  Name                     Status    Ports
----- ------------------------ --------- --------------
1     default                  active    Po1
184   fet.arka                 active    Cpu, Po1, Po2
262   mgq.net                  active    PPo2, Po1
512   sant.test                active    Cpu, Et16, Po1
821   ipv6.net                 active    Cpu, Po1, Po7

switch>

This command displays the list of all the member interfaces under each SVI.

switch# show vlan
VLAN  Name                     Status    Ports
----- ------------------------ --------- ----------------
1     default                  active
2148  VLAN2148                 active    Cpu, Et1, Et26
2700  VLAN2700                 active    Cpu, Et18

show vlan brief count

The show vlan brief count command displays the number of VLANs that are configured on the switch.

Command Mode

EXEC

Command Syntax

show vlan brief count

Example

This command displays the number of VLANs on the switch.

switch> show vlan brief count
Number of existing VLANs           : 18

switch>

show vlan counters

Displays information about configured ingress and egress VLAN counters on the switch.

Configuration Mode

EXEC

Command Syntax

show vlan counters

Example

Use the following command to display VLAN counters configured on the switch:

switch# show vlan counters
Vlan                 InOctets          InPkts
Vlan1                       0               0
Vlan100                   186               2
Vlan200                     0               0
Vlan300                    64               1
                
                
Vlan                OutOctets         OutPkts
Vlan1                       0               0
Vlan100                     0               0
Vlan200                   114               1
Vlan300                    70               1

show vlan dynamic

The show vlan dynamic command displays the source and quantity of dynamic VLANs on the switch. Dynamic VLANs support VM Tracer monitoring sessions.

Command Mode

EXEC

Command Syntax

show vlan dynamic

Example

This command displays the source and quantity of dynamic VLANs on the switch.

switch> show vlan dynamic
Dynamic VLAN source       VLANS
vmtracer-poc              88
switch>

show vlan internal allocation policy

The show vlan internal allocation policy command displays the method the switch uses to allocate VLANs to routed ports. The vlan internal order command configures the allocation method.

The allocation method consists of two configurable components:

range: the list of VLANs that are allocated to routed ports.
direction: the direction by which VLANs are allocated (ascending or descending).

Command Mode

EXEC

Command Syntax

show vlan internal allocation policy

Example

This command displays the internal allocation policy.

switch> show vlan internal allocation policy
Internal VLAN Allocation Policy: ascending
Internal VLAN Allocation Range: 1006-4094
switch>

show vlan internal usage

The show vlan internal usage command shows the VLANs that are allocated as internal VLANs for routed ports.

A routed port is an Ethernet or port channel interface that is configured as a layer 3 interface. Routed ports do not bridge frames and are not members of any VLANs. Routed ports can have IP addresses assigned to them and packets are routed directly to and from the port.

When an interface is configured as a routed port, the switch allocates an SVI with a previously unused VLAN ID. The switch prohibits the configuration of VLANs with numbers corresponding to internal VLAN interfaces allocated to a routed port. VLAN interfaces corresponding to SVIs allocated to a routed port cannot be configured by VLAN interface configuration mode commands.

Command Mode

EXEC

Command Syntax

show vlan internal usage

Example

This command displays the VLANs that are allocated to routed ports.

switch> show vlan internal usage
1006  Ethernet3
1007  Ethernet4
switch>

show vlan trunk group

The show vlan trunk group command displays the trunk group membership of the specified VLANs.

Command Mode

EXEC

Command Syntax

show vlan [ VLAN_LIST ] trunk group

Parameters

VLAN_LIST VLAN list. Options include:

no parameter all VLANs.
v_range VLANs specified by v_range.
id v_range VLANs specified by v_range.
name v_name VLANs specified by the VLAN name v_name.

Display Values

VLAN VLAN ID.
Trunk Groups Trunk groups associated with the listed VLANs.

Example

This command displays the trunk group membership of all configured VLANs.

switch> show vlan trunk group
VLAN     Trunk Groups
----     -------------------------------------
5
10       first_group
12
40       second_group
100      third_group
101      middle_group
102
200

switch>

state

The state command configures the VLAN transmission state of the configuration mode VLAN.

Active state: Ports forward VLAN traffic.
Suspend state: Ports block VLAN traffic.

The default transmission status is active.

The no state command restores the default VLAN transmission state to the configuration mode VLAN by removing the corresponding state command from running-config.

Command Mode

VLAN Configuration

Command Syntax

state OPERATION_STATE

no state

default state

Parameters

OPERATION_STATE VLAN transmission state. Options include:

active VLAN traffic is forwarded.
suspend VLAN traffic is blocked.

Example

These commands suspend VLAN traffic on VLANs 100-102.

switch(config)# vlan 100-102
switch(config-vlan-100-102)# state suspend
switch(config-vlan-100-102)#

switchport access vlan

The switchport access vlan command specifies the access VLAN of the configuration mode interface. Ethernet or port channel interfaces that are in access mode are members of only the access VLAN. Untagged frames that the interface receives are associated with the access VLAN. Frames tagged with the access VLAN are also associated with the access VLAN. The interface drops all other tagged frames that it receives. By default, VLAN 1 is the access VLAN of all Ethernet and port channel interfaces.

An interface's access mode is effective only when the interface is in access mode or dot1q-tunnel mode, as specified by the switchport mode command. Interfaces in dot1q-tunnel mode handle inbound traffic as untagged traffic and associate all traffic with the access VLAN. Interfaces configured to switchport trunk mode maintain and ignore existing switchport access commands.

The no switchport access vlan and default switchport access vlan commands restore VLAN 1 as the access VLAN of the configuration mode interface by removing the corresponding switchport access vlan statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

switchport access vlan v_num

no switchport access vlan

default switchport access vlan

Parameter

v_num number of access VLAN. Value ranges from 1 to 4094. Default is 1.

Example

These commands assign VLAN 100 as the access VLAN to interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport access vlan 100
switch(config-if-Et5)#

switchport dot1q ethertype

The switchport dot1q ethertype command configures the tag protocol identifier (TPID, also known as a dot1q ethertype), of the configuration mode interface. By default, all switch ports use the standard TPID of 0x8100.

The no switchport dot1q ethertype and default switchport dot1q ethertype commands restore the TPID to 0x8100 by removing the corresponding switchport dot1q ethertype statement from running-config.

Command Mode

Interface-Ethernet Configuration

Command Syntax

switchport dot1q ethertype ethertype

no switchport dot1q ethertype

default switchport dot1q ethertype

Parameter

ethertype ethertype number (TPID). Value ranges from 0x600 (1536) through 0xFFFF (65535), and can be entered in decimal or hexadecimal notation. Value is stored and displayed in hexadecimal form; the default value is 0x8100.

Example

These commands configure 0x9100 as the TPID of interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport dot1q ethertype 0x9100
switch(config-if-Et5)#

switchport mode

The switchport mode command specifies the switching mode of the configuration mode interface. The switch supports five switching modes: access, trunk, dot1q-tunnel, tap, and tool.

Access switching mode: The interface is a member of one VLAN, called the access VLAN, as specified by the switchport access vlan command. Tagged frames received on the interface are dropped unless they are tagged with the access VLAN. Frames transmitted from the interface are always untagged.
Trunk switching mode: The interface may be a member of multiple VLANs, as configured by the switchport trunk allowed vlan command. Untagged traffic is associated with the interface's native VLAN, as configured with the switchport trunk native vlan command.
Dot1q-tunnel switching mode: The interface treats all inbound packets as untagged traffic and handles them as traffic of its access VLAN, as specified by the switchport access vlan command.
Tap mode: The interface operates as a tap port. Tap ports receive traffic for replication on one or more tool ports.The interface may be a member of multiple VLANs, as configured by the switchport tap allowed vlan command. Untagged traffic is associated with the interface's native VLAN, as configured with the switchport tap native vlan command.

Tap ports are in STP forwarding state and prohibit egress traffic. MAC learning, control plane interaction and traps for inbound traffic are disabled.

Tool mode: The interface operates as a tool port. Tool ports replicate traffic received by tap ports. The interface may be a member of multiple VLANs, as configured by the switchport tool allowed vlan command. MAC learning, control plane interaction and traps for inbound traffic are disabled.

Tool ports are in STP forwarding state and prohibit ingress traffic that uses port settings.

The status of switchport configured ports depends on the switch’s tap aggregation mode (which can be viewed by using the mode command):

tap aggregation mode enabled: tap and tool ports are enabled. Switching ports are errdisabled.
tap aggregation mode disabled: tap and tool ports are errdisabled. Switching ports are enabled.

The no switchport mode and default switchport mode commands return the configuration mode interface to its default setting as an access port by deleting the corresponding switchport mode command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

switchport mode MODE_TYPE

no switchport mode

default switchport mode

Parameters

MODE_TYPE switching mode of the configuration mode interfaces. Options include:

access access switching mode.
dot1q-tunnel dot1q-tunnel switching mode.
tap tap switching mode.
tool tool switching mode.
trunk trunk switching mode.

Restrictions

Dot1q-tunnel switching mode is not available on Petra platform switches.

Tap aggregation (tap and tool modes) is available on FM6000 and Arad platform switches.

Example

These commands configure interface ethernet 4 as a trunk port.

switch(config)# interface ethernet 4
switch(config-if-Et4)# switchport mode trunk
switch(config-if-Et4)#

switchport trunk allowed vlan

The switchport trunk allowed vlan command creates or modifies the list of VLANs for which the configuration mode interface, in trunk mode, handles tagged traffic. By default, interfaces handle tagged traffic for all VLANs. Command settings persist in running-config without taking effect when the switch is in tap aggregation mode or the interface is not in trunk mode.

The no switchport trunk allowed vlan and default switchport trunk allowed vlan commands restore the trunk mode default allowed VLAN setting of all by removing the corresponding switchport trunk allowed vlan statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

switchport trunk allowed vlan EDIT_ACTION

no switchport trunk allowed vlan

default switchport trunk allowed vlan

Parameters

EDIT_ACTION modifications to the VLAN list.

v_range Creates VLAN list from v_range.
add v_range Adds specified VLANs to current list.
all VLAN list contains all VLANs.
except v_range VLAN list contains all VLANs except those specified.
none VLAN list is empty (no VLANs).
remove v_range Removes specified VLANs from current list.
Valid v_range formats include number, range, or comma-delimited list of numbers and ranges.

Example

These commands create the trunk mode allowed VLAN list of 6-10 for interface ethernet 14, then verifies the VLAN list.

switch(config)# interface ethernet 14
switch(config-if-Et14)# switchport trunk allowed vlan 6-10
switch(config-if-Et14)# show interfaces ethernet 14 switchport
Name: Et14
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Access Mode VLAN: 1 (inactive)
Trunking Native Mode VLAN: 1 (inactive)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: 6-10
Trunk Groups:

switch(config-if-Et14)#

switchport trunk group

The switchport trunk group command assigns the configuration mode interface to the specified trunk group. Trunk group ports handle traffic of the VLANs assigned to the group.

The no switchport trunk group and default switchport trunk group commands remove the configuration mode interface from the specified trunk group by deleting the corresponding statement from running-config. If the command does not specify a trunk group, the interface is removed from all trunk groups to which it is assigned.

Note: On platforms which support the use of port channels as mirror destinations, a port channel which is being used as a mirror destination must not be assigned to an MLAG.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

switchport trunk group [ group_name ]

no switchport trunk group [ group_name ]

default switchport trunk group [ group_name ]

Parameter

group_name trunk group name.

Example

These commands assign port channel 4 to trunk group fe-1.

switch(config)# interface port-channel 4
switch(config-if-Po4)# switchport trunk group fe-1
switch(config-if-Po4)#

switchport trunk native vlan

The switchport trunk native vlan command specifies the trunk mode native VLAN for the configuration mode interface. Interfaces in trunk mode associate untagged frames with the native VLAN. Trunk mode interfaces can also be configured to drop untagged frames. The default native VLAN for all interfaces is VLAN 1.

The no switchport trunk native vlan and default switchport trunk native vlan commands restore vlan 1 as the trunk mode native VLAN to the configuration mode interface by removing the corresponding switchport trunk native vlan command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

switchport trunk native vlan VLAN_ID

no switchport trunk native vlan

default switchport trunk native vlan

Parameters

VLAN_ID the ID of the native VLAN. Options include:
- v_num VLAN number. Value ranges from 1 to 4094.
- tag interface drops all untagged frames.

Example

These commands configure vlan 100 as the native VLAN for port channel 21.

switch(config)# interface port-channel 21
switch(config-if-Po21)# switchport trunk native vlan 100
switch(config-if-Po21)#

switchport vlan forwarding

The switchport vlan forwarding command forwards packets between the ports belonging to VLAN in the interface configuration mode. The scaling configuration is applicable on a per-port basis. In the 7160 platform, the hardware uses a Port-VLAN table for storing the configuration on a per port/VLAN combination and supports a maximum of 128 ports.

Note: The configuration is applicable to trunk ports only.

Command Mode

Interface-Ethernet Configuration

Command Syntax

switchport vlan forwarding [ accept | all ]

Parameters

accept accepts packets for VLAN.
all all VLANs.

Example

This command forwards and accepts all the packets of VLAN of interface ethernet 2.

switch(config)# interface ethernet 2
switch(config-if-Et2)# switchport vlan forwarding accept all
switch(config-if-Et2)#

switchport vlan translation

The switchport vlan translation command allows you to map packets from one VLAN to another using VLAN translation. This is carried out on packets having a dot1q header (tagged frames) only. The translation rewrites the VLAN ID (VID) field in dot1q headers on packets passing through a switched port without changing any other fields.

By default, the translation is bidirectional. The packets ingressing an interface through vlan A are internally mapped to vlan B; vlan B packets egressing the same interface are mapped to vlan A.

To use VLAN translation on a switched port, the port must be configured as a trunk port using the switchport mode command.

VLAN translation on routed ports is accomplished through the encapsulation dot1q vlan command.

The no switchport vlan translation and default switchport vlan translation commands remove VLAN mapping by removing the switchport vlan translation command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Command Syntax

switchport vlan translation [DIRECTION] incoming_vlanid new_vlanid

no switchport vlan translation incoming_vlanid new_vlanid

no switchport vlan translation DIRECTION incoming_vlanid

default switchport vlan translation incoming_vlanid new_vlanid

default switchport vlan translation DIRECTION incoming_vlanid

Parameters

DIRECTION direction of traffic to be translated.
- no parameter translates the specified VLAN IDs for transmitted and received traffic.
- in translates the specified VLAN IDs for received traffic only.
- out translates the specified VLAN IDs for transmitted traffic only.
- incoming_vlanid Enter the VLAN ID to be translated. Value ranges from 1 to 4094.
new_vlanid The new VLAN ID or bridging VLAN ID that will be used internally. Value ranges from 1 to 4094.

Example

These commands translate only incoming packets, changing the VLAN ID to 2008 in the dot1q header of packets ingressing on vlan 201.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport vlan translation in 201 2008 
switch(config-if-Et5)#

These commands translate multiple VLAN mappings on an interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport vlan translation 50 60
switch(config-if-Et5)# switchport vlan translation 61 71
switch(config-if-Et5)# switchport vlan translation 62 72
switch(config-if-Et5)#

switchport vlan translation required

On routed ports, the switchport vlan translation required command (permitted only on routed ports) configures the VLAN on the interface to act as the native VLAN.

Command Mode

Interface-Ethernet Configuration

Command Syntax

switchport vlan translation in|out required

Parameters

in - Ingress packets without a matching VLAN drop from the port.
out - Egress packets without a matching VLAN drop from the port.

Examples

The following command places the switch in switchport configuration mode and sets the requirement that egress VLAN translations must match or drop from the port.
```
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport vlan translation out required
```
The following command places the switch in switchport configuration mode and sets the requirement that ingress VLAN translations must match or drop from the port.
```
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport vlan translation in required
```

trunk group

The trunk group command assigns the configuration mode VLAN to a specified trunk group.

A trunk group is the set of physical interfaces that comprise the trunk and the collection of VLANs whose traffic is carried on the trunk. The traffic of a VLAN that belongs to one or more trunk groups is carried only on ports that are members of trunk groups to which the VLAN belongs. Switchport commands specify the physical interfaces that carry trunk group traffic.

The no trunk group and default trunk group commands remove the configuration mode VLAN from the specified trunk group by removing the corresponding trunk group statement from running-config. If a trunk group is not specified, the commands remove the configuration mode VLAN from all trunk groups.

Command Mode

VLAN Configuration

Command Syntax

trunk group [name]

no trunk group [name]

default trunk group [name]

Parameter

name a name representing the trunk group.

Example

These commands assigns vlan 49 to the trunk group mlagpeer:

switch(config)# vlan 49
switch(config-vlan-49)# trunk group mlagpeer
switch(config-vlan-49)#

vlan

The vlan command places the switch in VLAN configuration mode to configure a set of virtual LANs. The command creates the specified VLANs if they do not exist prior to issuing the command. A VLAN in use as an internal VLAN may not be created or configured. The switch rejects any vlan command that specifies an internal VLAN ID.

The default vlan and no vlan commands removes the VLAN statements from running-config for the specified VLANs.

The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

vlan vlan_range

no vlan vlan_range

default vlan vlan_range

Parameter

vlan_range VLAN list.

Formats include a name, number, number range, or comma-delimited list of numbers and ranges.

Commands Available in VLAN Configuration Mode

name (VLAN configuration mode)
state
trunk group

Guidelines

In MLAG configurations, VLANs operate as follows:

The VLAN must be configured identically on both MLAG peer switches.
The port-specific bridging configuration originates on the switch where the port is physically located. This configuration includes the switchport access VLAN, switchport mode (trunk or access), trunk-allowed VLANs, the trunk native VLAN, and the switchport trunk groups.

Example

This command creates vlan 49 and enters VLAN configuration mode for the new VLAN:

switch(config)# vlan 49
switch(config-vlan-49)#

vlan internal order

The vlan internal order command specifies the range that the switch can allocate as internal VLANs when configuring routed ports and the order of their allocation. By default, the switch allocates VLANs in ascending order from VLAN 1006 to VLAN 4094.

The no vlan internal order and default vlan internal order commands revert the policy to its default.

Command Mode

Global Configuration

Command Syntax

vlan internal order DIRECTION [RANGE_VLAN]

no vlan internal order

default vlan internal order

Parameters

DIRECTION VLAN allocation number direction. Options include:
- ascending allocates internal VLANs from lower VLAN bound to upper VLAN bound.
- descending allocates internal VLAN from upper VLAN bound to lower VLAN bound.
RANGE_VLAN allocation range. Options include:
- no parameter 1006 (lower bound) to 4094 (upper bound).
- range, lower, upper specifies lower bound (lower) and upper bound (upper).

Examples

This command configures the switch to allocate internal VLANS from 3000 through 3999.
```
switch(config)# vlan internal order ascending range 3000 3999
switch(config)#
```
This command configures the switch to allocate internal VLANS from 4094 through 1006.
```
switch(config)# vlan internal order descending
switch(config)#
```
This command configures the switch to allocate internal VLANS from 4094 down through 4000.
```
switch(config)# vlan internal order descending range 4000 4094
switch(config)#
```
This command reverts the allocation policy to its default (ascending, between 1006 and 4094).
```
switch(config)# no vlan internal order
switch(config)#
```

DCBX and Flow Control

This section describes Data Center Bridging Capability Exchange (DCBX) configuration tasks. Topics in this section include:

Introduction
Overview
DCBX Configuration and Verification
Configuring Priority-Flow-Control (PFC)
Configuring PFC Watchdog
DCBX and Flow Control Commands

Introduction

EOS implements Link Layer Discovery Protocol (LLDP) and the Data Center Bridging Capability Exchange (DCBX) protocol to help automate the configuration of Data Center Bridging (DCB) parameters, including the Priority-Based Flow Control (PFC) standard, which allows an end-to-end flow-control feature.

This feature enables a switch to recognize when it is connected to an iSCSI device and automatically configure the switch link parameters (such as priority flow control) to provide optimal support for that device. DCBX can be used to prioritize the handling of iSCSI traffic to help ensure that packets are not dropped or delayed. DCBX is off by default.

Overview

Data Center Bridging Capability Exchange (DCBX)

DCBX works with LLDP to allow switches to exchange information about their Data Center Bridging (DCB) capabilities and configuration and automatically negotiate common Priority-Based Flow Control (PFC) parameters.

Data is exchanged in Type-Length-Value (TLV) format. For DCBX to function on an interface LLDP must be enabled on that interface as well.

Priority-Based Flow Control (PFC)

Priority-Based Flow Control (PFC) uses a new control packet defined in IEEE 802.1Qbb and is not compatible with 802.3x Flow Control (FC). An interface that is configured for PFC will be disabled for FC. When PFC is disabled on an interface, the FC configuration for the interface becomes active. Any FC frames received on a PFC configured interface are ignored.

Each priority is configured as either drop or no-drop. If a priority that is designated as no-drop is congested, the priority is paused. Drop priorities do not participate in pause.

When PFC is disabled, the interface defaults to the IEEE 802.3x flow control setting for the interface. PFC is disabled by default.

PFC Watchdog

The PFC watchdog identifies the egress queues that are unable to transmit packets for a long time due to receiving continuous PFC pause frames. On identifying such stuck tx-queue PFC watchdog error-disables the respective port with a error-disable reason of stuck-queue. When there is an error reported on a port the traffic is re-routed through a different port to the destination.

The PFC watchdog supports the following PFC watchdog configurations:

PFC watchdog forced recovery of queues
PFC watchdog polling interval configuration
PFC Watchdog non-disruptive priorities configuration
Displaying stuck queue and recovery counters

DCBX Configuration and Verification

Set the Priority Rank to the Traffic Class

The dcbx application priority command assigns a priority rank to the specified traffic class in the application priority table. This table is transmitted on each DCBX-enabled interface.

Examples

These commands tell the DCBX peer that iSCSI frames (TCP ports 860 and 3260) should be assigned the given priority of 5.

switch(config)# dcbx application tcp-sctp 860 priority 5
switch(config)# dcbx application tcp-sctp 3260 priority 5

These commands specify a different priority for the two iSCSI traffic ports.

switch(config)# dcbx application tcp-sctp 860 priority 3
switch(config)# dcbx application tcp-sctp 3260 priority 4

This command is equivalent to the dcbx application tcp-sctp command. The DCBX peer that iSCSI frames are assigned are the given the priority 5.
```
switch(config)# dcbx application iscsi priority 5
switch(config)#
```

These commands prevent the peers from sending anything about the iSCSI frames.

switch(config)# no dcbx application tcp-sctp 860 priority 5
switch(config)# no dcbx application tcp-sctp 3260 priority 5

Configuring CEE DCBX Priority Group

The priority-flow-control priority command configures the Enhanced Transmission Selection (ETS) to the specified QoS group, and sets the traffic class priority and the bandwidth percentage for the packets in the traffic class.

Examples

This command configures the ETS to the QoS group map and assigns the CoS map value as 7 and sets traffic class priority to 5.
```
switch(config)# dcbx ets qos map cos 7 traffic-class 5
```
This command configures the ETS to the traffic class and sets the traffic class priority as 7 and bandwidth value to 70 percent.
```
switch(config)# dcbx ets traffic-class 7 bandwidth 70
```

DCBX Verification

To display the DCBX status and the interfaces on which DCBX is enabled, use the show dcbx command.

Example

This command displays the DCBX status for Ethernet 50.

switch# show dcbx Ethernet 50
Ethernet50:
 IEEE DCBX is enabled and active
 Last LLDPDU received on Thu Feb 14 12:06:01 2013
 No priority flow control configuration TLV received
 No application priority configuration TLV received
switch#

Configuring Priority-Flow-Control (PFC)

Enable Priority-Flow-Control (PFC)

The priority-flow-control command enables Priority-Flow-Control (PFC) on an individual port.

Example

The priority-flow-control command in DCBX mode enables PFC on an interface.

switch(config)# interface ethernet 2
switch(config-if-Et2)# priority-flow-control on

Set the Priority Flow Control Priority

The priority-flow-control priority command in DCBX mode creates a priority group that pauses priority. Each priority is configured as either drop or no-drop. If a priority that is designated as no-drop is congested, the priority is paused. Drop priorities do not participate in pause.

Examples

The priority-flow-control priority command in DCBX mode creates a priority group that pauses priority 5 on interface ethernet 2.

switch(config)# interface ethernet 2
switch(config-if-Et2)# priority-flow-control on
switch(config-if-Et2)# priority-flow-control priority 5 no-drop

To enable lossy behavior, use the drop option of the priority-flow-control priority command.

switch(config)# interface ethernet 2
switch(config-if-Et2)# priority-flow-control on
switch(config-if-Et2)# priority-flow-control priority 5 drop

Disable Priority-Flow-Control (PFC)

To disable Priority Flow Control (PFC) on the configuration mode interface and restore the default packet drop setting on the interface, use the priority-flow-control priority command.

Example

To disable PFC, use the no priority-flow-control command.

switch (config)# interface ethernet 2
switch(config-if-Et2)# no priority-flow-control

Configuring PFC Watchdog

Enabling PFC Watchdog

The priority-flow-control pause watchdog default timeout command starts monitoring all the egress queues which have guaranteed bandwidth enabled and for the priorities on which PFC is enabled.

Note: To enable PFC watchdog, user is required to configure guaranteed bandwidth on the tx-queue to be monitored. Also, PFC must be enabled on the port for the traffic flowing into the queue that is being monitored.

Example

These commands enable the PFC watchdog monitoring on tx-queue 3 of Ethernet 1/1, and configures a PFC congestion timeout of 10 seconds which error-disables the port if the queue is stuck.

switch# config
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# priority-flow-control on
switch(config-if-Et1/1)# priority-flow-control priority 3 no-drop
switch(config-if-Et1/1)# tx-queue 3
switch(config-if-Et1/1-txq-3)# bandwidth guaranteed 100
switch(config-if-Et1/1-txq-3)# exit
switch(config-if-Et1/1)# exit
switch(config)# priority-flow-control pause watchdog default timeout 10

Enabling PFC Watchdog Queue Recovery

The priority-flow-control pause watchdog default recovery-time forced command recovers a stuck queue after the PFC storm ceases. PFC watchdog supports the following two recovery methods.

Auto Recovery – recover queue(s) after the PFC storm ceases.
Forced Recovery – recover queue(s) after a fixed duration, irrespective of PFC storm being received.
Note: The default recovery mode is “auto”.

Example

This command recovers a stuck queue after a fixed duration of 10 seconds.

switch(config)# priority-flow-control pause watchdog default recovery-time 10 forced

Configuring PFC Watchdog Polling Interval

The priority-flow-control pause watchdog default polling-interval command configures the frequency at which queues should be checked for stuck or recovery detection. By default, polling interval is calculated internally or it considers the value configured through the CLI.

Note: Configuring a very low polling interval may increase load on the CPU.

Example

This command configures a polling interval of 10 seconds on the switch.

switch(config)# priority-flow-control pause watchdog default polling-interval 10

Displaying Stuck Queue and Recovery Counters

The show priority-flow-control counters watchdog command displays the value of number of times a queue is identified as stuck and recovered. These counters are maintained only for those queues that have PFC watchdog functionality enabled. These counters are cleared when either PFC or PFC watchdog configuration is disabled. Alternatively, show interfaces priority-flow-control counters watchdog command can be used to display the counters.

Examples

This command displays the value of number of times the queue was stuck and recovered for all the interfaces.

switch# show priority-flow-control counters watchdog
Port       TxQ   Total times   Total times
                 stuck         recovered
-------   ----   -----------   -----------
Et1/1      UC2             2             2
Et1/1      UC3             3             3
Et2/1      UC2            12            12
Et2/1      UC3            31            30

This command displays the value of number of times the queue was stuck and recovered for a specific interface. In this case it is Et1/1.

switch# show priority-flow-control interfaces Ethernet 1/1 counters watchdog
Port       TxQ   Total times   Total times
                 stuck         recovered
-------   ----   -----------   -----------
Et1/1      UC2             2             2
Et1/1      UC3             3             3

PFC Watchdog Non-disruptive Priorities

The PFC Watchdog acts to drop the traffic entering or leaving the port at the stuck PFC priority. Later when the queue recovers, this action is reversed. While applying these actions, some traffic (for all priorities) is dropped on that port. In such case, the priority-flow-control pause watchdog hardware non-disruptive priority command can be used to avoid the traffic drop on ports at stuck queues.

This traffic drop can be avoided by configuring specific PFC priorities as non-disruptive. When queues corresponding to these priorities are stuck/recovered, the traffic for other priorities are not impacted.

Examples

This command configures the specific PFC priorities as non-disruptive, and the priority is set to 3.
```
switch(config)# priority-flow-control pause watchdog hardware non-disruptive priority 3
```
This command configures all the ports, having a subset of non-disruptive priorities as a part of their no-drop priorities, start in non-disruptive mode.
```
switch(config)# priority-flow-control pause watchdog hardware port non-disruptive-only
```

Displaying PFC Watchdog Information

The show priority-flow-control command displays the PFC watchdog status information. Note, if the PFC watchdog default timeout value is non-zero then PFC watchdog is active on the switch.

Example

This command displays the PFC watchdog default timeout value, in this show example the timeout value is 3.0 which means the PFC watchdog is active.

switch# show priority-flow-control
The hardware supports PFC on priorities 0 1 2 3 4 5 6 7
The PFC watchdog default timeout is 3.0

Port   Enabled Priorities Active Note 
Et1/1   Yes       34      Yes    DCBX disabled 
Et1/2   Yes       34      Yes    DCBX disabled 
Et1/3   Yes       34      Yes    DCBX disabled 
Et1/4   Yes       34      Yes    DCBX disabled

The show interface status errdisabled command displays the port which is error-disabled due to stuck- queue condition.

Example

This command displays the interface Ethernet Eth1/1 status as errdisabled and the reason.

switch# show interface Eth1/1 status errdisabled

Port            Name          Status         Reason 
---------- ---------------- ----------------- ---------
Et1/1                        errdisabled    stuck-queue

The show priority-flow-control status command displays the current PFC watchdog details.

Example

This command displays the PFC watchdog configuration details at global and interface level.

switch# show priority-flow-control status
The hardware supports PFC on priorities 0 1 2 3 4 5 6 7
The PFC watchdog timeout is 1.0 second(s)
The PFC watchdog recovery-time is 2.0 second(s) (auto)
The PFC watchdog polling-interval is 0.1 second(s)
The PFC watchdog non-disruptive priorities are 3 4
The PFC watchdog port non-disruptive-only is False

E: PFC Enabled, D: PFC Disabled, A: PFC Active, W: PFC Watchdog Enabled
Port     Status  Priorities Note
Et1/1    E A W    1     7   DCBX disabled
Et1/2    E A -              DCBX disabled
Et1/3    D - -
Et1/4    D - -
Et2/1    D - -
.. 
..

DCBX and Flow Control Commands

Configuration Commands

dcbx application priority
dcbx ets
dcbx mode
no priority-flow-control
platform fm6000 pfc-wm
priority-flow-control
priority-flow-control pause watchdog action
priority-flow-control pause watchdog default
priority-flow-control pause watchdog hardware
priority-flow-control priority

Show Commands

show dcbx
show dcbx application-priority-configuration
show dcbx priority-flow-control-configuration
show dcbx status
show interfaces priority-flow-control
show platform fm6000 pfc-wm
show priority-flow-control

dcbx application priority

The dcbx application priority command assigns a priority rank to the specified traffic class in the application priority table. This table is transmitted on each DCBX-enabled interface.

The no dcbx application priority and default dcbx application priority commands remove the specified DCBX traffic class priority assignment by deleting the corresponding dcbx application priority command from running-config. When the command does not specify a traffic class, all DCBX traffic class priority assignments are removed.

Command Mode

Global Configuration

Command Syntax

dcbx application [ APPLICATION_TYPE priority ] rank

no dcbx application [ APPLICATION_TYPE priority ]

default dcbx application [ APPLICATION_TYPE priority ]

Parameters

APPLICATION_TYPE traffic class receiving the priority assignment. Options include:
- ether ethertype_number Ethernet traffic. ethertype_number varies from 1536 to 65535.
- iscsci iSCSCI traffic. Maps to TCP/SCTP ports 860 and 3260.
- tcp-sctp port_number TCP/SCTP traffic. Port number varies from 1 to 65535.
- tcp-sctp-udp port_number TCP/SCTP/UDP traffic. Port number varies from 1 to 65535.
- udp port_number UDP traffic. Port number varies from 1 to 65535.
rank priority assigned to traffic class. Values range from 0 to 7.

Examples

These commands tell the DCBX peer that iSCSI frames (TCP ports 860 and 3260) should be assigned the given priority of 5.

switch(config)# dcbx application tcp-sctp 860 priority 5
switch(config)# dcbx application tcp-sctp 3260 priority 5

These commands specify a different priority for the two iSCSI traffic ports.

switch(config)# dcbx application tcp-sctp 860 priority 3
switch(config)# dcbx application tcp-sctp 3260 priority 4

This command is equivalent to the dcbx application tcp-sctp command. The DCBX peer that iSCSI frames are assigned to is given priority 5.
```
switch(config)# dcbx application iscsi priority 5
switch(config)#
```

These commands prevent the peers from sending anything about the iSCSI frames.

switch(config)# no dcbx application tcp-sctp 860 priority
switch(config)# no dcbx application tcp-sctp 3260 priority

dcbx ets

The dcbx ets command configures the enhanced transmission selection (ETS) to the specified QoS group, and sets the traffic class priority and the bandwidth percentage for the packets in the traffic class.

The no dcbx ets and default dcbx ets commands remove the specified DCBX traffic classs priority assignment by deleting the corresponding dcbx ets command from the running-config.

Command Mode

Global Configuration

Command Syntax

dcbx ets [ qos map cos value traffic-class value | traffic-class value bandwidth value ]

no dcbx ets [ qos map cos value traffic-class value | traffic-class value bandwidth value ]

default dcbx ets [ qos map cos value traffic-class value | traffic-class value bandwidth value ]

Parameters

qos QoS to configure.(The sub options include):
- map QoS map to configure.
- cos CoS value assigned to port. Value ranges from 0 to 7. Default value is 0.
- traffic-class Assigns the traffic-class priority to the QoS map. The value ranges from 0 to 7.
traffic-class Assigns the traffic class priority. The value ranges from 0 to 7. (The sub options include):
- bandwidth The percentage of bandwidth assigned to the packets received from traffic class. The value ranges from 0 to 100 in percentage. The default value is 0.

Examples

This command configures the ETS to the QoS group map and assigns the CoS map value as 7 and sets the traffic class priority to 5.
```
switch(config)# dcbx ets qos map cos 7 traffic-class 5
```
This command configures the ETS to the traffic class and sets the traffic class priority value to 7 and sets the bandwidth value to 70 percent.
```
switch(config)# dcbx ets traffic-class 7 bandwidth 70
```

dcbx mode

The dcbx mode command enables DCBX mode on the configuration mode interface. The switch supports IEEE P802.1Qaz. When DCBX is enabled, two TLVs are added to outgoing LLDPDUs, which instruct the peer on the interface to configure PFC (priority flow control) and the application priority table in the same way as the switch.

The no dcbx mode, default dcbx mode, and dcbx mode none commands disable DCBX on the configuration mode interface by removing the corresponding dcbx mode command from running-config.

Command Mode

Interface-Ethernet Configuration

Command Syntax

dcbx mode MODE_NAME

no dcbx mode

default dcbx mode

Parameters

MODE_NAME Specifies the DCBX version. Options include:

ieee IEEE version.
cee Converged Enhanced Ethernet version.
none DCBX is disabled.

Examples

These commands enable interface ethernet 2 to use IEEE DCBX.

switch(config)# interface ethernet 2
switch(config-if-Et2)# dcbx mode ieee
switch(config-if-Et2)#

These commands disable DCBX on interface ethernet 2.

switch(config)# interface ethernet 2
switch(config-if-Et2)# dcbx mode none
switch(config-if-Et2)

no priority-flow-control

The no priority-flow-control and default priority-flow-control commands disable the priority flow control (PFC) on the configuration mode interface and restore the default packet drop setting on the interface, which takes effect when PFC is re-enabled. The commands delete all corresponding priority-flow-control commands from running-config.

Command Mode

Interface-Ethernet Configuration

Command Syntax

no priority-flow-control

default priority-flow-control

Example

These commands disable Priority Flow Control (PFC) on interface ethernet 3.

switch(config)# interface ethernet 3
switch(config-if-Et3)# no priority-flow-control
switch(config-if-Et3)#

priority-flow-control

The priority-flow-control command enables Priority Flow Control (PFC) on the configuration mode interface to pause selected traffic classes.

The no priority-flow-control and default priority-flow-control commands disable PFC on the configuration mode interface by deleting the corresponding priority-flow-control command from running-config. The priority-flow-control priority command also disables PFC on the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Command Syntax

priority-flow-control on

no priority-flow-control on

default priority-flow-control on

Examples

These commands enable PFC on interface ethernet 3.

switch(config)# interface ethernet 3
switch(config-if-Et3)# priority-flow-control on
switch(config-if-Et3)#

These commands disable PFC on interface ethernet 3.

switch(config)# interface ethernet 3
switch(config-if-Et3)# no priority-flow-control
switch(config-if-Et3)#

platform fm6000 pfc-wm

The platform fm6000 pfc-wm command configures the hardware buffer space allocated to the Priority Flow Control (PFC) RX-Private buffer. The command provides options to configure the buffer size and specify when PFC frames are sent to request that a neighbor stop sending traffic. The default values are as follows:

RX-Private: 18400 bytes
on (watermark): 9280 bytes
off (watermark): 1600 bytes

Values that are entered in the command are rounded up to the closest multiple of 160. The RX-Private value must be greater than the off value, which must be larger than the on value.

The no platform fm6000 pfc-wm and default platform fm6000 pfc-wm commands restore the default settings by removing the platform fm6000 pfc-wm command from running-config.

Command Mode

Global Configuration

Command Syntax

platform fm6000 pfc-wm [ RX-PRIVATE_SIZE ][ PFC-ON_WM ][ PFC-OFF_WM ]

no platform fm6000 pfc-wm

default platform fm6000 pfc-wm

The platform fm6000 pfc-wm command must explicitly configure at least one parameter.

Parameters

RX-PRIVATE_SIZE Specifies size of rx-private buffer. Options include:
- no parameter rx-private buffer retains previously configured size.
- rx-private 18268 to 102400 Size of rx-private buffer (bytes).
PFC-ON_WM Buffer capacity that triggers the switch to send PFC frames. Options include:
- no parameter Parameter retains previously configured value.
- on 9134 to 102400 Buffer capacity that triggers PFC frames (bytes).
PFC-OFF_WM Buffer capacity that triggers the switch to stop PFC frame transmissions. Options include:
- no parameter Parameter retains previously configured value.
- off 1536 to 102400 Buffer capacity that turns off PFC frames.

Related Command

show platform fm6000 pfc-wm displays the PFC RX-Private buffer memory allocations.

Example

This command configures the rx-private hardware buffer.

switch(config)# platform fm6000 pfc-wm rx-private 24800 on 16000 off 3200
switch(config)#

priority-flow-control pause watchdog action

The priority-flow-control pause watchdog action command either drops the traffic on a stuck queue, or error disables the port which has a stuck queue, or notifies if there is no action on the stuck queue. The following actions are performed based on the queue status.

The no priority-flow-control pause watchdog action command removes the specified priority-flow-control pause watchdog action configuration by deleting the corresponding priority-flow-control pause watchdog action command from running-config.

Command Mode

Global Configuration

Command Syntax

priority-flow-control pause watchdog action

no priority-flow-control pause watchdog action

Parameters

action PFC watchdog action for stuck transmit queues. Options include.

drop Drop traffic on the stuck queue.
errdisable Error disable port which has the stuck transmit queue.
notify-only No action on the stuck queue.

Guidelines

Before enabling the PFC watchdog configuration, configure the guaranteed bandwidth on the tx-queue to be monitored. Also, enable the PFC on the port for the PFC priorities for the traffic flowing into the queue that is being monitored.

Example

These commands enables the pfc-watchdog monitoring on tx-queue 3 of Ethernet 1/1, and configures a PFC watchdog action drop and drops the traffic if the queue is a stuck queue.

switch# config
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# priority-flow-control on
switch(config-if-Et1/1)# priority-flow-control priority 3 no-drop
switch(config-if-Et1/1)# tx-queue 3
switch(config-if-Et1/1-txq-3)# bandwidth guaranteed 100
switch(config-if-Et1/1-txq-3)# exit
switch(config-if-Et1/1)# exit
switch(config)# priority-flow-control pause watchdog action drop

priority-flow-control pause watchdog default

The priority-flow-control pause watchdog default command monitors all the egress queues which have guaranteed bandwidth enabled and for the priorities on which PFC is enabled. Guaranteed bandwidth is needed to ensure starvation due to higher priority traffic is not wrongly flagged as a stuck-queue due to congestion. The stuck duration after which the port needs to be error disabled is also configurable.

The no priority-flow-control pause watchdog default command removes the specified priority-flow-control pause watchdog configuration by deleting the corresponding priority-flow-control pause watchdog command from running-config.

Command Mode

Global Configuration

Command Syntax

priority-flow-control pause watchdog default

no priority-flow-control pause watchdog default

Parameters

default Specifies the default value. Options include.

polling-interval Configures the interval at which the watchdog should poll the queues. The polling interval value ranges from 0.005 to 30 seconds.
recovery-time Configures recovery-time after which stuck queue should recover and start forwarding. The recovery-time value ranges from 0.01 to 60 seconds.
- forced Force recover any stuck queue(s) after the recovery-time interval, irrespective of whether PFC frames are being received or not.
timeout Configures timeout after which port should be errdisabled or should start dropping on congested priorities. The timeout value ranges from 0.01 to 60 seconds.

Guidelines

Polling Interval Discrepancy
For user configured polling-interval to be valid, it must satisfy the following conditions
When the recovery-mode is auto and timeout, recovery-time, and polling-interval are non-default, polling-interval <= min (timeout, recovery-time) / 2,
When recovery-mode is forced or recovery-time is not configured, polling-interval <= (timeout / 2)
For better functioning of PFC Watchdog, when user configured polling interval is too large compared to either timeout or recovery time values, Watchdog will use auto calculated value instead of user configured value until the discrepancy is resolved. Also, CLI warning and syslog messages are generated to inform user of the discrepancy.

CLI Warnings

When there is discrepancy between timeout and polling-interval, the format of the message is as shown below:

! User configured polling interval <user-cfgd polling-interval> second(s) is 
greater than half of timeout <user-cfgd timeout> second(s). Setting 
polling-interval to <to-be-used polling-interval> second(s)

When there is discrepancy between recovery-time and polling-interval, the format of the message is as shown below

! User configured polling interval <user-cfgd polling-interval> second(s) is 
greater than half of recovery-time <user-cfgd recovery-time> second(s). Setting 
polling-interval to <to-be-used polling-interval> second(s)

Examples

These commands enable the pfc-watchdog monitoring on tx-queue 3 of interface ethernet1/1, and configures a PFC congestion timeout of 10 seconds which error-disables the port if the queue is stuck.

switch# config
switch(config)# interface ethernet1/1
switch(config-if-Et1/1)# priority-flow-control on
switch(config-if-Et1/1)# priority-flow-control priority 3 no-drop
switch(config-if-Et1/1)# tx-queue 3
switch(config-if-Et1/1-txq-3)# bandwidth guaranteed 100
switch(config-if-Et1/1-txq-3)# exit
switch(config-if-Et1/1)# exit
switch(config)# priority-flow-control pause watchdog default timeout 10

These commands enable the pfc-watchdog monitoring on tx-queue 3 of interface ethernet1/1, and configures a PFC forced recovery-time interval of 30 seconds after which the stuck queue(s) are recovered, irrespective of whether PFC frames are being received or not.

switch# config
switch(config)# interface ethernet1/1
switch(config-if-Et1/1)# priority-flow-control on
switch(config-if-Et1/1)# priority-flow-control priority 3 no-drop
switch(config-if-Et1/1)# tx-queue 3
switch(config-if-Et1/1-txq-3)# bandwidth guaranteed 100
switch(config-if-Et1/1-txq-3)# exit
switch(config-if-Et1/1)# exit
switch(config)# priority-flow-control pause watchdog default recovery-time 30 forced

These commands enable the pfc-watchdog monitoring on tx-queue 3 of Ethernet 1/1, and configures a PFC polling-interval of 20 seconds after which queue is polled.

switch# config
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# priority-flow-control on
switch(config-if-Et1/1)# priority-flow-control priority 3 no-drop
switch(config-if-Et1/1)# tx-queue 3
switch(config-if-Et1/1-txq-3)# bandwidth guaranteed 100
switch(config-if-Et1/1-txq-3)# exit
switch(config-if-Et1/1)# exit
switch(config)# priority-flow-control pause watchdog default polling-interval 20

priority-flow-control pause watchdog hardware

The priority-flow-control pause watchdog hardware command configures specific PFC priorities as non-disruptive. This will avoid traffic drop on queues corresponding to these priorities are stuck/recovered, the traffic for other priorities are not impacted.

The no priority-flow-control pause watchdog hardware command removes the specified priority-flow-control pause watchdog non-disruptive configuration by deleting the corresponding priority-flow-control pause watchdog hardware command from running-config.

Command Mode

Global Configuration

Command Syntax

priority-flow-control pause watchdog hardware

no priority-flow-control pause watchdog hardware

Parameters

hardware Configure PFC priority through hardware. Options include:

non-disruptive PFC watchdog non-disruptive configuration. The priority value ranges from 0 to 7.

Guidelines

Example

These commands enable the pfc-watchdog monitoring on tx-queue 3 of interface ethernet 1/1, and configures PFC priorities as non-disruptive on PFC priorities 3 and 4.

switch# config
switch(config)# interface ethernet1/1
switch(config-if-Et1/1)# priority-flow-control on
switch(config-if-Et1/1)# priority-flow-control priority 3 no-drop
switch(config-if-Et1/1)# tx-queue 3
switch(config-if-Et1/1-txq-3)# bandwidth guaranteed 100
switch(config-if-Et1/1-txq-3)# exit
switch(config-if-Et1/1)# exit
switch(config)# priority-flow-control pause watchdog hardware non-disruptive priority 3 4

priority-flow-control priority

The priority-flow-control priority command configures the packet resolution setting on the configuration mode interface. This setting determines if packets are dropped when priority flow control (PFC) is enabled on the interface. Packets are dropped by default.

The no priority-flow-control priority and default priority-flow-control priority commands restore the default packet drop setting on the configuration mode interface by deleting the corresponding priority-flow-control priority command from running-config. The priority-flow-control priority command also restores the default setting on the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Command Syntax

priority-flow-control priority pack-drop

no priority-flow-control priority

default priority-flow-control priority

Parameters

pack-drop denotes the interfaces. Options include:

drop Packets are dropped. Default setting.
no drop Packets are not dropped.

Examples

These commands in DCBX mode create a priority group that pauses dot1p priority 5 on interface ethernet 2.

switch(config)# interface ethernet 2
switch(config-if-Et2)# priority-flow-control on
switch(config-if-Et2)# priority-flow-control priority 5 no-drop

These commands enable lossy behavior.

switch(config)# interface ethernet 2
switch(config-if-Et2)# priority-flow-control on
switch(config-if-Et2)# priority-flow-control priority 5 drop

These commands remove the priority group that pauses dot1p priority 5 on interface ethernet 2.

switch(config)# interface ethernet 2
switch(config-if-Et2)# priority-flow-control on
switch(config-if-Et2)# no priority-flow-control priority

show dcbx

The show dcbx command list DCBX status and the interfaces on which DCBX is enabled.

Command Mode

EXEC

Command Syntax

show dcbx [INTERFACE]

Parameters

INTERFACE Interface type and number. Options include:

no parameter all configured DCBX interfaces.
ethernet e-num Ethernet interface specified by e-num.

Examples

This command displays the DCBX status for ethernet 50.

switch# show dcbx ethernet 50
Ethernet50:
  IEEE DCBX is enabled and active
  Last LLDPDU received on Thu Feb 14 12:06:01 2013
  No priority flow control configuration TLV received
  No application priority configuration TLV received
switch#

This command displays the DCBX status for ethernet 50 when Priority Flow Control (PFC) is not enabled.

switch# show dcbx ethernet 50
Ethernet50:
  IEEE DCBX is enabled and active
  Last LLDPDU received on Thu Feb 14 12:08:29 2013
  - PFC configuration: willing
    not capable of bypassing MACsec
    supports PFC on up to 4 traffic classes
    PFC enabled on priorities: 5 7
    WARNING: peer PFC configuration does not match the local PFC configuration
  - Application priority configuration:
    2 application priorities configured:
      tcp-sctp 860 priority 5
      tcp-sctp 3260 priority 5
switch#

show dcbx application-priority-configuration

The show dcbx application-priority-configuration command displays the DCBX peer application priority configuration.

Command Mode

EXEC

Command Syntax

show dcbx [INTERFACE] application-priority-configuration

Parameters

INTERFACE Interface type and number. Options include:

no parameter All configured DCBX interfaces.
ethernet e-num Ethernet interface specified by e-num.

Guidelines

This command and the show priority-flow-control command function identically.

Example

This command displays the DCBX peer application priority configuration for all DCBX-enabled interfaces.

switch# show dcbx application-priority-configuration
Ethernet1:
  Last LLDPDU received on Thu Feb 14 10:52:20 2013
  No application priority configuration TLV received
Ethernet2:
  Last LLDPDU received on Thu Feb 14 10:52:20 2013
  No application priority configuration TLV received
...
Ethernet50:
  Last LLDPDU received on Thu Feb 14 12:08:29 2013
  - Application priority configuration:
    2 application priorities configured:
      tcp-sctp 860 priority 5
      tcp-sctp 3260 priority 5
switch#

show dcbx priority-flow-control-configuration

The show dcbx priority-flow-control-configuration command displays the IEEE DCBX peer priority flow control configurations.

Command Mode

EXEC

Command Syntax

show dcbx [ INTERFACE ] priority-flow-control-configuration

Parameters

INTERFACE Interface type and number. Options include:

no parameter all configured DCBX interfaces.
ethernet e-num Ethernet interface specified by e-num.

Example

This command displays the DCBX peer priority flow control configuration for the DCBX-enabled interfaces on the device.

switch# show dcbx priority-flow-control-configuration 
Ethernet1:
  Last LLDPDU received on Thu Feb 14 10:52:20 2013
  No priority flow control configuration TLV received
Ethernet2:
  Last LLDPDU received on Thu Feb 14 10:52:20 2013
  No priority flow control configuration TLV received
...
Ethernet50:
  Last LLDPDU received on Thu Feb 14 12:11:29 2013
  - PFC configuration: willing
    not capable of bypassing MACsec
    supports PFC on up to 4 traffic classes
    PFC enabled on priorities: 5 7
    WARNING: peer PFC configuration does not match the local PFC configuration
switch#

show dcbx status

The show dcbx status command displays the DCBX status on the interfaces on which DCBX is enabled.

Command Mode

EXEC

Command Syntax

show dcbx [INTERFACE] status

Parameters

INTERFACE Interface type and number. Options include:

no parameter all configured DCBX interfaces.
ethernet e-num Ethernet interface specified by e-num.

Example

This command displays the DCBX status for the DCBX-enabled interfaces.

switch# show dcbx status  
Ethernet1:
  Last LLDPDU received on Thu Feb 14 10:52:20 2013
Ethernet2:
  Last LLDPDU received on Thu Feb 14 10:52:20 2013
Ethernet50:
  IEEE DCBX is enabled and active
  Last LLDPDU received on Thu Feb 14 12:11:54 2013
switch#

show interfaces priority-flow-control

The show interfaces priority-flow-control command displays the status of PFC on all interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [ INTERFACE ] priority-flow-control [ INFO_LEVEL ]

Parameters

INTERFACE Interface type and numbers. Options include:
- no parameter Display information for all interfaces.
- ethernet e_range Ethernet interface range specified by e_range.
- loopback l_range Loopback interface specified by l_range.
- management m_range Management interface range specified by m_range.
- port-channel p_range Port-Channel Interface range specified by p_range.
- vlan v_range VLAN interface range specified by v_range.
- VXLAN vx_range VXLAN interface range specified by vx_range.
  Valid range formats include number, number range, or comma-delimited list of numbers and ranges.
INFO_LEVEL specifies the type of information displayed. Options include:
- no parameter Displays information about all DCBX neighbor interfaces.
- status Displays the DCBX status.
- counters Displays the DCBX counters.

Guidelines

This command and the show priority-flow-control command function identically.

Example

This command displays the PFC for all interfaces.

switch# show interfaces priority-flow-control 
The hardware supports PFC on priorities 0 1 2 3 4 5 6 7

Port    Enabled Priorities Active Note
Et1     No                 No
Et2     No                 No
...
Et50    Yes          5     Yes
...
Port                 RxPfc           TxPfc
Et1                      0               0
Et2                      0               0
...
Et50                     0               0
...
switch#

show platform fm6000 pfc-wm

The show platform fm6000 pfc-wm command displays the buffer space allocated to the RX-Private buffer and buffer levels that trigger PFC frame transmission activities.

Command Mode

Privileged EXEC

Command Syntax

show platform fm6000 pfc-wm

Related Command

priority-flow-control priority specifies the PFC RX-Private buffer memory allocation.

Example

This command displays the rx-private hardware buffer memory allocation.

switch# show platform fm6000 pfc-wm
Pfc_Rx_Private_WM: 24800 Bytes
Pfc_On_WM: 16000 Bytes
Pfc_Off_WM: 3200 Bytes
switch#

show priority-flow-control

The show priority-flow-control command displays the status and other PFC and PFC watchdog information on all interfaces if no specific interface is specified.

Command Mode

EXEC

Command Syntax

show priority-flow-control [ status | counters | interfaces ]

Parameters

interfaces specifies the interface for which the information is displayed. Options include:
- Ethernet Hardware Ethernet interface.
- Loopback Loopback interface.
- Management Management interface.
- Port-Channel Lag interface.
- Recirc-Channel Recirculation interface.
- Tunnel Tunnel interface.
- Vlan VLAN interface.
- VXLAN VXLAN Tunnel Interface.
status displays the interface PFC status.
counters displays the interface PFC counters. Options include:
- detail displays the DCBX counters for each priority class. This option is available only on Trident switches.
- watchdog displays the PFC watchdog counters.

Examples

This command displays the PFC status on all interfaces.

switch# show priority-flow-control
The hardware supports PFC on priorities 0 1 2 3 4 5 6 7
Port    Enabled Priorities Active Note                                          
Et1     No                 No                                                   
Et2     No                 No                                                   
...
Et50    Yes          5     Yes                                                  
...
Port                 RxPfc           TxPfc
Et1                      0               0
Et2                      0               0
...
Et50                     0               0
...

This command displays the PFC watchdog status. If PFC watchdog default timeout is non-zero (in this case it is 3.0) then PFC watchdog is actively running on the switch.

switch# show priority-flow-control
The hardware supports PFC on priorities 0 1 2 3 4 5 6 7
The PFC watchdog default timeout is 3.0

Port   Enabled Priorities Active Note 
Et1/1   Yes       34      Yes    DCBX disabled 
Et1/2   Yes       34      Yes    DCBX disabled 
Et1/3   Yes       34      Yes    DCBX disabled 
Et1/4   Yes       34      Yes    DCBX disabled
...

This command displays the current value of these counters for all the interfaces being monitored by PFC watchdog. Alternatively, show interfaces priority-flow-control counters watchdog command can be used for the same.

switch# show priority-flow-control counters watchdog
Port       TxQ   Total times   Total times
                 stuck         recovered
-------   ----   -----------   -----------
Et1/1      UC2             2             2
Et1/1      UC3             3             3
Et2/1      UC2            12            12
Et2/1      UC3            31            30

This command displays the current value of these counters for a specific subset of interfaces. Alternatively, show interfaces priority-flow-control counters watchdog command can be used for the same.

switch# show priority-flow-control interfaces ethernet 1/1 counters watchdog
Port       TxQ   Total times   Total times
                 stuck         recovered
-------   ----   -----------   -----------
Et1/1      UC2             2             2
Et1/1      UC3             3             3

This command displays the configuration details of PFC watchdog at global and interface level.

switch# show priority-flow-control status
The hardware supports PFC on priorities 0 1 2 3 4 5 6 7
The PFC watchdog timeout is 1.0 second(s)
The PFC watchdog recovery-time is 2.0 second(s) (auto)
The PFC watchdog polling-interval is 0.1 second(s)
The PFC watchdog non-disruptive priorities are 3 4
The PFC watchdog port non-disruptive-only is False

E: PFC Enabled, D: PFC Disabled, A: PFC Active, W: PFC Watchdog Enabled
Port     Status  Priorities Note
Et1/1    E A W    1     7   DCBX disabled
Et1/2    E A -              DCBX disabled
Et1/3    D - -
Et1/4    D - -
Et2/1    D - -
..

IP Address Locking

EOS provides IP Address Locking capabilities when configured on an Ethernet Layer 2 port.

After enabling IP Address Locking on a Layer 2 (L2) port, the port only permits IP and ARP packets with authorized IP source addresses. Configure IP Address Locking in one of two modes:

IPv4
IPv6

IP Address Locking prevents a host on a different interface from claiming ownership of an IP address through ARP spoofing. IPv6 Locking extends this behavior to IPv6 packets, including ICMPv6 Neighbor Discovery Router Advertisement and Redirect and DHCP server-to-client packets.

On an IPv4 Locked Port, the ARP protocol performs the following actions on the network:

Probing with the IPv4 address 0.0.0.0 as the Sender Protocol Address (SPA).
Permit Duplicate Address Detection (DAD).
Drop incoming DHCP server response packets to avoid any rogue devices acting as DHCP servers.
Permit incoming DHCP client request packets on devices to complete the DHCP handshake and obtain a DHCP lease.

On an IPv6 Locked Port, the ARP protocol performs the following actions on the network:

Drop incoming DHCPv6 server response packets.
Permit incoming DHCPv6 client request packets.
On an incoming ICMPv6 network device, perform the following actions:
- Drop Router Advertisement packets since only routers should send these packets.
- Permit Router Solicitation packets.
- Drop redirect packets as only routers should send these packets.
Figure 1. IP Address Locking

IP Address Locking relies on DHCP LeaseQuery and MAC address learning to determine if an IP address is authorized on a particular port. Ensure that DHCP servers used in the network allow LeaseQuery messages.

This chapter describes IP Address Locking configuration tasks and associated commands.

IP Address Locking Configuration
IP Address Locking Commands

IP Address Locking Configuration

This section describes IP Locking configuration tasks. Topics in this section include:

Preparing a Switch for IP Address Locking
Enabling IP Address Locking
Disabling IP Address Locking
Enabling IP Address Locking on Ports
Enabling IP Address Locking on All Ports of a VLAN
Blocking IPv4 and ARP Packets
Configuring IP Locking Static Leases
Configuring IP Address Locking Lease Query Timeout
Configuring Locked Address Expiration
Enforcing Locked IP Addresses
Displaying IP Address Locking Counters
Displaying IP Address Locking

Preparing a Switch for IP Address Locking

Before enabling IPv4 Address Locking, you must configure a DHCP Server and a Local Layer 3 interface.

Enabling a DHCP Server for IPv4 Address Locking

Add the DHCP servers used by hosts to acquire leases. IPv4 Address Locking communicates with the DHCP servers to learn the authorized IP addresses on the switch.

Example

The following commandsenable DHCP servers with an IPv4 address of 10.1.1.1, and another DHCP server with the IP address, 10.30.1.3:

switch(config-address-locking)# dhcp server ipv4 10.1.1.1
switch(config-address-locking)# dhcp server ipv4 10.30.1.3

Adding a Local Layer 3 Interface

Add a local L3 interface to communicate with the DHCP server. This could be the management interface, a routed interface, or a Switch Virtual Interface (SVI). This interface requires an assigned valid IP address, routable to the configured DHCP server, and can reside in a non-default VRF. The switch packets sent to the DHCP Server use the interface IP address as the source IP address.

Example

The following commandsconfigure an interface with a valid IP address, 10.10.1.2/16, on VLAN2160:

switch# configure
switch(config)# interface Vlan2160
switch(config-if-Vl2160)# ip address 10.10.1.2/16

The following commands add the interface to the IP Address Locking configuration:

switch# configure 
switch(config)# address locking
switch(config-address-locking)# local-interface Vlan2160

Enabling IP Address Locking

Configure IP Address Locking for either IPv4 or IPv6 addresses, and both types of IP addresses can be enabled for IP Address Locking. IPv6 Address Locking requires a different approach outlined in this section.

Enabling IP Address Locking

Configure IPv4 Address Locking commands in the configuration mode.

Example

Use the following commands to enter IP Address Locking configuration mode and add IPv4 Address Locking:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv4

Enabling IPv6 Address Locking

To enable IPv6 locking, disable the enforcement of IPv6 Address Locking.

Example

Use the following commands to disable IPv6 Address Locking enforcement, and then enable IPv6 for IP Address Locking:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv6 enforcement disabled
switch(config-address-locking)# locked-address ipv6

Disabling IP Address Locking

Disable IP Address Locking using the disabled command in address-locking mode. This turns off the feature and allows a host to use any IP address, authorized or unauthorized, on any port.

Example

switch# configure
switch(config)# address locking
switch(config-address-locking)# disabled

Enabling IP Address Locking on Ports

To enable IPv4 Address Locking on ports connected to clients, IP Address Locking must be enabled in the interface configuration mode. Running this command only enables IPv4 Locking and overrides the previous configuration for the interface.

Example

Use the following commands to enable IP Address Locking for the interface, Ethernet27/1:

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# address-family ipv4

Use the following commands to enable IPv6 Address Locking on ports connected to clients, use the address-family ipv6 parameter.

Example

To activate IPv6 Address Locking on interface Ethernet53 and port 4, use the following syntax:

switch(config)# interface Ethernet53/4
switch(config-if-Et53/4)# address locking
switch(config-if-Et53/4-address-locking)# address-family ipv6

Enabling IP Address Locking on All Ports of a VLAN

To activate IP Address Locking on all VLAN port members, use the VLAN address locking configuration submode.

Examples

The following commands activate IPv4 Address Locking on VLAN 20:

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# address-family ipv4

To exclude a VLAN port member, disable IP Address Locking on that port using the interface configuration submode.

The following commands exclude port 25 on Ethernet2:

switch(config)# interface Ethernet2/25
switch(config-if-Et2/25)# address locking
switch(config-if-Et2/25)# address-family ipv4 disabled

To configure IPv6 Address Locking on all ports, use the same commands, but designate the address-family as ipv6.

The following commands enable IPv6 Address Locking and override the previous configuration for the interface.

switch(config)# interface Ethernet 27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# address-family ipv6

To enable IPv6 Address Locking on all members of a port for VLAN 20, use the IPv6 Locking commands in the VLAN address locking configuration sub-mode.

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# address-family ipv6

Use the following command to enable both IPv4 and IPv6 Address Locking on a port:

switch(config)# interface Ethernet 27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# address-family ipv4 
switch(config-if-Et27/1-address-locking)# address-family ipv6

Blocking IPv4 and ARP Packets

Use the deny ip_address on IPv4 Address Locking ports to block all IPv4 and ARP packets with a specific source IPv4 address. The port denies the packet and affects only IPv4 enforcement modes. This action deauthorizes the addresses on the port and can be configured with multiple IPv4 addresses. You must configure this on an interface already configured with IPv4 Address Locking.

Note: Use only IPv4 addresses with this configuration.

Example

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-addr-lock)# deny 172.21.16.25

Configuring IP Locking Static Leases

The lease mac command within address locking configuration mode installs a lease into hardware for the configured IP address on the interface with the configured associated MAC address. If the MAC address does not appear in the MAC table or the MAC address on an interface without a configured IP Locking feature, the lease does not install until the interface adds the MAC address to an interface configured with IP Locking.

Note: IP Locking removes from the switch any lease from the DHCP server that matches either the same IP or MAC as a statically configured lease.

Example

Use the following commands to configure an IP address, 172.21.13.11, and MAC Address, a0:ce:c8:b1:78:d3, with a static lease:

switch# configure
switch(config)# address locking
switch(config-address-locking)# lease 172.21.13.11 mac a0:ce:c8:b1:78:d3

Clearing Leases

The clear address locking lease command removes the lease from hardware. The command removes lease bindings at different granularities.

The clear address locking lease ipv4 V4ADDR command removes a single lease associated with an IPv4 address.
The clear address locking lease ipv6 V6ADDR command removes a single lease associated with an IPv6 address.
The clear address locking lease intf ethernet slot command removes all leases associated with the specified interface.
The clear address locking lease all removes all leases on the switch.

Configuring IP Address Locking Lease Query Timeout

The command, lease query retry interval interval timeout minutes configures sending lease queries at specific retry intervals. The no lease query retry command removes the retry interval and timeout configuration.

Example

Use the following commands to configure an interval, 5, and timeout of 100 minutes :

switch(config)# address locking
switch(config-address-locking)# lease query retry interval 5 timeout 100

IP Address Locking sends out DHCP LeaseQuery requests to all configured DHCP servers in the following cases:

When an IP Address Locking enabled port learns a MAC address, IP Address Locking sends out a LeaseQuery request for the learned MAC address. After learning the MAC address, IP Address Locking waits one (1) second for the DHCP.
When an IP Address Locking enabled port removes a MAC address after enabling the locked-address expiration mac disabled feature, IP Address Locking sends a LeaseQuery request for the removed MAC address.
When the IP Address Locking agent restarts, EOS sends LeaseQuery requests for all MAC addresses on all IP Address Locking interfaces and for all MAC addresses in the IP Address Locking table.
When you add a new DHCP configuration, EOS sends new LeaseQuery requests to the new DHCP for all MAC addresses learned on all IP Address Locking interfaces and for all MAC addresses in the IP Address Locking leases table.
When you configure an interface with IP Address Locking, IP Address Locking sends LeaseQuery requests for all MAC addresses learned on that interface.
When an IP or ARP packet with a source IP address that does not exist in the IP Address Locking table arrives at an interface, EOS sends LeaseQuery requests for all MAC addresses on that interface. If the host already has a valid DHCP lease and the DHCP server sends a LeaseActive reply, IP Address Locking sends at least one (1) request every 50 seconds for that host as a result of dropped ARP or IP packets.
When the DHCP Lease reaches the last known expiration time, IP Address Locking sends out a LeaseQuery request for the MAC address associated with the lease. Note that this may be different from the actual expiration time. For example, if the host renewed the lease before the actual lease expires and received no LeaseQuery requests sent for the MAC address, IP Address Locking sends out a query at the original expiration time.
After a LeaseActive reply receives a matching MAC address of a previously received lease, IP Address Locking sends out a LeaseQuery request for the previous IP address associated with the updated MAC address.
After a LeaseActive reply receives a matching MAC address of a previously received lease, IP Address Locking sends out a LeaseQuery request for the previous MAC address associated with the updated IP address.

When IP Address Locking sends out a LeaseQuery request, and does not receive a LeaseActive reply, IP Address Locking sends six (6) additional retries over 64 seconds using an exponential backoff algorithm. A 0-25% delay sending requests which may take up to 80 seconds to send out all seven (7) requests.

Every LeaseQuery request includes a transaction ID. After sending the last request, and for an additional 10 seconds, IP Address Locking accepts any LeaseActive reply matching the transaction ID and then queries for the MAC address of a sent LeaseQuery request.

If a LeaseActive reply contains multiple IP addresses, IP Address Locking begins a query process for the additional IP addresses using the same retry mechanisms. However, if you configure the LeaseQuery retry interval and timeout but do not receive LeaseActive replies, IP Address Locking sends continuous lease query requests at the configured retry interval until reaching the specified timeout period.

Configuring Locked Address Expiration

The IP addresses remain authorized and installed after the corresponding MAC addresses age out. IP Address Locking, by default, removes authorized leases after the corresponding MAC addresses age out. The locked-address expiration mac disabled command configures IP Address Locking to keep leases installed, after the corresponding MAC addresses age out.

Example

The following commands keep leases installed on the IP address:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address expiration mac disabled

Enforcing Locked IP Addresses

The locked-address ipv4 enforcement disabled command disables address filtering for all ports with IPv4 Address Locking enabled. This permits IPv4 packets while still keeping all other drop rules. When configured, IP Address Locking does not drop IP or ARP packets, and does not send out lease queries to configured DHCP servers.

Examples

The following commands disable IPv4 Address Locking globally:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv4 enforcement disabled

The following commands configure locked address enforcement for an interface:

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# locked-address ipv4 enforcement disabled

The following commands configure locked address enforcement for a VLAN:

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# locked-address ipv4 enforcement disabled

The locked-address ipv6 enforcement disabled command disables address filtering for all ports with IPv6 Locking enabled. This permits IPv6 packets while still keeping all other drop rules.

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv6 enforcement disabled

To configure locked address enforcement for an interface, use the following commands:

switch(config)# interface Ethernet27/1
switch(config-if-Et27/1)# address locking
switch(config-if-Et27/1-address-locking)# locked-address ipv6 enforcement disabled

To configure locked address enforcement for VLAN 20, use the following commands:

switch(config)# vlan 20
switch(config-vlan-20)# address locking
switch(config-vlan-20-addr-lock)# locked-address ipv6 enforcement disabled

Displaying IP Address Locking Counters

The show address locking counters command displays DHCP lease query messages sent, received, and dropped. The output provides two sets of counters:

The number of packets sent and received from each DHCP server.
The number of packets sent and received for each locked interface.

The output displays separate counters for the different types of messages communicated between the switch and the DHCP server.

Example

switch# show address locking counters
Lease Active Lease Unknown Lease Unassigned    	 
DHCP Server Query  Rcvd   Drop   Rcvd   Drop Rcvd     Drop    Unknown
----------- ----- ----- ------ ------ ------ -------- ------- -------
80.80.80.80 32860  8002 34     8001   32     13423     134    3234
            
            
Interface Query Lease Active Lease Unknown Lease Unassigned
--------- ----- ------------ ------------- ----------------
Ethernet2  1747 1234         189           324

The clear address locking counters command resets all the counters associated with IP Locking to zero.

Displaying IP Address Locking

Use the show address locking command to display the status of IPv4 and IPv6 locking.

Example

switch# show address locking
IP Locking is active
Interface        IPv4	                 IPv6
--------------- -------------------   ---------------------------
Ethernet27/1     yes 	                 no (not configured) 
Ethernet31/1     no (not configured)   no (not a layer 2 interface)

The show address locking command also displays interfaces with the reason IP Address Locking may not be enabled. For an interface without IP Address Locking enabled, the following priority (highest at top) imposes on the output:

Unconfigured.
Not a Layer 2 interface.
No local interface configured.
No DHCP server configured.

The show address locking table ipv4 command displays all the DHCP leases that IP Address Locking knows about, current status of installed leases, and the authorized interfaces for these IP addresses.

Example

switch# show address locking table ipv4
IP Address     MAC Address      Interface  Installed    Expiration Time
-------------- ---------------- ---------- ------------ --------------- 
10.30.4.4      ba76.a467.7ff8   Et27/1     installed     in 0:01:57

IP Address Locking Commands

IP Address Locking Configuration Commands

address locking deny
address locking dhcp
address-locking disable
address locking lease query
address locking local-interface

IP Address Locking Clear Commands

clear address locking lease

IPv4 Static Lease Commands

address locking lease

IP Address Locking Address Expiration Commands

locked-address expiration mac disabled

IP Address Locking Address Enforcement Commands

locked-address ipv4 enforcement disabled
locked-address ipv6 enforcement disabled

IP Address Locking Show Commands

show address locking
show address locking counters
show address locking table ipv4

address locking deny

Use the address locking command to block IPv4 and ARP packets with specific IPv4 addresses on the switch. You must perform this command from an interface configured for IP Address Locking on the switch.

Command Mode

Interface Configuration

Address Locking Configuration

Command Syntax

address locking deny ip_address

Parameter

ip_address - Specify the IPv4 address to block packets.

Example

Use the following command to deny IPv4 and ARP packets from IPv4 address, 172.16.21.131, from Ethernet interface, Ethernet53/4:

switch(config)# interface Ethernet53/4
switch(config-if-Et53/4)# address locking 
switch(config-address-locking)# deny 172.16.21.131

address locking dhcp

Use the address locking command to enter address locking mode and then dhcp to configure the DHCP server.

Command Mode

Address Locking Configuration

Command Syntax

address locking dhcp server ipv4 ip_address

Parameters

dhcp server - configure a DHCP server to assign IP addresses and assign static addresses using a MAC address.
- ipv4 ip_address - Specify the IP address for the DHCP server.
- mac mac_address - Specify the MAC address of the DHCP server.

Example

To configure a DHCP server with an IPv4 address. 172.13.21.3, use the following command:

switch(config)# address locking 
switch(config-address-locking)# dhcp server ipv4 172.13.21.3

address-locking disable

The address-locking disable command disables IP Address Locking on a switch.

Command Mode

Address Locking Configuration

Command Syntax

address-locking disable

Example

Use the address-locking command to enter address locking mode and then disable to disable the configuration.

switch(config)# address-locking
switch(config-address-locking)# disable

address locking lease

Use the address locking command to enter the IPv4 and IPv6 locking mode and then on the switch, use the lease to configure DHCP leases.

The lease mac command within the address locking configuration mode installs a lease onto hardware for the configured IP address on the interface with the associated configured MAC address. If the MAC address does not exist in the MAC table or the MAC address appears on an interface with an IP Locking configuration feature, the lease does not install until you add the MAC address to an interface configured with IP Locking.

Command Mode

Address Locking Configuration

Command Syntax

lease ip_address mac ip_address

Parameters

lease
- V4ADDR - Specify the IPv4 address to assign the lease.
- mac MACADDR - Configure the MAC address for a static lease.
no lease V4ADDR mac MACADDR - Removes the retry and timeout configuration.
default lease V4ADDR mac MACADDR - Configures the lease with the default IPv4 address and MAC address.

Example

To configure a lease with the IPv4 address, 1.1.1.1, and the MAC address, a.b.c, use the following command:

switch(config)# address locking 
switch(config-address-locking)# lease 1.1.1.1 mac a.b.c

address locking lease query

Use the address locking command to enter the IPv4 and IPv6 locking mode and then use the lease query retry interval to configure DHCP leases.

The no lease query retry command removes the retry interval and timeout configuration.

Command Mode

Address Locking Configuration

Command Syntax

lease query retry interval interval-time

Parameters

interval interval-time - Configure the query retry interval and timeout. The interval can be from 1 - 4294967295 seconds.

Example

To configure a lease with the retry interval, 5 seconds, and a timeout, 100, use the following command:

switch(config)# address locking
switch(config-address-locking)# lease query retry interval 5 timeout 100

address locking local-interface

Use the address locking local-interface command to configure a local interface for IPv4 and IPv6 locking IP addresses on the switch.

Command Mode

Address Locking Configuration

Command Syntax

Parameters

local-interface
- Ethernet slot_number - Configure an Ethernet subinterface for IPv4 and IPv6 locking IP addresses on the switch.
- Loopback loopback_interface_number - Configure a Loopback interface for IPv4 and IPv6 locking IP addresses on the switch.
- Management management_interface slot_number - for IPv4 and IPv6 locking IP addresses on the switch.
- Port-Channel lag_group port_channel_subinterface - Configure a Port-Channel interface for IPv4 and IPv6 locking IP addresses on the switch.
- Tunnel tunnel_interface - Configure a Tunnel interface for IPv4 and IPv6 locking IP addresses on the switch.
- Vlan vlan_interface_number - Configure a VLAN interface for IPv4 and IPv6 locking IP addresses on the switch.

Example

To configure an Ethernet interface, Ethernet53/4, use the following command:

switch(config)# address locking
switch(config-address-locking)# local-interface Ethernet53/4

clear address locking lease

Use the clear address locking lease command to remove lease bindings at different granularities.

The clear address locking lease ipv4 V4ADDR command removes a single lease associated with an IPv4 address.
The clear address locking lease ipv6 V6ADDR command removes a single lease associated with an IPv6 address.
The clear address locking lease intf ethernet slot command removes all leases associated with the specified interface.
The clear address locking lease all command remove all leases on the switch.

Command Mode

Address Locking mode

Command Syntax

clear address locking lease [ all | interface [ ethernet slot ] | ipv4 V4ADDR | ipv6 V6ADDR ]

Parameters

all- View the entire lease table.
interface- interface to clear the lease.
- ethernet slot - Ethernet interface slot number.
ipv4 V4ADDR- IPv4 address of the lease
ipv6 V6ADDR - IPv6 address of the lease

Example

Use the following command to clear all IP Address Locking leases from the switch:

switch(config-address-locking)# clear address locking lease all

locked-address expiration mac disabled

IP Address Locking, by default, removes authorization from leases after the corresponding MAC addresses age out. Use the locked-address expiration mac disabled command to configure IP Address Locking to keep the leases installed, even after the corresponding MAC addresses age out.

Command Mode

Address Locking Configuration

Command Syntax

locked-address expiration mac disabled

no locked-address expiration mac disabled

default locked-address expiration mac disabled

Parameters

expiration - Configures expiration mode for locked addresses.
mac - Configures deauthorizing locked addresses when MAC addresses age out.
disabled - Disables deauthorizing locked address when MAC addresses age out.

Example

Use this command to disable locked address expiration:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address expiration mac disabled

locked-address ipv4 enforcement disabled

The locked-address ipv4 enforcement disabled command disables address filtering for all ports with IPv4 Locking enabled. This permits IPv4 packets while still keeping all other drop rules.

Command Mode

Address Locking Configuration

Command Syntax

locked-address ipv4 enforcement disabled

no locked-address ipv4 enforcement disabled

default locked-address ipv4 enforcement disabled

Parameters

ipv4 - Configure the IP address family.
enforcement - Configure enforcement for locked addresses.
disabled - Disable enforcement for locked addresses.

Example

Use the following command to disable locking address enforcement for IPv4 addresses:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv4 enforcement disabled

locked-address ipv6 enforcement disabled

The locked-address ipv6 enforcement disabled command disables address filtering for all ports with IPv6 Locking enabled. This permits IPv6 packets while retaining all other drop rules.

Command Mode

Address Locking Configuration

Command Syntax

locked-address IPv6 enforcement disabled

no locked-address IPv6 enforcement disabled

default locked-address IPv6 enforcement disabled

Parameters

ipv6 - IPv6 address configuration.
enforcement - Configure enforcement for locked addresses.
disabled - Disable enforcement for locked addresses.

Example

Use the following command to disable locking address enforcement for IPv6 addresses:

switch# configure
switch(config)# address locking
switch(config-address-locking)# locked-address ipv6 enforcement disabled

show address locking

Use the show address locking command to display the status of IP and IPv6 locking.

The show address locking command also displays the reason as to why IP Locking is not enabled for an interface. For an interface without IP Locking enabled, the following priority (highest at top) apply to the output:

Interface not configured.
Interface is not a Layer 2 interface.
No local interface configured.
No DHCP server configured.

Command Mode

EXEC

Command Syntax

show address locking

Example

To display information about IP locking, use the show address locking command:

switch# show address locking
         
IP Locking is active
Interface        IPv4	                 IPv6
--------------- -------------------   ---------------------------
Ethernet27/1     yes 	                 no (not configured) 
Ethernet31/1     no (not configured)    no (not a layer 2 interface)

show address locking counters

The show address locking counters command displays DHCP lease query messages sent, received, and dropped. Two sets of counters display in the output:

Number of packets sent and received from each DHCP server.
Number of packets sent and received for each locked interface.

IP Locking uses separate counters for different kinds of messages communicated between the switch and the DHCP server.

Command Mode

EXEC

Command Syntax

show address locking counters

Related Commands

The clear address locking counters command resets all the counters associated with IP Locking to zero.

Example

The following command displays IP Address Locking Counters:

switch# show address locking counters
Lease Active Lease Unknown Lease Unassigned    	 
DHCP Server Query  Rcvd   Drop   Rcvd   Drop Rcvd     Drop    Unknown
----------- ----- ----- ------ ------ ------ -------- ------- -------
80.80.80.80 32860  8002 34     8001   32     13423     134    3234
            
            
Interface Query Lease Active Lease Unknown Lease Unassigned
--------- ----- ------------ ------------- ----------------
Ethernet2  1747 1234         189           324

show address locking table ipv4

Use the show address locking table ipv4 command to display all DHCP leases with IP Locking, and the interfaces with authorized the IP addresses.

Command Mode

EXEC

Command Syntax

Parameters

dynamic - Display the dynamic leases.
- installed-Display the leases installed on the hardware.
- interface - Display the leases on a specified interface.
installed - Display installed leases.
interface - Display the leases on a specified interface.
- Ethernet slot Specified Ethernet sub-interface.
static - Display static leases.
- installed - Display the leases on the hardware.
- interface - Display the leases on a specified interface.
  - Ethernetslot Specified Ethernet sub-interface.

Example

switch# show address locking table ipv4
IP Address     MAC Address      Interface  Installed    Expiration Time
-------------- ---------------- ---------- ------------ --------------- 
AC 10.30.4.4   ba76.a467.7ff8   Et27/1     installed     in 0:01:57 

  IP Address       Action
---------------   --------
10.30.4.4         permit

Layer 2 Protocol Forwarding

EOS supports Layer2 (L2) Protocol Forwarding on Ethernet interfaces in addition to Type-5 PW. Also, EOS allows selective forwarding of certain L2 Protocol packets, such as tagged, untagged, and all, instead of forwarding all LACP frames, both tagged and untagged. The protocol list for L2 Protocol Forwarding also supports PAUSE, LACP, LLDP, MACsec, and STP. Additionally, L2PF supports the Per-VLAN Spanning Tree (PVST) protocol to forward, drop, or trap PVST packets on Type-2 platforms. EOS enables drop support for all supported protocols.

Configuring L2 Protocol Forwarding

Use the following commands to create a profile that allows forwarding tagged/untagged/all types of PAUSE/LACP/LLDP/MACSEC/STP/E-LMI/ ISIS/micro-BFD frames.

switch(config-l2-protocol)# forwarding profile abc
switch(config-l2-protocol-abc)# isis forward
switch(config-l2-protocol-abc)# macsec tagged forward
switch(config-l2-protocol-abc)# pause untagged forward
switch(config-l2-protocol-abc)# exit

The following commands apply the profile to an interface or subinterface:

switch(config)# int ethernet1/1
switch(config-if-Et1/1)# l2-protocol forwarding profile abc
switch(config-if-Et1/1)# exit
switch(config)# int ethernet2/1.1
switch(config-if-Et2/1.1)# l2-protocol forwarding profile def
switch(config-if-Et2/1.1)# exit

TCAM Profile

A specific TCAM profile is required to configure L2 Protocol Forwarding profiles except if the L2 Protocol Forwarding profile has only ‘lacp forward’ and is configured on Type-5 PW ports on Type-1 platforms. One such TCAM profile is as follows:

switch(config)# hardware tcam
switch(config-tcam)# profile l2protocolfwd
switch(config-tcam-profile-12protocolfwd)# feature acl port ip
switch(config-tcam-feature-acl-port-ip)# sequence 45
switch(config-tcam-feature-acl-port-ip)# key size limit 160
switch(config-tcam-feature-acl-port-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-port-ip)# action count drop
switch(config-tcam-feature-acl-port-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-acl-port-ip)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-ip)# feature acl port ipv6
switch(config-tcam-feature-acl-port-ipv6)# sequence 25
switch(config-tcam-feature-acl-port-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-ops-3b l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-port-ipv6)# action count drop
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-ipv6)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-ipv6)# feature acl port mac
switch(config-tcam-feature-acl-port-mac)# sequence 55
switch(config-tcam-feature-acl-port-mac)# key size limit 160
switch(config-tcam-feature-acl-port-mac)# key field dst-mac ether-type src-mac
switch(config-tcam-feature-acl-port-mac)# action count drop
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet mpls forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet non-ip forwarding bridged
switch(config-tcam-feature-acl-port-mac)# feature acl subintf ip
switch(config-tcam-feature-acl-subintf-ip)# sequence 40
switch(config-tcam-feature-acl-subintf-ip)# key size limit 160
switch(config-tcam-feature-acl-subintf-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-subintf-ip)# action count drop
switch(config-tcam-feature-acl-subintf-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-subintf-ip)# feature acl subintf ipv6
switch(config-tcam-feature-acl-subintf-ipv6)# sequence 15
switch(config-tcam-feature-acl-subintf-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-subintf-ipv6)# action count drop
switch(config-tcam-feature-acl-subintf-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-subintf-ipv6)# feature acl vlan ip
switch(config-tcam-feature-acl-vlan-ip)# sequence 35
switch(config-tcam-feature-acl-vlan-ip)# key size limit 160
switch(config-tcam-feature-acl-vlan-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-vlan-ip)# action count drop
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# feature acl vlan ipv6
switch(config-tcam-feature-acl-vlan-ipv6)# sequence 10
switch(config-tcam-feature-acl-vlan-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6)# action count drop
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ipv6)# feature acl vlan ipv6 egress
switch(config-tcam-feature-acl-vlan-ipv6-egress)# sequence 20
switch(config-tcam-feature-acl-vlan-ipv6-egress)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6-egress)# action count drop
switch(config-tcam-feature-acl-vlan-ipv6-egress)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6-egress)# feature counter lfib
switch(config-tcam-feature-counter-lfib)# sequence 85
switch(config-tcam-feature-counter-lfib)# feature l2-protocol forwarding
switch(config-tcam-feature-l2-protocol-fowarding)# sequence 95
switch(config-tcam-feature-l2-protocol-fowarding)# key size limit 160
switch(config-tcam-feature-l2-protocol-fowarding)# key field dst-mac vlan-tag-format
switch(config-tcam-feature-l2-protocol-fowarding)# action mirror redirect-to-cpu set-tc
switch(config-tcam-feature-l2-protocol-fowarding)# packet non-ip forwarding bridge
switch(config-tcam-feature-l2-protocol-fowarding)# packet non-ip forwarding bridged sub-interface
switch(config-tcam-feature-l2-protocol-fowarding)# feature mirror ip
switch(config-tcam-feature-mirror-ip)# sequence 80
switch(config-tcam-feature-mirror-ip)# key size limit 160
switch(config-tcam-feature-mirror-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-mirror-ip)# action count mirror set-policer
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-mirror-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-mirror-ip)# feature mpls
switch(config-tcam-feature-mpls)# sequence 5
switch(config-tcam-feature-mpls)# key size limit 160
switch(config-tcam-feature-mpls)# action drop redirect set-ecn
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-mpls)# feature mpls pop ingress
switch(config-tcam-feature-mpls-pop-ingress)# sequence 90
switch(config-tcam-feature-mpls-pop-ingress)# feature pbr ip
switch(config-tcam-feature-pbr-ip)# sequence 60
switch(config-tcam-feature-pbr-ip)# key size limit 160
switch(config-tcam-feature-pbr-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control
switch(config-tcam-feature-pbr-ip)# action count redirect
switch(config-tcam-feature-pbr-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-pbr-ip)# feature pbr ipv6
switch(config-tcam-feature-pbr-ipv6)# sequence 30
switch(config-tcam-feature-pbr-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-pbr-ipv6)# action count redirect
switch(config-tcam-feature-pbr-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-pbr-ipv6)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# sequence 65
switch(config-tcam-feature-pbr-mpls)# key size limit 160
switch(config-tcam-feature-pbr-mpls)# key field mpls-inner-ip-tos
switch(config-tcam-feature-pbr-mpls)# action count drop redirect
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-pbr-mpls)# feature qos ip
switch(config-tcam-feature-qos-ip)# sequence 75
switch(config-tcam-feature-qos-ip)# key size limit 160
switch(config-tcam-feature-qos-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-qos-ip)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-qos-ip)# feature qos ipv6
switch(config-tcam-feature-qos-ipv6)# sequence 70
switch(config-tcam-feature-qos-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
switch(config-tcam-feature-qos-ipv6)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-qos-ipv6)# feature tunnel VXLAN
switch(config-tcam-feature-tunnel-VXLAN)# sequence 50
switch(config-tcam-feature-tunnel-VXLAN)# key size limit 160
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN forwarding bridged decap

For ISIS protocol forwarding, “snoop” action has to be present in the TCAM profile for l2-protocol forwarding feature as follows:

switch(config-tcam)# feature l2-protocol forwarding
switch(config-tcam-l2-protocol forwarding)# sequence 95
switch(config-tcam-l2-protocol forwarding)# key size limit 160
switch(config-tcam-l2-protocol forwarding)# key field dst-mac vlan-tag-format
switch(config-tcam-l2-protocol forwarding)# action mirror redirect-to-cpu set-tc snoop
switch(config-tcam-l2-protocol forwarding)# packet non-ip forwarding bridged
switch(config-tcam-l2-protocol forwarding)# packet non-ip forwarding bridged sub-interface

For the special case of micro-BFD protocol forwarding, the following TCAM profile needs to be applied:

switch(config)# hardware tcam
switch(config-tcam)# profile l2protocolfwd-bfd-rfc-7130
switch(config-tcam-profile l2protocolfwd-bfd-rfc-7130)# feature acl port ip egress mpls-tunnelled-match
switch(config-tcam-feature-acl-port-ip-egress-mpls-tunnelled-match)# sequence 95
switch(config-tcam-feature-acl-port-ip-egress-mpls-tunnelled-match)# feature acl port ipv6 egress
switch(config-tcam-feature-acl-port-ipv6-egress)# sequence 105
switch(config-tcam-feature-acl-port-ipv6-egress)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-port-ipv6-egress)# action count drop mirror
switch(config-tcam-feature-acl-port-ipv6-egress)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-ipv6-egress)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-ipv6-egress)# feature acl port mac
switch(config-tcam-feature-acl-port-mac)# sequence 55
switch(config-tcam-feature-acl-port-mac)# key size limit 160
switch(config-tcam-feature-acl-port-mac)# key field dst-mac ether-type src-mac
switch(config-tcam-feature-acl-port-mac)# action count drop mirror
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet mpls forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet non-ip forwarding bridged
switch(config-tcam-feature-acl-port-mac)# feature acl subintf ip
switch(config-tcam-feature-acl-subintf-ip)# sequence 40
switch(config-tcam-feature-acl-subintf-ip)# key size limit 160
switch(config-tcam-feature-acl-subintf-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-subintf-ip)# action count drop
switch(config-tcam-feature-acl-subintf-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-subintf-ip)# feature acl subintf ipv6
switch(config-tcam-feature-acl-subintf-ipv6)# sequence 15
switch(config-tcam-feature-acl-subintf-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-subintf-ipv6)# action count drop
switch(config-tcam-feature-acl-subintf-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-subintf-ipv6)# feature acl vlan ip
switch(config-tcam-feature-acl-vlan-ip)# sequence 35
switch(config-tcam-feature-acl-vlan-ip)# key size limit 160
switch(config-tcam-feature-acl-vlan-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
switch(config-tcam-feature-acl-vlan-ip)# action count drop
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ip)# feature acl vlan ipv6
switch(config-tcam-feature-acl-vlan-ipv6)# sequence 10
switch(config-tcam-feature-acl-vlan-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6)# action count drop
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-vlan-ipv6)# feature acl vlan ipv6 egress
switch(config-tcam-feature-acl-vlan-ipv6-egress)# sequence 20
switch(config-tcam-feature-acl-vlan-ipv6-egress)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-acl-vlan-ipv6-egress)# action count drop mirror
switch(config-tcam-feature-acl-vlan-ipv6-egress)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-vlan-ipv6-egress)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-vlan-ipv6-egress)# feature counter lfib
switch(config-tcam-feature-counter-lfib)# sequence 85
switch(config-tcam-feature-counter-lfib)# feature forwarding-destination mpls
switch(config-tcam-feature-forwarding-destination-mpls)# sequence 100
switch(config-tcam-feature-forwarding-destination-mpls)# feature l2-protocol forwarding
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# sequence 95
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# key size limit 160
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# key field dst-mac vlan-tag-format
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# action mirror redirect-to-cpu set-tc
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# packet ipv4 forwarding bridged
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# packet ipv6 forwarding bridged
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# packet non-ip forwarding bridged
switch(config-tcam-feature-forwarding-l2-protocol-forwarding)# feature mirror ip
switch(config-tcam-feature-mirror-ip)# sequence 80
switch(config-tcam-feature-mirror-ip)# key size limit 160
switch(config-tcam-feature-mirror-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-mirror-ip)# action count mirror set-policer
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-mirror-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-mirror-ip)# feature mpls
switch(config-tcam-feature-mpls)# sequence 5
switch(config-tcam-feature-mpls)# key size limit 160
switch(config-tcam-feature-mpls)# action drop redirect set-ecn
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-mpls)# feature mpls pop ingress
switch(config-tcam-feature-mpls-pop-ingress)# sequence 90
switch(config-tcam-feature-mpls-pop-ingress)# feature pbr ip
switch(config-tcam-feature-pbr-ip)# sequence 60
switch(config-tcam-feature-pbr-ip)# key size limit 160
switch(config-tcam-feature-pbr-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control
switch(config-tcam-feature-pbr-ip)# action count redirect
switch(config-tcam-feature-pbr-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-pbr-ip)# feature pbr ipv6
switch(config-tcam-feature-pbr-ipv6)# sequence 30
switch(config-tcam-feature-pbr-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-pbr-ipv6)# action count redirect
switch(config-tcam-feature-pbr-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-pbr-ipv6)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# sequence 65
switch(config-tcam-feature-pbr-mpls)# key size limit 160
switch(config-tcam-feature-pbr-mpls)# key field mpls-inner-ip-tos
switch(config-tcam-feature-pbr-mpls)# action count drop redirect
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-pbr-mpls)# feature qos ip
switch(config-tcam-feature-qos-ip)# sequence 75
switch(config-tcam-feature-qos-ip)# key size limit 160
switch(config-tcam-feature-qos-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-qos-ip)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-qos-ip)# feature qos ipv6
switch(config-tcam-feature-qos-ipv6)# sequence 70
switch(config-tcam-feature-qos-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
switch(config-tcam-feature-qos-ipv6)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-qos-ipv6)# feature tunnel VXLAN
switch(config-tcam-feature-tunnel-VXLAN)# sequence 50
switch(config-tcam-feature-tunnel-VXLAN)# key size limit 160
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-tunnel-VXLAN)# packet ipv4 VXLAN forwarding bridged decap

Once l2protocolfwd or l2protocolfwd-bfd-rfc-7130 tcam profile is created, the profile needs to be applied to the switch using the following command under config mode:

switch(config)# hardware tcam
switch(config-tcam)# system profile l2protocolfwd

Consumption of TCAM

The following table describes how TCAM is consumed when the same L2 Protocol Forwarding profile is applied:


Level of application	Type-1 platforms	Type-2 platforms
Front panel ports	Separate TCAM entries for each port	Same set of TCAM entries for ports on the same fap and core
Subinterfaces	Same set of TCAM entries for subinterfaces on the same fap	Same set of TCAM entries for subinterfaces on the same fap and core

L2 Protocol Forwarding Limitations

A maximum of 31 distinct L2 Protocol Forwarding profiles are applied across multiple subinterfaces on the same FAP.
A maximum of 31 distinct L2 Protocol Forwarding profiles are applied across multiple subinterfaces, and front panel ports on the same FAP on Type-2 platforms.
The feature is not supported for subinterfaces on Type-1 platforms if any of the following features are present in the TCAM Profile:
- feature pbr subintf ip
- feature pbr subintf ipv6
- feature pbr subintf mpls

L2 Protocol Forwarding Show commands

The show l2-protocol forwarding interface displays the L2 protocol forwarding profile configuration corresponding to the interfaces or subinterfaces.

switch(config)# show l2-protocol forwarding interface

Interface     Profile
------------- -------
Ethernet1/1   abc
Ethernet2/1.1 def
 

switch> show l2-protocol forwarding interface Ethernet1/1


Interface   Profile   
----------- --------
Ethernet1/1 abc

The following show commands display all packet forwarding behavior on an interface or a subinterface:

switch(config)# show l2-protocol forwarding interface detail                                                                                                                                                                                      
Tagging Types: T: tagged U: untagged
Actions: F: forward
                      BFD RFC-7130 E-LMI ISIS LACP LLDP MACSEC PAUSE STP
Interface     Profile   T     U    T  U  T U  T U  T U  T   U  T  U  T U
------------- ------- ----- ------ -- -- - -- - -- - -- -- --- -- -- - -                                                                                                                                             
Ethernet1/1   abc       -     -    -  -  F  F - -  - -  F   -  -  F  - -
Ethernet2/2.1 def       -     -    -  -  - -  - -  - -  -   -  -  -  - -

switch> show l2-protocol forwarding interface Ethernet1/1 detail
Tagging Types: T: tagged U: untagged                                                                                                                                                                        
Actions: F: forward                                                                                                                                                                                         
                      BFD RFC-7130 E-LMI ISIS LACP LLDP MACSEC PAUSE STP
Interface     Profile   T     U    T  U  T U  T U  T U  T   U  T  U  T U
------------- ------- ----- ------ -- -- - -- - -- - -- -- --- -- -- - -                                                                                                                                                             
Ethernet1/1   abc       -     -    -  -  F F  - -  - -  F   -  -  F  - -

switch> show l2-protocol forwarding interface Ethernet2/2.1 detail
Tagging Types: T: tagged U: untagged                                                                                                                                                                        
Actions: F: forward                                                                                                                                                                                         
                      BFD RFC-7130 E-LMI ISIS LACP LLDP MACSEC PAUSE STP
Interface     Profile   T     U    T  U  T U  T U  T U  T   U  T  U  T U
------------- ------- ----- ------ -- -- - -- - -- - -- -- --- -- -- - -                                                                                                                                                             
Ethernet2/2.1 def       -     -    -  -  - -  - -  - -  -   -  -  -  - -

Layer 2 Subinterfaces

A Layer 2 subinterface is a logical bridging endpoint associated with traffic on an interface distinguished by 802.1Q tags, where each interface, 802.1q tag tuple is treated as a first-class bridging interface.

Like other types of interfaces, an L2 subinterface is a normal bridging endpoint in the bridging domain.

Configurations

Creating a Layer 2 Subinterface

Complete the following steps to configure a Layer 2 (L2) subinterface on an Arista switch:

Configure the parent interface to be a routed port.

switch(config)# interface et1
switch(config-if-Et1)# no switchport

Create a subinterface on the parent interface (et1.1), assign 802.1q encapsulation (vlan 100), and assign the forwarding VLAN ID (vlan 200).

switch(config-if-Et1)# interface et1.1
switch(config-if-Et1.1)# encapsulation dot1q vlan 100
switch(config-if-Et1.1)# vlan id 200
! VLAN does not exist. Creating vlan 200

An alternative to configuring a forwarding VLAN id is to use VLAN name (office).

switch(config)# vlan 200
switch(config-vlan-200)# name office
switch(config-vlan-200)# int et1.2
switch(config-if-Et1.2)# encapsulation dot1q vlan 101
switch(config-if-Et1.2)# vlan name office

Now subinterfaces et1.1 and et1.2 have been created and added to vlanVLAN 200.

switch# show interface et1.1-2 status
Port     Name   Status       Vlan     Duplex Speed  Type                  Flags Encapsulation
Et1.1           connected    200      full   10G    dot1q-encapsulation   100

Et1.2           connected    200      full   10G    dot1q-encapsulation   101

MAC Address on Layer 2 Subinterface

MAC addresses can either be statically configured or dynamically assigned behind Layer 2 (L2) subinterfaces.

switch(config)# mac address-table static 0000.000a.000a vlan 200 interface et1.1

switch# show mac address-table interface et1.1-2
          Mac Address Table
--------------------------------------------------------

Vlan  Mac Address     Type     Ports   Moves  Last Move
----  -----------     ----     -----   -----  ---------
 200  0000.000a.000a  STATIC   Et1.1
 200  0000.000b.000b  DYNAMIC  Et1.2   1      0:00:06 ago
Total Mac Addresses for this criterion: 2

MAC address learning can be enabled or disabled on an L2 subinterface using the following commands:

In the following example, the show interface ethernet1.1 switchport command has this running-config:

switch(config-if-Et1.1)# show interface ethernet1.1 switchport
Name: Et1.1
Switchport: Enabled
Administrative Mode: tunnel
Operational Mode: tunnel
MAC Address Learning: disabled
Dot1q ethertype/TPID: 0x8100 (active)
Dot1q VLAN Tag: Allowed
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: ALL
Static Trunk Groups:
Dynamic Trunk Groups:
Source interface filtering: enabled
VLAN forwarding mode: allowedVlansOnly

To enable MAC address learning, use the no mac address learning disabledcommand:

switch(config-if-Et1.1)# no mac address learning disabled

QoS Feature

Supported QoS features include the following:

Shaping

After creating an L2 subinterface, you can configure a shape rate (in Kbps) on the sub-interface. For example, configure the shape rate to 50000000 Kbps.

switch(config-if-Et1.1)# shape rate 50000000

The configuration of non-default shape rate results in the allocation of dedicated virtual output queues (VOQ) for the subinterface. Each subinterface allocates four (4) VOQs. Different TC traffic goes to the VOQ according to the following mapping:


TC6-7 :	VOQ3
TC4-5 :	VOQ2
TC2-3 :	VOQ1
TC0-1 :	VOQ0

VOQ3 is in strict-priority mode to the other VOQs.

VOQ2, VOQ1, and VOQ0 are in WRR with a static credit ratio 2:3:6 (higher ratio implies more credits).

The subinterface inherits the trust mode of the parent interface.

Before EOS Release 4.24.2F, EOS supported shaping only on L2 subinterfaces of parent Ethernet interfaces, for example, Et1.1. Beginning with EOS Release 4.24.2F, EOS supports shaping on L2 subinterface over a port-channel parent interface for example, Po1.1).

Note: A single parent interface supports up to 2000 shaped subinterfaces.

Guaranteed Bandwidth

After configuring shaping on an L2 sub-interface, configure a guaranteed bandwidth (in Kbps or percent) on the subinterface using the bandwidth guaranteed command.

switch(config-if-Et1.1)# bandwidth guaranteed 10000000
switch(config-if-Et1.1)# bandwidth guaranteed percent 10

Policing

For policing to work on the L2 subinterface, you must switch to the QoS profile.

Example

switch(config)# hardware tcam
switch(config-hw-tcam)# system profile qos

Sample Policy-map Configuration:

switch(config)# ip access-list a1
switch(config-acl-a1)# statistics per-entry
switch(config-acl-a1)# 10 permit ip any any

switch(config)# class-map type qos match-any c1
switch(config-cmap-qos-c1)# match ip access-group a1

switch(config)# class-map type qos match-any c2
switch(config-cmap-qos-c2)# match vlan 100 0xfff

switch(config)# ipv6 access-list a1
switch(config-ipv6-acl-a1)# statistics per-entry
switch(config-ipv6-acl-a1)# 10 permit ipv6 any any

switch(config)# class-map type qos match-any c3
switch(config-cmap-qos-c3)# match ipv6 access-group a1

switch(config)# policy-map type quality-of-service p1
switch(config-pmap-quality-of-service-p1)# class c1
switch(config-pmap-quality-of-service-p1-c1)# police cir 10 Mbps bc 100000 bytes
    exit
exit

After you create an L2 subinterface, you can configure a policy-map on the sub-interface, similar to the following example.

switch(config-if-Et1.1)# service-policy type qos input p1

Interface Counters

To enable the hardware features for counting packets on L2 subinterfaces ingress and/or egress, use the hardware counter feature command, similar to the following example. In the example, enable subinterface layer2 for ingress, and then enable for egress.

Example

switch(config)# hardware counter feature subinterface in layer2
switch(config)# hardware counter feature subinterface out layer2

To display the L2 subinterface counters, use the show interface counters command similar to the following example. In the example, subinterface et1.1 displays.

switch# show interfaces et1.1 counters

Port        InOctets      InPkts
Et1.1       0             0

Port         OutOctets    OutPkts
Et1.1        0             0

To clear all of the interface counters, use the clear counters command:

switch# clear counters

To learn counters for a specific L2 interface, use the clear counters command, and clear the L2 subinterface. In the example, clear the L2 subinterface et1.1.

switch# clear counters et1.1

Limitations

The following limitations apply to the Layer 2 subinterface feature:

A total of 256 Layer 2 subinterfaces with shaping are supported across the entire switch and they can be distributed across any number of Ethernet ports.
When configuring a shape rate on an L2 subinterface over a parent port -channel interface, such as, Po1.1), traffic load-balancing is disabled and is directed to a selected port-channel member. Also, the bandwidth of the port-channel subinterface will be equal to the selected member. However, the show interface command continues to show the bandwidth of the port-channel which is incorrect.
After configuring a shape rate on an L2 subinterface, the L2 subinterface must be flapped by using the shut” and no shut commands.
Shaping of BUM traffic on L2 subinterfaces is supported only with “ingress replication”.
EOS does not support Layer 3 forwarding through SVIs .
EOS does not support control plane processing, such as IGMP snooping and STP BPDU.
When IGMP protocol packets are expected to be forwarded on L2 subinterfaces, then IGMP snooping must be disabled globally on the entire switch using the no ip igmp snooping command. When IGMP snooping is configured on any VLAN, then IGMP protocol packets are discarded by L2 subinterfaces.
Double tagged packets arriving on L2 subinterfaces with a single encapsulation dot1q vlan <outer_vid> command configured will match on the outer VLAN tag, and have only the outer VLAN tags terminated.
Configuration of double tagged L2 subinterfaces through the encapsulation dot1q vlan <outer_vid> inner <inner_vid> command is not supported.
EOS does not support the mixing of shaped and non-shaped subinterfaces under the same parent interface.
Traffic classification on ingress traffic to l2 subinterface is disabled by default. To enable this feature, configure using the qos trust cos command on the parent interface.
L2 subinterfaces are not supported in an MLAG environment.

QoS Show Commands

Use the show interfaces status command to display the subinterface status.

Example

switch# show interfaces status sub-interfaces
Port     Name   Status       Vlan     Duplex Speed  Type                Flags Encapsulation
Et1.1           connected    200      full   10G    dot1q-encapsulation       100
Et1.2           connected    200      full   10G    dot1q-encapsulation       101

Use the show vlan command to display the VLAN membership. In the following example, vlan 200 is configured to be displayed.

Example

switch# show vlan 200
VLAN  Name                 Status    Ports
----- ------------------- --------- -------------------
200   office               active    Et1.1, Et1.2, Et5

Use the show qos interface command to display the QoS configuration on an L2 subinterface. In the following example, QoS subinterface Ethernet 1.1 is configured to be displayed.

Example

switch# show qos interface Ethernet 1.1
Ethernet1.1:

   Trust Mode: DSCP
   Default COS: 0
   Default DSCP: 0

   Port shaping rate: 50625 / 50000 kbps

Use the show interface counters with the queue keyword to display the L2 subinterface counters. For example subinterface Ethernet 1.1 is configured to display the L2 subinterface counters.

Example

switch# show interface Ethernet 1.1 counters queue
Aggregate VoQ Counters
Egress   Traffic   Pkts     Octets     DropPkts  DropOctets
Port     Class
------------------------------------------------------------
Et1.1    TC0-1      0        0          0         0
Et1.1    TC2-3      0        0          0         0
Et1.1    TC4-5      0        0          0         0
Et1.1    TC6-7      460266   276159600  109316    65589600

Use the show mac address-table command to display the MAC address on L2 subinterfaces. For example, subinterfaces Et1.1 and Et1.2 are configured to be displayed.

Example

switch# show mac address-table interface et1.1-2
          Mac Address Table
------------------------------------------------------------------

Vlan    Mac Address       Type        Ports      Moves   Last Move
----    -----------       ----        -----      -----   ---------
 200    0000.000a.000a    STATIC      Et1.1
 200    0000.000b.000b    DYNAMIC     Et1.2      1       0:00:16 ago
Total Mac Addresses for this criterion: 2

Layer 3 Configuration

This chapter covers the following Layer 3 sections:

IPv4

Arista switches support Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) for routing packets across network boundaries. This section describes Arista’s implementation of IPv4 and includes these topics:

IPv4 Addressing
IPv4 Routing
IPv4 Multicast Counters
Route Management
IPv4 Route Scale
IP Source Guard
DHCP Server
DHCP Relay Global Configuration Mode
DHCP Relay Across VRF
DHCP Relay in VXLAN EVPN
DHCP Snooping with Bridging
TCP MSS Clamping
IPv4 GRE Tunneling
GRE Tunneling Support
BfRuntime to Use Non-default VRFs
IPv4 Commands

IPv4 Addressing

Each IPv4 network device is assigned a 32-bit IP address that identifies its network location. These sections describe IPv4 address formats, data structures, configuration tasks, and display options:

IPv4 Address Formats
IPv4 Address Configuration
Address Resolution Protocol (ARP)
Displaying ARP Entries

IPv4 Address Formats

IPv4 addresses are composed of 32 bits, expressed in dotted decimal notation by four decimal numbers, each ranging from 0 to 255. A subnet is identified by an IP address and an address space defined by a routing prefix. The switch supports the following subnet formats:

IP address and subnet mask: The subnet mask is a 32-bit number (dotted decimal notation) that specifies the subnet address space. The subnet address space is calculated by performing an AND operation between the IP address and subnet mask.
IP address and wildcard mask: The wildcard mask is a 32-bit number (dotted decimal notation) that specifies the subnet address space. Wildcard masks differ from subnet masks in that the bits are inverted. Some commands use wildcard masks instead of subnet masks.
CIDR notation: CIDR notation specifies the scope of the subnet space by using a decimal number to identify the number of leading ones in the routing prefix. When referring to wildcard notation, CIDR notation specifies the number of leading zeros in the routing prefix.

Examples

These subnets (subnet mask and CIDR notation) are calculated identically:
```
10.24.154.13 255.255.255.0
10.24.154.13/24
```
The defined space includes all addresses between 10.24.154.0 and 10.24.154.255. These subnets (wildcard mask and CIDR notation) are calculated identically:
```
124.17.3.142 0.0.0.15
124.17.3.142/28
```
The defined space includes all addresses between 124.17.3.128 and 124.17.3.143.

IPv4 Address Configuration

Assigning an IPv4 Address to an Interface

The ip address command specifies the IPv4 address of an interface and the mask for the subnet to which the interface is connected.

Example

These commands configure an IPv4 address with subnet mask for VLAN 200:

switch(config)# interface vlan 200
switch(config-if-Vl200)# ip address 10.0.0.1/24
switch(config-if-Vl200)#

Assigning an IPv4 Class E Address to an Interface

The ipvr routable 240.0.0.0/4command assigns a class E addresses to an interface. When configured, the class E address traffic are routed through BGP, OSPF, ISIS, RIP, static routes and programmed to the FIB and kernel. By default, this command is disabled.

Example

These commands configure an IPv4 Class E (240/4) address to an interface.

switch(config)# router general
switch(config-router-general)# ipv4 routable 240.0.0.0/4

Detecting duplicate IP Addresses on an Interface

The ip address duplicate detection disabled command detects any duplicate IP address on the interface. When the duplicate IP address is detected, a syslog message is generated. It helps the network operator to identify IP addresses misconfiguration. By default, this feature is enabled.

Examples

This command disables the feature on the switch.

switch(config)# ip address duplicate detection disabled

This command enables the feature.
```
switch(config)# ip address duplicate detection logging
```
Note: Commands are in global configuration mode, and are not per VRF.

This is an example of a Syslog message, when a duplicate IP address is detected.

Mar 24 16:41:57 cd290 Arp: %INTF-4-DUPLICATE_ADDRESS_WITH_HOST: IP address 100.1.1.2 
configured on interface Ethernet1/1 is in use by a host with 
MAC address 00:00:01:01:00:00 on interface Ethernet1/1 in VRF default

Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP) maps IP addresses to MAC addresses recognized by the local network devices. The ARP cache consists of a table that stores the correlated addresses of the devices that the router facilitates data transmissions.

After receiving a packet, routers use ARP to find the device MAC address assigned to the packet destination IP address. If the ARP cache contains both addresses, the router sends the packet to the specified port. If the ARP cache does not contain the addresses, ARP broadcasts a request packet to all devices in the subnet. The device at the requested IP address responds and provides its MAC address. ARP updates the ARP cache with a dynamic entry and forwards the packet to the responding device. Add static ARP entries to the cache using the CLI.

Proxy ARP

Proxy ARP enables a network device (proxy) to respond to ARP requests for network addresses on a different network with its MAC address. Traffic to the destination directs to the proxy device which then routes the traffic toward the ultimate destination.

Configuring ARP

The switch uses ARP cache entries to correlate 32-bit IP addresses to 48-bit hardware addresses. The arp aging timeout command specifies the duration of dynamic address entries in the Address Resolution Protocol (ARP) cache for addresses learned through the Layer 3 interface. The default duration is 14400 seconds (four hours).

Entries refresh and expire at a random time within the range of 80%-100% of the cache expiry time. The refresh attempts three times at an interval of 2% of the configured timeout.

Static ARP entries never time out and must be removed from the table manually.

Example

This command specifies an ARP cache duration of 7200 seconds (two hours) for dynamic addresses added to the ARP cache learned through VLAN 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# arp aging timeout 7200
switch(config-if-Vl200)# show active
interface Vlan200
   arp aging timeout 7200
switch(config-if-Vl200)#

The arp command adds a static entry to an Address Resolution Protocol (ARP) cache.

Example

This command adds a static entry to the ARP cache in the default VRF.

switch(config)# arp 172.22.30.52 0025.900e.c63c arpa
switch(config)#

The arp proxy max-delay command enables delaying proxy ARP requests on the configuration mode interface. EOS disables Proxy ARP by default. When enabled, the switch responds to all ARP requests, including gratuitous ARP requests, with target IP addresses that match a route in the routing table. When a switch receives a proxy ARP request, EOS performs a check to send the response immediately or delay the response based on the configured maximum delay in milliseconds (ms).

Example

Use the following command to set a delay of 500ms before returning a response to a proxy ARP request.

switch(config)#arp proxy max-delay 500ms

Gratuitous ARP

EOS broadcasts gratuitous ARP packets using a device in response to an internal change rather than as a response to an ARP request. The gratuitous ARP packet consists of a request packet (no reply expected) that supplies an unrequested update of ARP information. In a gratuitous ARP packet, both the source and destination IP addresses use the IP of the sender, and the destination MAC address uses the broadcast address (ff:ff:ff:ff:ff:ff).

Gratuitous ARP packets generate to update ARP tables after an IPv4 address or a MAC address change occurs.

Configuring Gratuitous ARP

By default, Arista switch interfaces reject gratuitous ARP request packets. The arp gratuitous accept command configures an L3 interface to accept the gratuitous ARP request packets sent from a different device in the network and add the mappings to the ARP table. Gratuitous ARP can be configured on Ethernet interfaces, VLANs/SVI, or L3 port channels, but has no effect on L2 interfaces.

Example

These commands enable gratuitous ARP packet acceptance on interface ethernet 2/1.

switch (config)# interface ethernet 2/1
switch (config-if-Et2/1)# arp gratuitous accept

Displaying ARP Entries

The show ip arp command displays ARP cache entries that map an IP address to a corresponding MAC address. The table displays addresses by their host names when the command includes the resolve argument.

Examples

This command displays ARP cache entries that map MAC addresses to IPv4 addresses.

switch> show ip arp

Address         Age (min)  Hardware Addr   Interface
172.25.0.2              0  004c.6211.021e  Vlan101, Port-Channel2
172.22.0.1              0  004c.6214.3699  Vlan1000, Port-Channel1
172.22.0.2              0  004c.6219.a0f3  Vlan1000, Port-Channel1
172.22.0.3              0  0045.4942.a32c  Vlan1000, Ethernet33
172.22.0.5              0  f012.3118.c09d  Vlan1000, Port-Channel1
172.22.0.6              0  00e1.d11a.a1eb  Vlan1000, Ethernet5
172.22.0.7              0  004f.e320.cd23  Vlan1000, Ethernet6
172.22.0.8              0  0032.48da.f9d9  Vlan1000, Ethernet37
172.22.0.9              0  0018.910a.1fc5  Vlan1000, Ethernet29
172.22.0.11             0  0056.cbe9.8510  Vlan1000, Ethernet26

switch>

This command displays ARP cache entries that map MAC addresses to IPv4 addresses. The output displays host names assigned to IP addresses in place of the address.

switch> show ip arp resolve

Address         Age (min)  Hardware Addr   Interface
green-vl101.new         0  004c.6211.021e  Vlan101, Port-Channel2
172.22.0.1              0  004c.6214.3699  Vlan1000, Port-Channel1
orange-vl1000.n         0  004c.6219.a0f3  Vlan1000, Port-Channel1
172.22.0.3              0  0045.4942.a32c  Vlan1000, Ethernet33
purple.newcompa         0  f012.3118.c09d  Vlan1000, Port-Channel1
pink.newcompany         0  00e1.d11a.a1eb  Vlan1000, Ethernet5
yellow.newcompa         0  004f.e320.cd23  Vlan1000, Ethernet6
172.22.0.8              0  0032.48da.f9d9  Vlan1000, Ethernet37
royalblue.newco         0  0018.910a.1fc5  Vlan1000, Ethernet29
172.22.0.11             0  0056.cbe9.8510  Vlan1000, Ethernet26

switch>

ARP Inspection

The Address Resolution Protocol (ARP) inspection command ip arp inspection vlan activates a security feature that protects the network from ARP spoofing. EOS intercepts ARP requests and responses on untrusted interfaces on specified VLANs and verifies intercepted packets to ensure valid IP-MAC address bindings. On trusted interfaces, all incoming ARP packets process and forward without verification, and all invalid ARP packets are dropped.

Enabling and Disabling ARP Inspection

By default, EOS disables ARP inspection on all VLANs.

Examples

This command enables ARP inspection on VLANs 1 through 150.

switch(config)# ip arp inspection vlan 1 - 150
switch(config)#

This command disables ARP inspection on VLANs 1 through 150.

switch(config)# no ip arp inspection vlan 1 - 150
switch(config)#

This command sets the ARP inspection default to VLANs 1 through 150.

switch(config)# default ip arp inspection vlan 1 - 150
switch(config)#

This command enable ARP inspection on multiple VLANs 1 through 150 and 200 through 250.
```
switch(config)# ip arp inspection vlan 1-150,200-250
switch(config)#
```

Syslog for Invalid ARP Packets Dropped

After dropping an invalid ARP packet, EOS displays the following syslog message appears. The log severity level can be set higher if required.

%SECURITY-4-ARP_PACKET_DROPPED: Dropped ARP packet on interface Ethernet28/1 Vlan 
2121 because invalid mac and ip binding. Received: 00:0a:00:bc:00:de/1.1.1.1.

Displaying ARP Inspection States

The command show ip arp inspection vlan displays the configuration and operation state of ARP inspection. For a VLAN range specified by show ip arp inspection vlandisplays only VLANs with ARP inspection enabled. If you do not specify a VLAN, the output displays all VLANs with ARP inspection enabled. The operation state turns to Active when the hardware traps ARP packets for inspection.

Example

This command displays the configuration and operation state of ARP inspection for VLANs 1 through 150.

switch(config)# show ip arp inspection vlan 1 - 150

VLAN 1
----------
Configuration
: Enabled
Operation State : Active
VLAN 2
----------
Configuration
: Enabled
Operation State : Active
{...}
VLAN 150
----------
Configuration
: Enabled
Operation State : Active

switch(config)#

Displaying ARP Inspection Statistics

The command show ip arp inspection statistics displays the statistics of inspected ARP packets. For a VLAN specified by show ip arp inspection vlan, the output displays only VLANs with ARP inspection. If you do not specify a VLAN, the output displays all VLANs with ARP inspection enabled.

The command clear arp inspection statistics clears ARP inspection.

Examples

This command displays ARP inspection statistics for VLAN 1.

switch(config)# show ip arp inspection statistics vlan 2

Vlan : 2
------------
ARP Req Forwarded = 20
ARP Res Forwarded = 20
ARP Req Dropped = 1
ARP Res Dropped = 1

Last invalid ARP:
Time: 10:20:30 ( 5 minutes ago )
Reason: Bad IP/Mac match
Received on: Ethernet 3/1
Packet:
  Source MAC: 00:01:00:01:00:01
  Dest MAC: 00:02:00:02:00:02
  ARP Type: Request
  ARP Sender MAC: 00:01:00:01:00:01
  ARP Sender IP: 1.1.1

switch(config)#

This command displays ARP inspection statistics for ethernet interface 3/1.

switch(config)# show ip arp inspection statistics ethernet interface 3/1

Interface : 3/1
--------
ARP Req Forwarded = 10
ARP Res Forwarded = 10
ARP Req Dropped = 1
ARP Res Dropped = 1

Last invalid ARP:
Time: 10:20:30 ( 5 minutes ago )
Reason: Bad IP/Mac match
Received on: VLAN 10
Packet:
  Source MAC: 00:01:00:01:00:01
  Dest MAC: 00:02:00:02:00:02
  ARP Type: Request
  ARP Sender MAC: 00:01:00:01:00:01
  ARP Sender IP: 1.1.1

switch(config)#

This command clears ARP inspection statistics.

switch(config)# clear arp inspection statistics
switch(config)#

Configuring Trust Interface

By default, all interfaces are untrusted. The command ip arp inspection trust configures the trust state of an interface.

Examples

This command configures the trust state of an interface.

switch(config)# ip arp inspection trust
switch(config)#

This command configures the trust state of an interface to untrusted.
```
switch(config)# no ip arp inspection trust
switch(config)#
```
This command configures the trust state of an interface to the default.
```
switch(config)# default ip arp inspection trust
switch(config)#
```

Configuring Rate Limit

After enabling ARP inspection, EOS traps ARP packets to the CPU. When the incoming ARP rate exceeds expectations, two actions can be taken. For notification purposes, the command ip arp inspection logging enables logging of incoming ARP packets. The command ip arp inspection limit disables the interfaces and prevents a denial-of-service attack..

Examples

This command enables logging of incoming ARP packets when the rate exceeds the configured value and sets the rate to 2048, the upper limit for the number of invalid ARP packets allowed per second. Then, it sets the burst consecutive interval to monitor interface for a high ARP rate to 15 seconds.
```
switch(config)# ip arp inspection logging rate 2048 burst interval 15
switch(config)#
```
This command configures the rate limit of incoming ARP packets to disable the interface when the incoming ARP rate exceeds the configured value, and sets the rate to 512, the upper limit for the number of invalid ARP packets allowed per second.Then sets the burst consecutive interval to monitor the interface for a high ARP rate to 11 seconds.
```
switch(config)# ip arp inspection limit rate 512 burst interval 11
switch(config)#
```

This command displays verification of the interface specific configuration.

switch(config)# interface ethernet 3/1
switch(config)# ip arp inspection limit rate 20 burst interval 5
switch(config)# interface Ethernet 3/3
switch(config)# ip arp inspection trust
switch(config)# show ip arp inspection interfaces

 Interface      Trust State  Rate (pps) Burst Interval
 -------------  -----------  ---------- --------------
 Et3/1          Untrusted    20         5
 Et3/3          Trusted      None       N/A

switch(config)#

Disabling Errors Caused by ARP Inspection

If the incoming ARP packet rate on an interface exceeds the configured rate limit in burst interval, EOS disables the interface by default. If errdisabled, the interface remains in this state until you intervene with the command errdisable detect cause arp-inspection. For example, after you perform a shutdown or no shutdown of the interface or it automatically recovers after a certain time period. The command errdisable recovery cause arp-inspection enables auto recovery. The command errdisable recovery interval enables sharing the auto recovery interval among all disabled interfaces. See the chapter Data Transfer Introduction for information on all errdisable commands.

Examples

This command enables errdisable caused by an ARP inspection violation.

switch(config)# errdisable detect cause arp-inspection
switch(config)#

This command disables errdisable caused by an ARP inspection violation.

switch(config)# no errdisable detect cause arp-inspection
switch(config)#

This command enables auto recovery.

switch(config)# errdisable recovery cause arp-inspection
switch(config)#

This command disables auto recovery.

switch(config)# no errdisable recovery cause arp-inspection
switch(config)#

This command enables sharing the auto recovery interval of 10 seconds among all errdisable interfaces.
```
switch(config)# errdisable recovery interval 10
switch(config)#
```
This command disables sharing the auto recovery interval of 10 seconds among all errdisable interfaces.
```
switch(config)# no errdisable recovery interval 10
switch(config)#
```

This command displays the reason for a port entering the errdisable state.

switch(config)# show interfaces status errdisabled

Port         Name         Status       Reason
------------ ------------ ------------ ---------------
Et3/2                     errdisabled  arp-inspection

switch(config)#

Configuring Static IP MAC Binding

The ARP inspection command ip source binding allows you to add static IP-MAC binding. If enabled, ARP inspection verifies incoming ARP packets based on the configured IP-MAC bindings. The static IP-MAC binding entry can only be configured on Layer 2 ports. By default, there is no binding entry on the system.

Examples

This command configures static IP-MAC binding for IP address 127.0.0.1, MAC address 0001.0001.0001, vlan 1, and Ethernet interface slot 4 and port 1.
```
switch(config)# ip source binding 127.0.0.1 0001.0001.0001 vlan 1 interface 
ethernet 4/1
switch(config)#
```
This command configures static IP-MAC binding for IP address 127.0.0.1, MAC address 0001.0001.0001, vlan 1, and port-channel interface 20.
```
switch(config)# ip source binding 127.0.0.1 0001.0001.0001 vlan 1 interface 
port-channel 20
switch(config)#
```

This command displays the configured IP-MAC binding entries. Note that the Lease column displays dynamic DHCP snooping binding entries. For static binding entries, lease time displays as infinite.

switch(config)# show ip source binding 127.0.0.1 0001.0001.0001 static vlan 1 
interface port-channel 20

MacAddress      IpAddress   Lease(sec)  Type   VLAN  Interface
--------------- ----------- ----------- ------ ----- --------------
0001.0001.0001  127.0.0.1   infinite    static 1     Port-Channel20

switch(config)#

IPv4 Routing

Internet Protocol version 4 (IPv4) is a communications protocol used for relaying network packets across a set of connected networks using the Internet Protocol suite. Routing transmits network layer data packets over connected independent subnets. Each subnet is assigned an IP address range, and each device on the subnet is assigned an IP address from that range. The connected subnets have IP address ranges that do not overlap.

A router is a network device that connects multiple subnets. Routers forward inbound packets to the subnet whose address range includes the packets’ destination address. IPv4 and IPv6 are internet layer protocols that define packet-switched internetworking, including source-to-destination datagram transmission across multiple networks.

These sections describe IPv4 routing and route creation options:

Enabling IPv4 Routing
Static and Default IPv4 Routes
Dynamic IPv4 Routes
Viewing IPv4 Routes and Network Components

Enabling IPv4 Routing

When IPv4 routing is enabled, the switch attempts to deliver inbound packets to destination IPv4 addresses by forwarding them to interfaces or next-hop addresses specified by the forwarding table.

The ip routing command enables IPv4 routing.

Example

This command enables IP routing:

switch(config)# ip routing
switch(config)#

Static and Default IPv4 Routes

Static routes are entered through the CLI and are typically used when dynamic protocols cannot establish routes to a specified destination prefix. Static routes are also useful when dynamic routing protocols are not available or appropriate. Creating a static route associates a destination IP address with a local interface. The routing table refers to these routes as connected routes available for redistribution into routing domains defined by dynamic routing protocols.

The ip route command creates a static route. The destination is a network segment; the next-hop is either an IP address or a routable interface port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.

By default, the administrative distance assigned to static routes is 1. Assigning a higher administrative distance to a static route configures it to be overridden by dynamic routing data. For example, a static route with a distance value of 200 is overridden by OSPF intra-area routes, which have a default distance of 110.

A route tag is a 32-bit number that is attached to a route. Route maps use tags to filter routes. Static routes have a default tag value of 0.

Example

This command creates a static route:

switch(config)#ip route 172.17.252.0/24 vlan 500
switch(config)#

Creating Default IPv4 Routes

The default route denotes the packet forwarding rule that takes effect when no other route is configured for a specified IPv4 address. All packets with destinations that are not established in the routing table are sent to the destination specified by the default route.

The IPv4 destination prefix is 0.0.0.0/0, and the next-hop is the default gateway.

Example

This command creates a default route and establishes 192.14.0.4 as the default gateway address:

switch(config)#ip route 0.0.0.0/0 192.14.0.4
switch(config)#

Resolution RIB Profiles for Static Routes

Specify a Resolution RIB Profile as a system-connected per next-hop for a static route. System-connected describes a static route that only resolves if the next hop can be reached over a connected route. If you do not specify a system-connected route, the static route resolves if the next hop can be reached over any type of route in the FIB, including a connected route or a tunnel RIB. route.

Configuring Resolution RIB Profile for Static Routes

Use the following command to configure a Resolution RIB Profile for static route, 10.0.0.0/24, and 10.1.0.0:

switch(config)#ip route vrf myVRF 10.0.0.0/24 10.1.0.0 resolution ribs system-connected

Displaying Resolution Profiles for Static Routes

Use the show ip routecommand:

switch(config)#show ip route
interface Ethernet1
   mtu 1500
   no switchport
   ip address 10.1.1.1/24
 !
interface Ethernet2
   no switchport
   ip address 10.10.10.1/24 
   
ip route 10.100.100.0/24 10.10.10.2 resolution ribs system-connected
 !
arp 10.1.1.2 00:22:33:44:55:66 arpa
arp 10.10.10.2 00:22:33:44:55:67 arpa
 !
mpls tunnel static st1 10.10.10.2/32 10.1.1.2 Ethernet1 label-stack 9000

Dynamic IPv4 Routes

Dynamic routing protocols establish dynamic routes. These protocols also maintain the routing table and modify routes to adjust for topology or traffic changes. Routing protocols assist the switch in communicating with other devices to exchange network information, maintaining routing tables, and establishing data paths.

The switch supports these dynamic IPv4 routing protocols:

Viewing IPv4 Routes and Network Components

Displaying the FIB and Routing Table

The show ip route command displays routing table entries that are in the forwarding information base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal-cost paths to the same prefix are displayed contiguously as a block, with the destination prefix displayed only on the first line.

The show running-config command displays configured commands not in the FIB. The show ip route summary command displays the number of routes, categorized by source, in the routing table.

Examples

This command displays IP routes learned through BGP.

switch> show ip route bgp

Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, A - Aggregate

 B E    170.44.48.0/23 [20/0] via 170.44.254.78
 B E    170.44.50.0/23 [20/0] via 170.44.254.78
 B E    170.44.52.0/23 [20/0] via 170.44.254.78
 B E    170.44.54.0/23 [20/0] via 170.44.254.78
 B E    170.44.254.112/30 [20/0] via 170.44.254.78
 B E    170.53.0.34/32 [1/0] via 170.44.254.78
 B I    170.53.0.35/32 [1/0] via 170.44.254.2
                             via 170.44.254.13
                             via 170.44.254.20
                             via 170.44.254.67
                             via 170.44.254.35
                             via 170.44.254.98

switch>

This command displays a summary of routing table contents.

switch> show ip route summary

Route Source         Number Of Routes
-------------------------------------
connected                   15
static                       0
ospf                        74
  Intra-area: 32 Inter-area:33 External-1:0 External-2:9
  NSSA External-1:0 NSSA External-2:0
bgp                          7
  External: 6 Internal: 1
internal                    45
attached                    18
aggregate                    0

switch>

Displaying the IP Route Age

The show ip route age command displays the time when the route for the specified network was present in the routing table. It does not account for changes in parameters like metrics, next hop etc.

Example:

This command displays the time since the last update to ip route 172.17.0.0/20.

switch> show ip route 172.17.0.0/20 age

Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I - ISIS, A - Aggregate

 B E    172.17.0.0/20 via 172.25.0.1, age 3d01h

switch>

Displaying Gateways

A gateway is a router that provides access to another network. The gateway of last resort, also known as the default route, is the route that a packet uses when the route to its destination address is unknown. The IPv4 default route in is 0.0.0.0/0.

The show ip route gateway command displays IP addresses of all gateways (next hops) used by active routes.

Example

This command displays next hops used by active routes.

switch> show ip route gateway

The following gateways are in use:
   172.25.0.1 Vlan101
   172.17.253.2 Vlan2000
   172.17.254.2 Vlan2201
   172.17.254.11 Vlan2302
   172.17.254.13 Vlan2302
   172.17.254.17 Vlan2303
   172.17.254.20 Vlan2303
   172.17.254.66 Vlan2418
   172.17.254.67 Vlan2418
   172.17.254.68 Vlan2768
   172.17.254.29 Vlan3020

switch>

Displaying Host Routes

The show ip route host command displays all host routes in the host forwarding table. Host routes are those whose destination prefix is the entire address (mask = 255.255.255.255 or prefix = /32). Each displayed host route is labeled with its purpose:

F static routes from the FIB.
R routes defined because the IP address is an interface address.
B broadcast address.
A routes to any neighboring host for which the switch has an ARP entry.

Example

This command displays all host routes in the host forwarding table.

switch# show ip route host

R - receive B - broadcast F - FIB, A - attached

F   127.0.0.1 to cpu
B   172.17.252.0 to cpu
A   172.17.253.2 on Vlan2000
R   172.17.253.3 to cpu
A   172.17.253.10 on Vlan2000
R   172.17.254.1 to cpu
A   172.17.254.2 on Vlan2901
B   172.17.254.3 to cpu
B   172.17.254.8 to cpu
A   172.17.254.11 on Vlan2902
R   172.17.254.12 to cpu

F   172.26.0.28 via 172.17.254.20 on Vlan3003
                via 172.17.254.67 on Vlan3008
                via 172.17.254.98 on Vlan3492
via 172.17.254.86 on Vlan3884
                via 172.17.253.2 on Vlan3000
F   172.26.0.29 via 172.25.0.1 on Vlan101
F   172.26.0.30 via 172.17.254.29 on Vlan3910
F   172.26.0.31 via 172.17.254.33 on Vlan3911
F   172.26.0.32 via 172.17.254.105 on Vlan3912

switch#

IPv4 Multicast Counters

IPv4 multicast counters allow association of IPv4 multicast routes with a packet or byte counter.

This chapter contains the following sections.

Multicast Counters Hardware Overview
Multicast Counters iBGP and eBGP Configuration
Configuring IPv4 Multicast Counters

Multicast Counters Hardware Overview

This section describes a hardware overview for multicast counters, and contains the following sections.

Platform Independent Requirements for Counters
Policer Counter Overview
BGP Functions Supported for Arista Switches
Additional Requirements

Platform Independent Requirements for Counters

The following platform independent requirements include:

Enable/Disable counters.
Clear counters.
Show counters.
Configure counter mode for byte (default) or frame mode.

Policer Counter Overview

The switch hardware has two policer banks, each with 4k entries, and each entry has one 32-bit entry1 and one 32-bit entry2, which can be used as either a packet counter or byte counter.

In the pipeline, each bank can have one policer index coming from upstream blocks, which means different features cannot update multiple policer entries in the same bank simultaneously. Therefore, different features cannot share entries in the same bank.

Each FFU/BST entry points to a corresponding RAM in switch hardware routing. A policer index is saved in the action ram, so when installing a multicast route into hardware, the platform code will get a policer index and save it in the action field. A counter is not added to the action field if a policer index is unavailable.

Switch hardware can have multiple features competing for the policer banks. It is desirable to have a platform command to reserve policer banks dedicated to a certain feature.

The following command reserves one or two policer banks to be used only by the named feature:

[no] platform fm6000 [nat|acl|qos|multicast] policer banks <1|2>

Available bank(s) are reserved for the feature. Otherwise the command will take effect at the next reboot or FocalPointV2 agent restart. This reservation guarantees the configured number of bank(s) for this feature. However, the feature can still possibly obtain the other policer bank if it needs more, and the other bank is available.

If a feature has a pending reservation request which is not fulfilled because of availability, and some other feature frees a bank, the bank will be allocated to the pending feature.

BGP Functions Supported for Arista Switches

Arista switches support these BGP functions:

A single BGP instance
Simultaneous internal (IBGP) and external (EBGP) peering
Multiprotocol BGP
BGP Confederations

Additional Requirements

On switch hardware, the following additional requirements include:

Reservation of policer banks.
Notification of policer bank availability when a policer entry is freed by other features.

Multicast Counters iBGP and eBGP Configuration

This section describes the commands required to configure an iBGP and an eBGP topology, and contains the following sections.

Policer Usage

Policer Usage

There are two types of counters – those created by wildcard creation and by specific creation. When a specific counter is required, and the hardware runs out of policer entries, a wildcard counter is forced to give up its policer entry.

Suppose the user configures a specific counter, and the Starter Group (SG) already has a wildcard-created counter. In that case, this counter is upgraded to a specific one, with no change in the hardware policer index. If the user configures both a wildcard counter and a specific counter for this SG and subsequently deletes the specific counter, the counter for this SG is downgraded to a wildcard, with no change in the hardware policer index. However, if another specific counter is pending for a hardware policer index, then this policer entry will be assigned to that counter due to its higher precedence.

Even if a counter is configured by the user, in order to conserve the use of hardware resources, do not allocate a policer entry until a real route (G, S) is programmed into the Frame Filtering and Forwarding Unit (FFU).

Configuring IPv4 Multicast Counters

Perform the following CLI steps to configure IPv4 multicast counters on the FM6000 platform:

Execute the global configuration command:
- no|default ip multicast count bytes| packets
Enables wildcard counters. Also used to change bytes/packets mode. When hardware runs of resources, specific creation has priority to preempt counters from wildcard creation. The bytes | packets optional keyword enables the counter to be in either bytes mode or packets mode. This mode applies to all counters. All counter values will be reset to zero when the counter mode changes.
- no|default ip multicast count <G> <S>
This only takes effect when ip multicast count is enabled. Either <G> <S> or bytes|packets optional keyword is used. They can not be used concurrently.

No | default Commands: (default is same as no)
- no ip multicast count Deletes all multicast counters, including explicit <G> <S> routes
  - no ip multicast count <G> <S> Removes the config. Do not delete the counter because the wildcard is still active.
  - If no <G, S> is specified, all multicast routes will have counters unless the hardware runs out of resources. The creation of counters is referred to as “wildcard creation.”
  - If <G, S> is specified, only <G, S> will get a counter (and no other route). The creation of counters is referred to as “specific creation.” By default, all mcast routes will have counters allocated. This <G, S> configuration is applicable when the hardware runs out of resources. Specific <G, S> creation has priority to preempt counters from wildcard creation.
The byte | frame optional keyword enables the counter to be in either byte mode or frame mode. This mode applies to all counters. When the counter mode changes, all counter values will be reset to zero.

Either <G, S>, or byte | frame optional keywords are used but cannot be used together. All counters are byte|frame. The byte|frame mode is global and not applicable on a <G, S> basis.
Execute clear command:
```
clear ip multicast count <G> <S>
```
Execute show command:
```
show multicast fib ipv4 <G> count
```
This command currently exists but does not show anything.
This show command is intended to display the following (example):
```
switch> show multicast fib ipv4 count
Activity poll time: 60 seconds 
225.1.1.1 100.0.0.2
Byte: 123
Vlan100 (iif)
Vlan200
Activity 0:00:47 ago
```
Total counts are the sum of counts from all sources in that group.

The count value can be N/A if a mroute does not have an associated counter.

If the count value for any source in a G is N/A, then the total counts for G will be shown as N/A. However, the count values for other sources are still shown.

Route Management

When enabling routing, the switch discovers the best route to a packet destination address by exchanging routing information with other devices. EOS disables IP routing by default.

The following sections describes routing features that EOS supports:

Route Redistribution
Equal Cost Multipath Routing (ECMP) and Load Sharing
Unicast Reverse Path Forwarding (uRPF)
Routing Tables / Virtual Routing and Forwarding (VRF)
RIB Route Control

Route Redistribution

Route redistribution advertises connected (static) routes or routes established by other routing protocols into a dynamic routing protocol's routing domain. By default, the switch advertises only routes in a routing domain established by the protocol that defined the domain.

Route redistribution commands specify the scope of the redistribution action. By default, all routes from a specified protocol, or all static routes, advertise into the routing domain. Commands can filter routes by applying a route map and defining the subset of routes to advertise.

Equal Cost Multipath Routing (ECMP) and Load Sharing

Equal Cost Multi-Path (ECMP) provides a routing strategy to forward traffic over multiple paths with equal routing metric values.

Configuring ECMP (IPv4)

EOS assigns all ECMP paths with the same tag value, and commands that change the tag value of a path also change the tag value of all paths in the ECMP route.

In a network topology using ECMP routing, hash polarization may result when all switches perform identical hash calculations. Hash polarization leads to uneven load distribution among the data paths. Switches select different hash seeds to perform hash calculations and avoid hash polarization.

The ip load-sharing command provides the hash seed with an algorithm for distributing data streams among multiple equal-cost routes to a specified subnet.

Example

This command sets the IPv4 load sharing hash seed to 20:

switch(config)# ip load-sharing fm6000 20
switch(config)#

Multicast Traffic Over ECMP

The switch attempts to spread outbound unicast and multicast traffic to all ECMP route paths equally. To disable the sending of multicast traffic over ECMP, use the multipath none command or the no version of the multipath deterministic command.

Resilient ECMP

Resilient ECMP uses prefixes where routes are not desired for rehashing due to link flap, typically where ECMP participates in load balancing. Resilient ECMP configures a fixed number of next-hop entries in the hardware ECMP table for all the routes within a specified IP address prefix. Implementing fixed table entries for a specified next-hop address allows the data flow hash to a valid next-hop number to remain intact even when some next-hops go down or come back online.

Enable resilient ECMP for all routes within a specified prefix using the ip hardware fib ecmp resilience

command. The command specifies the maximum number of next-hop addresses that the hardware ECMP table contains for the specified IP prefix and configures a redundancy factor that facilitates the duplication of next-hop addresses in the table. The fixed table space for the address uses the maximum number of next hops multiplied by the redundancy factor. When the table contains the maximum number of next-hop addresses, the redundancy factor specifies the number of times to list each address. When the table contains fewer than the maximum number of next-hop addresses, the table space entries fill with additional duplication of the next-hop addresses.

EOS supports resilient ECMP for IPv6 IP addresses.

Example

This command configures a hardware ECMP table space of 24 entries for the IP address 10.14.2.2/24. A maximum of six next-hop addresses can be specified for the IP address. When the table contains six next-hop addresses, each appears in the table four times. When the table contains fewer than six next-hop addresses, each address duplicates until filling all of the 24 table entries.

switch(config)# ip hardware fib ecmp resilience 10.14.2.2/24 capacity 6 redundancy 4
switch(config)#

Unequal Cost Multipath (UCMP) for Static Routes

Unequal Cost Multipath (UCMP) for Static Routes provides a mechanism to forward traffic from a device on an ECMP route with the ratio of the weights used for next-hops and program them into the Forwarding Information Database (FIB).

Configuring UCMP for Static Routes

Use the following commands to configure UCMP on the VRF, myVRF, with an FEC maximum size of 100:

switch(config)# router general
switch(config-router-general)# vrf myVRF
switch(config-router-general-vrf-myVRF)# route static ucmp forwarding fec maximum-size 100

Aggregate Group Monitoring (AGM) for ECMP

This feature allows the monitoring of packets and bytes traversing the members of the configured ECMP groups on the switch with a high time resolution. Once enabled, AGM collects data for the specified duration, writes it to the specified file on the switch storage, and then stops.

Supported Platforms

DCS-7260CX3

Configuring AGM for ECMP Groups

Note: You must have at least one ECMP Group configured on the switch.

To begin collecting data on the switch at 100 millisecond intervals for 1800 seconds, use the following command:

switch(config)# start snapshot counters ecmp poll intervall 100 milliseconds duration 1800 seconds

Specify an optional URL to store the data. If not specified, the files store in the non-persistent storage at /var/tmp/ecmpMonitor.

If providing a URL, it must point to a valid file system. EOS allows the following file systems:

file - The path must start with /tmp or /tmp. The files store in the non-persistent storage.
flash - Files store in persistent storage.

Use the following command to interrupt the snapshot before the end of the configured duration:

switch# stop snapshot counters ecmp

To delete previous snapshots, use the following command:

switch# clear snapshot counters ecmp id_range

If you do not specify a range of IDs, then all previous snapshots delete from the system.

Displaying AGM for ECMP Information

Use the show snapshot counters ecmp history to display information about the configuration.

switch# show snapshot counters ecmp history
                                Request ID: 17
                                Output directory URL: file:/var/tmp/ecmpMonitor
                                Output file name(s): ecmpMonitor-17-adj1284.ctr, ecmpMonitor-17-adj1268.ctr
                                Complete: True
                                Poll interval: 1000 microseconds
                                Total poll count: 59216
                                Start time: 2024-06-17 17:58:36
                                Stop time: 2024-06-17 17:59:36
                                
                                L2 Adjacency ID    Interfaces
                                --------------------- ----------------------------------------------------              
                                1268                  Ethernet54/1, Ethernet41/1, Ethernet1/1, Ethernet57/1
                                1284                  Ethernet20/1, Ethernet35/1, Ethernet41/1, Ethernet8/1, Ethernet1/1

The output displays the list of previous snapshots including any current ones as well as the following information:

Request ID - Identifies the snapshot Request ID to use for the clear command.
Output directory URL - Identifies the snapshot storage location.
Complete - Identifies the snapshot completion status.
Poll Interval - Identifies the configured polling interval for the snapshot.
Total poll count - Identifies the total number of hardware counters collected.d
Start time and Stopped time - Identifies the system time when the snapshot started and stopped.
L2 Adjacency ID and Interfaces - The summary of the ECMP groups monitored by AGM.

Resilient Equal-Cost Multi-Path(RECMP) Deduping

Routes covered by a Resilient Equal-Cost Multi-Path (RECMP) prefix consists of routes that use hardware tables dedicated for Equal-Cost Multi-Path (ECMP) routing. Resilient ECMP (RECMP) deduping reduces the number of ECMP hardware table entries allocated by the switch to force the routes with the same set of next hops but point to different hardware table entries and point to the same hardware table entry when encountering high hardware resource utilization. Forcing RECMP routes to change the hardware table entry that they point to may potentially cause a traffic flow disruption for any existing flows going over that route. The deduping process attempts to minimize the amount of potential traffic loss.

Each route needs to allocate hardware table entries in the ASIC that contain forwarding information for the route, such as the next-hops and egress links used by each next-hop uses. The network device uses these hardware table entries when making forwarding decisions for a packet meant for a certain route. These ECMP hardware tables have limited size and can fill up quickly if allocating a large number of these hardware table entries. One option to ease the usage of these hardware tables can force RECMP routes to share hardware table entries.

RECMP routes can point to the same hardware table entry if they share the same set of next hops and the order of the next-hops. However, RECMP routes may end up sharing the same set of next-hops, but the next-hop ordering may be different between them, and the routes end up occupying different hardware table entries in the ASIC. RECMP routing has a property where the current ordering of next-hops for a given route can be influenced by the previous order. The ordering between the routes can differ because these routes had a different set of next hops at some previous time before they finally converged onto the same set of next-hops.

When the ECMP hardware resource usage crosses the high threshold, the deduping process begins, and it lasts until the ECMP hardware resource usage falls below the low threshold. Use the ip hardware fib next-hop resource optimization thresholds command to modify the thresholds.

Configuring Resilient ECMP Deduping

EOS disabled Resilient ECMP Deduping by default.

Use the following command to disable all the hardware resource optimization features:
```
switch(config)# ip hardware fib next-hop resource optimization disabled
```
Use the following command to re-enable the all hardware resource optimization features after disabling them:
```
switch(config)# no ip hardware fib next-hop resource optimization disabled
```
Use the following command to configure the thresholds for starting and stopping the optimization:
```
switch(config)# ip hardware fib next-hop resource optimization thresholds low <20> high <80>
```

Note:

The value specified for the threshold represents the percentage of resource utilization, and uses an integer between 0 and 100.
Setting the high threshold to 80 indicates that optimization starts when the resource utilization is above 80%. The default value of this threshold is 90.
Setting the low threshold to 20 indicates that optimization stops when the resource utilization is below 20%. The default value of this threshold is 85.

Show Commands

The show ip hardware fib summary command displays the statistics of this RECMP deduping:

Example

switch# show ip hardware fib summary
Fib summary
-----------
Adjacency sharing: disabled
BFD peer event: enabled
Deletion Delay: 0
Protect default route: disabled
PBR: supported
URPF: supported
ICMP unreachable: enabled
Max Ale ECMP: 600
UCMP weight deviation: 0.0
Maximum number of routes: 0
Fib compression: disabled
Resource optimization for adjacency programming: enabled
Adjacency resource optimization thresholds: low 20, high 80

The last two lines of the output shows if RECMP deduping is enabled, and the corresponding threshold values for starting and stopping the optimization process.

The show hardware capacity command displays the utilization of the hardware resources. The example below shows the multi-level hierarchy ECMP resources:

switch# show hardware capacity
Forwarding Resources Usage

Table    Feature         Chip    Used     Used    Free	Committed    Best Case    High
                                 Entries  (%)     Entries    Entries      Max          Watermark
                                                                                       Entries
------- --------------- ------- -------- ------- --------   ------------ ------------ ---------
ECMP                            0        0%     4095        0     	 4095         0
ECMP     Mpls                   0        0%     4095        0     	 4095         0
ECMP     Routing                0        0%     4095        0     	 4095         0
ECMP     VXLANOverlay           0        0%     4095        0     	 4095         0
ECMP     VXLANTunnel            0        0%     3891        0     	 3891         0

Limitations

With RECMP deduping, optimization of a sub-optimal ECMP route requires releasing and reallocating hardware resources for the route. Therefore the process may increase overall convergence time for route programming. It may not be desirable to always start the optimization when the sufficent hardware resource existt. The threshold value for starting the optimization should be adjusted based on the route scale of the network.
The deduping of ECMP hardware resources may cause potential traffic flow disruption for traffic flows going over RECMP routes with changing hardware table entries. While the deduping process tries to minimize the amount of traffic flow disruption, it is still sometimes inevitable.
RECMP hardware table entries can only be deduped to other RECMP hardware table entries that share the same set of nexthops. This puts a limit to the amount of RECMP hardware table entries that can be reduced to the number of RECMP hardware table entries with unique nexthop sets.

Unicast Reverse Path Forwarding (uRPF)

Unicast Reverse Path Forwarding (uRPF) verifies the accessibility of source IP addresses in forwarded packets from a switch. When uRPF determines that the routing table does not contain an entry with a valid path to the packet source IP address, the switch drops the packet.

IPv4 and IPv6 uRPF operate independently. Configure uRPF on a VRF. Commands that do not specify a VRF utilize the default instance. uRPF does not affect multicast routing.

uRPF defines two operational modes:

Strict mode - In strict mode, uRPF also verifies that a received packet on the interface with the routing table entry uses that entry for the return packet.
Loose mode - uRPF validation does not verify the inbound packet ingress interface.

uRPF Operation

Configure uRPF on interfaces. For packets arriving on a uRPF-enabled interface, the source IP address examines the source and destination addresses of unicast routing table entries and verifies it.

uRPF requires a reconfigured routing table to support IP address verification. When enabling uRPF for the first time, unicast routing becomes briefly disabled to facilitate the routing table reconfiguration. The initial enabling of uRPF does not affect multicast routing.

A packet fails uRPF verification if the table does not contain an entry whose source or destination address that matches the packet’s source IP address. In strict mode, the uRPF also fails when the matching entry’s outbound interface does not match the packet’s ingress interface.

uRPF does not verify the following packets:

DHCP with a source that uses 0.0.0.0 and a destination uses 255.255.255.255.
IPv6 link local in the following format -FE80::/10.
Multicast packets

ECMP uRPF

When verifying ECMP routes, strict mode checks all possible paths to determine the correct interface receives the packet. ECMP groups with a maximum of eight routing table entries support strict mode. The switch reverts to loose mode for ECMP groups that exceed eight entries.

Default Routes

uRPF strict mode provides an allow-default option that accepts default routes. On interfaces that enable allow-default and define a default route, uRPF strict mode validates a packet even when the routing table does not contain an entry that matches the packet’s source IP address. If not enabling allow-default, uRPF does not consider the default route when verifying an inbound packet.

Null Routes

NULL0 routes drop traffic destined to a specified prefix. When enabling uRPF, traffic originating from null route prefixes drops in strict and loose modes.

uRPF Configuration

Enable Unicast Reverse Path Forwarding (uRPF) for IPv4 packets ingressing the configuration mode interface using the ip verify command.

Note: uRPF cannot be enabled on interfaces with ECMP member FECs.

Examples

This command enables uRPF loose mode on interface vlan 17.

switch(config)# interface vlan 17
switch(config-if-Vl17)# ip verify unicast source reachable-via any
switch(config-if-Vl17)# show active
 interface Vlan17
   ip verify unicast source reachable-via any
switch(config-if-Vl17)#

This command enables uRPF strict mode on interface vlan 18.

switch(config)# interface vlan 18
switch(config-if-Vl18)# ip verify unicast source reachable-via rx
switch(config-if-Vl18)# show active
 interface Vlan18
   ip verify unicast source reachable-via rx
switch(config-if-Vl18)#

Routing Tables / Virtual Routing and Forwarding (VRF)

An IP routing table is a data table that lists the routes to network destinations and metrics (distances) associated with those routes. A routing table is also known as a Routing Information Base (RIB).

Virtual Routing and Forwarding (VRF) allows traffic separation by maintaining multiple routing tables. Arista switches support multiple VRF instances:

A default global VRF
Multiple user-defined VRFs

The number of user-defined VRFs supported varies by platform. VRFs can be used as management or data plane VRFs.

Management VRFs have routing disabled and typically used for management-related traffic.
Dataplane VRFs have routing enabled and support routing protocols and packet forwarding, including both hardware and software.

Trident, FM6000, and Arad platform switches support dataplane VRFs.

VRFs support unicast IPv4 and IPv6 traffic and multicast traffic. Loopback, SVI, and routed ports may be added to VRFs. Management ports may be added without any hardware forwarding.

To allow overlap in the sets of IP addresses used by different VRF instances, a Route Distinguisher (RD) may be prepended to each address. RFC4364 defines RDs.

Default VRF

EOS creates the default VRF automatically and you cannot renamed or configure it. Some configuration options accept default as a VRF input.

User-Defined VRFs

Create a user-defined VRF with the vrf instance command. After creating it, a VRF may be assigned a Route Distinguisher (RD) with the rd (VRF configuration mode) command in the VRF submode of Router-BGP Configuration Mode.

Examples

These commands create a VRF named purple, place the switch in BGP VRF configuration mode for that VRF, and specify a route distinguisher for the VRF, identifying the administrator as AS 530, and assigning 12 as its local number.
```
switch(config)# vrf instance purple
switch(config-vrf-purple)# router bgp 50
switch(config-router-bgp)# vrf purple
switch(config-router-bgp-vrf-purple)# rd 530:12
switch(config-router-bgp-vrf-purple)#
```
To add interfaces to a user-defined VRF, enter configuration mode for the interface and use the vrf (Interface mode) command. Loopback, SVI, and routed ports can be added to a VRF.
These commands add vlan 20 to the VRF named purple.
```
switch(config)# interface vlan 20
switch(config-if-Vl20)# vrf purple
switch(config-if-Vl20)#
```

The show vrf command shows information about user-defined VRFs on the switch.

This command displays information for the VRF named purple.

switch# show vrf purple
Vrf     RD         Protocols  State       Interfaces
------- ---------- ---------- ----------- ------------
purple  64496:237  ipv4       no routing  Vlan42, Vlan43

switch>

rd (VRF configuration mode)

The rd command issued in VRF Configuration Mode is a legacy command supported for backward compatibility. To configure a Route Distinguisher (RD) for a VRF, use the rd (VRF configuration mode) command.

Note: Legacy RDs that were assigned to a VRF in VRF Configuration Mode will still appear in show vrf outputs if an RD has not been configured in Router-BGP VRF Configuration Mode, but they no longer have an effect on the system.

Context-Active VRF

The context-active VRF specifies the default VRF commands to use when displaying or refreshing routing table data.

VRF-context aware commands include:

clear arp-cache
show ip
show ip arp
show ip route
show ip route gateway
show ip route host

The cli vrf command specifies the context-active VRF.

Example

This command specifies magenta as the context-active VRF.

switch# cli vrf magenta
switch# show routing-context vrf
Current VRF routing-context is magenta

The show routing-context vrf command displays the context-active VRF.

Example

This command displays the context-active VRF.

switch# show routing-context vrf
Current VRF routing-context is magenta
switch#

RIB Route Control

The Routing Information Base (RIB) consists of the routing information learned by the routing protocols, including static routes. The Forwarding Information Base (FIB) consists of the routes actually used to forward traffic through a router.

Forwarding Information Base (FIB) performs IP destination prefix-based switching decisions. Similar to a routing table, the FIB maintains the forwarding information for the winning routes from the RIB. When routing or topology changes occur in the network, the IP routing table information updates, and reflects the changes in the FIB.

Configuring FIB policy

The RIB calculates the best or winning routes to each destination and place these routes in the forwarding table. Then advertises the best routes based on the configured FIB policy.

For example, a FIB policy can be configured to deny the routes for FIB programming, however, it does not prevent these routes fromadvertising a routing protocol, or redistributed into another routing domain, or used for recursive resolution in the IP RIB. FIB policies control the size and content of the routing tables, and the best route to take to reach a destination.

Use the rib ipv4 | ipv6 fib policy command to enable an FIB policy for a specific VRF in the Router General Configuration Mode.

EOS supports the following match statements:

match interface
match [ ip | ipv6 ] address prefix-list
match [ ip | ipv6 ] resolved-next-hop prefix-list
match isis level
match metric
match source-protocol

Example

The following example enables FIB policy for IPv4 in the default VRF, using the route map, map1.

switch(config)# router general
switch(config-router-general)# vrf default 
switch(config-router-general-vrf-default)# rib ipv4 fib policy map1

Displaying FIB Information

Use the show rib route <ipv4|ipv6> fib policy exclude command to display the RIB information. The fib policy excluded option displays the RIB routes excluded from programming into the FIB by the FIB policy.

Example

The following example displays the routes filtered by FIB policy using the fib policy excluded option of the show rib route ip|ipv6 command.

switch# show rib route ipv6 fib policy excluded
switch# show rib route ip bgp fib policy excluded

VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
>B    10.1.0.0/24 [200/0]
         via 10.2.2.1 [115/20] type tunnel
            via 10.3.5.1, Ethernet1
         via 10.2.0.1 [115/20] type tunnel
            via 10.3.4.1, Ethernet2
            via 10.3.6.1, Ethernet3 
>B    10.1.0.0/24 [200/0]
         via 10.2.2.1 [115/20] type tunnel
            via 10.3.5.1, Ethernet1
         via 10.2.0.1 [115/20] type tunnel 
            via 10.3.4.1, Ethernet2
            via 10.3.6.1, Ethernet3

Displaying RIB Route Information

Use the show rib route ip command to view the IPv4 RIB information.

Example:

This command displays IPv4 RIB static routes.

switch# show rib route ip static

VRF name: default, VRF ID: 0xfe, Protocol: static
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
>S    10.80.0.0/12 [1/0]
         via 172.30.149.129 [0/1]
            via Management1, directly connected
>S    172.16.0.0/12 [1/0]
         via 172.30.149.129 [0/1]
            via Management1, directly connected

switch#

IPv4 Route Scale

Optimize IPv4 routes to achieve route scale when route distribution has many routes with one or two parameters, and each parameter consisting of prefix lengths 12, 16, 20, 24, 28, and 32. If configuring two separate prefix lengths, in any order, one must have the prefix length of 32.

Note: IPv4 Route Scale cannot be used with AlgoMatch.

The following sections describe IPv4 route scale configuration, show commands, and system log messages:

Configuring IPv4 Route Scale
IPv4 Routescale with 2-to-1 Compression
Show Commands

Configuring IPv4 Route Scale

Enable IPv4 route scale using the ip hardware fib optimize command in the Global Configuration Mode. The platform Layer 3 agentrestarts to ensure IPv4 routes optimization with the agent SandL3Unicast terminate command in the Global Configuration Mode.

Example

This configuration command allows configuring prefix lengths 12 and 32.

switch(config)# ip hardware fib optimize exact-match prefix-length 12 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

One of the two prefixes uses a prefix-length of 32 required in the instance when using two prefixes. For this command to take effect, you must restart the platform Layer 3 agent.

Example

This configuration command restarts the platform Layer 3 agent to ensure IPv4 route optimization.

switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated

Restarting the platform Layer 3 agent results in deletion of all IPv4 routes and then re-adds them to the hardware.

Example

This configuration command allows configuring prefix lengths 32 and 16.

switch(config)# ip hardware fib optimize exact-match prefix-length 32 16
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

One of the two prefixes uses a prefix-length of 32 required in the instance when using two prefixes. For this command to take effect, you must restart the platform Layer 3 agent.

Examples

This configuration command restarts the platform Layer 3 agent to ensure IPv4 route optimization.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes and then re-adds them to the hardware.

This configuration command allows configuring prefix length 24.

switch(config)# ip hardware fib optimize exact-match prefix-length 24
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

In this instance, when configuring a single prefix-length, the configuration does not require a prefix-length of 32. For this command to take effect, you must restart the platform Layer 3 agent.

Examples

This configuration command restarts the platform Layer 3 agent to ensure IPv4 route optimization.
```
switch(config)#agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes and then re-adds them to the hardware.

This configuration command allows configuring the prefix length 32.

switch(config)# ip hardware fib optimize exact-match prefix-length 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

For this command to take effect, you must restart the platform Layer 3 agent.

This configuration command restarts the platform Layer 3 agent to ensure IPv4 route optimization.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes and then re-adds them to the hardware.

This configuration command disables the prefix lengths 12 and 32 configuration.

switch(config)#no ip hardware fib optimize exact-match prefix-length 12 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are not optimized

One of the two prefixes uses a prefix-length of 32 required in the instance when using two prefixes. For this command to take effect, you must restart the platform Layer 3 agent.

Examples

This configuration command restarts the platform Layer 3 agent to ensure no IPv4 route optimization.
```
switch(config)#agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes and then re-adds them to the hardware.
This configuration command attempts to configure the prefix lengths 20 and 28 which triggers an error exception. One of the two prefixes in this command must be a prefix-length of 32 required when adding two prefixes.
```
switch(config)#ip hardware fib optimize exact-match prefix-length 20 28
% One of the prefix lengths must be 32
```

IPv4 routes of certain prefix lengths can be optimized for enhanced route scale. The following command disables prefix optimization on the specified VRF(s) to provide more flexibility.

Examples

This configuration command disables prefix optimization on the default VRF.

switch(config)# ip hardware fib optimize disable-vrf default
! Please restart layer 3 forwarding agent to ensure that the disable-vrf option change takes effect

This configuration command disables prefix optimization on VRFs named vrf1 and vrf2.

switch(config)# ip hardware fib optimize disable-vrf vrf1 vrf2
! Please restart layer 3 forwarding agent to ensure that the disable-vrf option change takes effect

This configuration command restarts the platform Layer 3 agent to ensure that the disable-vrf configuration takes effect.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```

Examples

This configuration command enables prefix optimization on the default VRF.

switch(config)# ip hardware fib optimize vrf default prefix-length 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

This configuration command enables prefix optimization on VRFs named vrf1 and vrf2.

switch(config)# ip hardware fib optimize vrf vrf1 vrf2 prefix-length 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

This configuration command disables optimization on vrf1 and vrf2 optimization configured in above example.

switch(config)# no ip hardware fib optimize vrf vrf1
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

The platform trident forwarding-table partition flexible command enables ALPM Mode in Flexible UFT mode using a subset of resources, so ALPM and Exact Match can coexist.

Examples

This configuration command sets up the flexible partition.

switch(config)# platform trident forwarding-table partition flexible ?
  alpm         Shared UFT bank entries for the ALPM table
  exact-match  Shared UFT bank entries for the exact-match table
  l2-shared    Shared UFT bank entries for the MAC table
  l3-shared    Shared UFT bank entries for the host table

ALPM gives the route prefix in DEFIM (TCAM table for longest prefix matched (LPM) lookup) and ALPM tables.

switch(config)# platform trident forwarding-table partition flexible alpm ?
  184320  Upto 180K LPM routes
  368640  Upto 360K LPM routes

Note: The size parameter has following values:

DCS-7300X3: 180k and 360k are accepted.
CCS-720XP: 144k and 96k are accepted.
Other sizes are invalid.

IPv4 Routescale with 2-to-1 Compression

The IPv4 routescale with2-to-1 compression optimizes certain prefix lengths and enhances the route scale capabilities on 7500R, 7280R, 7500R2, and 7280R2 platforms. The compression is best suited to achieve route scale when route distribution has a large number of routes of one or two prefix lengths.

Configuring IPv4 Routescale 2-to-1 Compression

Use the compress command to increase the hardware resources available for the specified prefix length. This command allows configuring up to one compressed prefix length, and this command is supported only on 7500R, 7280R, 7500R2, and 7280R2 platforms.

Note: The compress command takes effect only when you restart the platform Layer3 agent on 7500R, 7280R, 7500R2, and 7280R2 platforms. Use command agent SandL3Unicast terminate to restart the platform Layer3 agent.

Examples

In the following example we are configuring prefix length 20 and 24, expanding prefix length 19 and 23, and compressing prefix length 25.

switch(config)# ip hardware fib optimize prefix-length 20 24 expand 19 23 compress 25
 ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

In the following example we are configuring prefix length 20 and 23, expanding prefix length 19, compressing prefix length 24.

switch(config)# ip hardware fib optimize prefix-length 20 23 expand 19 compress 24
 ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

Optionally, you can also use the internet profile to configure the IPv4 route scale compression.

switch(config)# ip hardware fib optimize prefixes profile internet
 ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

Configure a new TCAM profile for the compress configuration to work, and disable a few features in the new TCAM profile to make space for the flex-route feature in the hardware. Features like acl vlan ip and the mirror ip have to be disabled, if you need any of these features or any other features to be enabled with flex-route feature, contact the Arista team.

The internet profile works differently based on whether the flex-route feature is enabled in the TCAM profile or not. If the flex-route feature is enabled, the internet profile behaves like ip hardware fib optimize prefix-length 20 23 expand 19 22 compress 24. If the flex-route feature is disabled, the internet profile behaves as ip hardware fib optimize prefix-length 20 24 expand 19 23.

Example

switch(config)# hardware tcam
switch(config-hw-tcam)# profile flex-route copy default
switch(config-hw-tcam-profile-flex-route)# feature flex-route copy system-feature-source-profile
switch(config-hw-tcam-profile-flex-route-feature-flex-route)# exit
switch(config-hw-tcam-profile-flex-route)# no feature acl vlan ip
switch(config-hw-tcam-profile-flex-route)# no feature mirror ip
switch(config-hw-tcam-profile-flex-route)# exit
Saving new profile 'flex-route'
switch(config-hw-tcam)# system profile flex-route

Limitations

A maximum of two prefix lengths can be optimized directly at any point of time, of which only one can be a non-nibble aligned prefix length. Additional prefix lengths can be optimized using the expand or the compress options.
A maximum of 1-to-4 way expansion and 2-to-1 way compression into any optimized prefix length is supported. Multiple expansion prefix lengths can be programmed at any time, however, there can be just one compression prefix length programmed at any given point in time.
A maximum of 4096 next-hops can be reliably pointed to by the compressed prefixes using 2-to-1 way compression.
The 2-to-1 compression cannot be enabled along with unicast RPF. When both features are enabled together, unicast RPF functionality may not be correct.
The flex-route feature in TCAM profiles based only on the default profile, while disabling the acl vlan ip and the mirror ip features. Contact the Arista team if any other feature, that is not available in the default TCAM profile, is required to be supported along with the flex-route feature, including support for Mirror to GRE tunnel or ACLs on SVI.
VXLAN is not supported with the compress option of this feature. There is no Syslog or a warning message when VXLAN is configured along with the 2-to-1 way compression feature.

Show Commands

Display the IPv4 route scale summary using the show platform arad ip route summary command in the Global Configuration Mode. Resources for all IPv4 route scale routes are displayed by the show platform arad ip route command for the Global Configuration Mode.

Examples

This command displays hardware resource usage for IPv4 routes.

switch(config)# show platform arad ip route summary

Total number of VRFs: 1
Total number of routes: 25
Total number of route-paths: 21
Total number of lem-routes: 4

This command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources appear with an asterisk (*).

switch(config)# show platform arad ip route

Tunnel Type: M(mpls), G(gre)
* - Routes in LEM
------------------------------------------------------------------------------------------------
|                              Routing Table                                      |             |
|------------------------------------------------------------------------------------------------
|VRF|  Destination   |     |                   |    |Acl  |                 |ECMP | FEC | Tunnel
|ID |    Subnet      | Cmd |    Destination    |VID |Label| MAC / CPU Code  |Index|Index|T Value
------------------------------------------------------------------------------------------------
|0  |0.0.0.0/8       |TRAP |CoppSystemL3DstMiss|0   | -   |ArpTrap          |  -  |1030 |   -  
|0  |100.1.0.0/32    |TRAP |CoppSystemIpBcast  |0   | -   |BcastReceive     |  -  |1032 |   -  
|0  |100.1.0.0/32    |TRAP |CoppSystemIpUcast  |0   | -   |Receive          |  -  |32766|   -  
|0  |100.1.255.255/32|TRAP |CoppSystemIpBcast  |0   | -   |BcastReceive     |  -  |1032 |   -  
|0  |200.1.255.255/32|TRAP |CoppSystemIpBcast  |0   | -   |BcastReceive     |  -  |1032 |   -  
|0  |200.1.0.0/16    |TRAP |CoppSystemL3DstMiss|1007| -   |ArpTrap          |  -  |1029 |   -  
|0  |0.0.0.0/0       |TRAP |CoppSystemL3LpmOver|0   | -   |SlowReceive      |  -  |1024 |   -  
|0  |4.4.4.0/24*     |ROUTE|Et10               |1007| -   |00:01:00:02:00:03|  -  |1033 |   -  
|0  |10.20.30.0/24*  |ROUTE|Et9                |1006| -   |00:01:00:02:00:03|  -  |1027 |   -

IP Source Guard

IP Source Guard (IPSG) prevents IP spoofing attacks.

IP Source Guard (IPSG) filters inbound IP packets based on the source MAC and IP addresses. Hardware supports IPSG. IPSG enabled on a Layer 2 port verifies IP packets received on this port. EOS permits packets if each packet source MAC and IP addresses match user-configured IP-MAC binding entries on the receiving VLAN and port. EOS drops packets with no match immediately.

Configuring IPSG

IPSG applies only to Layer 2 ports, and you enable it using the ip verify source command for the Global Configuration Mode. When configured on Layer 3 ports, IPSG does not take effect until this interface converts to Layer 2.

Layer 2 Port-Channels, not member ports, support IPSG. The IPSG configuration on port channels supersedes the configuration on the physical member ports. Therefore, source IP MAC binding entries should be configured on port channels using the ip source binding command. When configured on a port channel member port, IPSG does not take effect until deleting this port from the port channel configuration.

Examples

These configuration commands exclude VLAN IDs 1 through 3 from IPSG filtering. When enabled on a trunk port, IPSG filters the inbound IP packets on all allowed VLANs. IP packets received on VLANs 4 through 10 on ethernet 36 filter using IPSG, while those received on VLANs 1 through 3 are permitted.
```
switch(config)# no ip verify source vlan 1-3
switch(config)# interface ethernet 36
switch(config-if-Et36)# switchport mode trunk
switch(config-if-Et36)# switchport trunk allowed vlan 1-10
switch(config-if-Et36)# ip verify source
switch(config-if-Et36)#
```
This configuration command configures source IP-MAC binding entries to IP address 10.1.1.1, MAC address 0000.aaaa.1111, VLAN ID 4094, and interface ethernet 36.
```
switch(config)# ip source binding 10.1.1.1 0000.aaaa.1111 vlan 4094 interface ethernet 36
switch(config)#
```

DHCP Server Show Commands

Use the show dhcp server command to display DHCP server information.

DHCPv4 display example:

switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 10.2.2.2
DNS domain name: domainFoo
Lease duration: 1 days 0 hours 0 minutes
TFTP server:
serverFoo (Option 66)
10.0.0.3 (Option 150)
TFTP file: fileFoo
Active Leases: 1
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Inactive (Could not determine VRF)
   Ethernet2   Inactive (Not in default VRF)
   Ethernet3   Inactive (Kernel interface not created yet)
   Ethernet4   Inactive (Not up)
   Ethernet5   Inactive (No IP address)
   Ethernet6   Active

Vendor information:
Vendor ID: default
  Sub-options         Data       
---------------- ----------------
      1          192.0.2.0, 192.0.2.1

Vendor ID: vendorFoo
  Sub-options       Data       
---------------- -----------
      2            192.0.2.2
      3            “Foo”

Subnet: 10.0.0.0/8
Subnet name: subnetFoo
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.1.1.1 10.2.2.2
Lease duration: 3 days 3 hours 3 minutes
Default gateway address: 10.0.0.3
TFTP server:
subnetServerFoo (Option 66)
10.0.0.4 (Option 150)
TFTP boot file: subnetFileFoo
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.1

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.2

For DHCPv6, there are two additional fields in subnet information output, Direct field and the Relay field. These two fields specify if the DHCP Server is accepting broadcast or relayed messages.

The Direct field displays Active when the subnet matches the interface with DHCPv6 configured. This indicates the server is accepting broadcast messages.

The Direct field displays Inactive when there is another existing subnet already matching the interface, or when the subnet matches more than one DHCP configured interface.

Examples of outputs for the DHCPv6 show dhcp server command:

In this example, DHCPv6 is configured with subnet fe80::/10 while being enabled on Ethernet1 with address fe80::1/64 and on Ethernet3 with address fe80::2/64.

switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled                                                                                                                                                                                                                     
DNS server(s): fe80::6                                                                                                                                                                                                                     
DNS domain name: testaristanetworks.com                                                                                                                                                                                                        
Lease duration: 1 days 3 hours 30 minutes                                                                                                                                                                                                      
Active leases: 0                                                                                                                                                                                                                               
IPv6 DHCP interface status:                                                                                                                                                                                                                    
   Interface    Status                                                                                                                                                                                                                         
--------------- ------                                                                                                                                                                                                                         
   Ethernet1    Active
   Ethernet3    Active                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                               
Subnet: fe80::/10                                                                                                                                                                                                                      
Subnet name: foo                                                                                                                                                                                                                                                                                                                                                                                                                                     
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5                                                                                                                                                                                                                                                                                                                                                                                                                                          
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active                                                                                                                                                                                                                            
Active leases: 0

This example illustrates when multiple subnets match an interface. In this example, DHCPv6 is configured with subnets fc00::/7 and fe80::/10 while being enabled on Ethernet1 with address fe80::1/10 and fc00::1/7.

switch# show dhcp server ipv6
IPv6 DHCP server is active                                                                                                                                                                                                                     
DNS server(s):  fc00::2                                                                                                                                                                                                                     
DNS domain name: testaristanetworks.com                                                                                                                                                                                                        
Lease duration: 1 days 3 hours 30 minutes                                                                                                                                                                                                      
Active leases: 0                                                                                                                                                                                                                               
IPv6 DHCP interface status:                                                                                                                                                                                                                    
   Interface    Status                                                                                                                                                                                                                         
--------------- ------                                                                                                                                                                                                                         
   Ethernet1    Active                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                               
Subnet: fc00::/7                                                                                                                                                                                                                      
Subnet name: foo                                                                                                                                                                                                                               
Range: fc00::1 to fc00::5                                                                                                                                                                                                       
DNS server(s): fc00::6 fc00::8                                                                                                                                                                                                                                                                                                                                                                                                                                          
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
                                                                                                                                                                                                                                  
Active leases: 0

Subnet: fe80::/10                                                                                                                                                                                                                      
Subnet name: bar                                                                                                                                                                                                                                                                                                                                                                                                                                         
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active
                                                                                                                                                                                                                                  
Active leases: 0

When a subnet is disabled, the show dhcp server command displays the disable message with a reason. The number of active leases of the disabled subnets will be 0. In this example, there are overlapping subnets.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/24 (Subnet is disabled - overlapping subnet 10.0.0.0/8)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

Subnet: 10.0.0.0/8 (Subnet is disabled - overlapping subnet 10.0.0.0/24)
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0

In this example, the display output shows overlapping ranges.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/8 (Subnet is disabled - range 10.0.0.9-10.0.0.12 overlaps with an existing pool)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

This example shows duplicate static IP address reservation.

Subnet: 10.0.0.0/8 (Subnet is disabled - ipv4-address 10.0.0.11 is reserved more than once)
Subnet name:
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f    
IPv4 address: 10.0.0.11

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.11

Use the show dhcp server leases command to display detailed information about the IP addresses allocated by the DHCP Server (including the IP address, the expected end time for that address, the time when the address is handed out, and the equivalent MAC address).

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b                                                                                                                                                                                                                                
End: 2019/06/20 18:06:33 UTC                                                                                                                                                                                                                   
Last transaction: 2019/06/20 14:36:33 UTC                                                                                                                                                                                                      
MAC address: 165a.a86d.ffac

DHCP Server

The router with DHCP Server enabled acts as a server that allocates and delivers network addresses with desired configuration parameters to its hosts.

The DHCP server is based on ISC Kea.

The router with an DHCP Server enabled acts as a server that allocates and delivers network addresses with desired configuration parameters to its hosts.

DHCP Server support includes:

DHCPv4 support includes:

Configurable on different interfaces: Routed, VLAN, LAG, Sub-interface, and LAG Sub-interface.
Configurable lease time for allocated network addresses.
Configurable DNS domain.
Configurable DNS servers.
Configurable subnets with parameters:
- Default gateway
- DNS servers
- Ranges
- Lease time

Additional features for DHCPv4 include:

Configurable TFTP server
Configurable TFTP bootfile

Additional features for DHCPv4 includes:

Configurable Vendor options with sub options
Configurable sub option types include: IPv4 address, array of IPv4 addresses, and string
TFTP bootfile now supports an URI

Additional features for DHCPv4 include a configurable static IP address for exclusive use by a given client, based on the client’s MAC address.

Example deployment:

DHCP Server on an aggregation switch, via VXLAN tunnels.

DHCP Server Overview

The dhcp server command configures an Ethernet interface on a switch with DHCP server enabled. Configure the following features on all platforms:

Interfaces including Routed, VLANs, LAG, Sub-interface, and LAG Sub-interface
Lease time for allocated network addresses
DNS domains
DNS servers
Subnets with parameters:
- Default gateway
- DNS servers
- Ranges
- Lease time
TFTP Server-Name (DHCP option 66 )
TFTP server Bootfile-Name (DHCP option 67)
List of TFTP servers (DHCP option 150)
Vendor options with suboptions (DHCP option 43)
Suboptions including IPv4 address, array of IPv4 addresses, and string.
TFTP server Bootfile-Name (DHCP option 67) with support for an URI.
Configurable static IP address for exclusive use by a given client, based on the client MAC address.

Note: Only supported on a default VRF.

Minimal DHCP Server Configuration

The following displays a DHCP server enabled for IPv4 on Ethernet1 and IPv6 on Ethernet 2.

switch(config)# interface ethernet 1
switch(config-if-Et1)# dhcp server ipv4
switch(config)# interface ethernet 2
switch(config-if-Et2)# dhcp server ipv6

The following file extract displays a minimal working configuration for DHCP IPv4.

interface Ethernet1
no switchport
dhcp server ipv4
ip address 192.0.2.1/24
dhcp server
subnet 192.0.2.0/24
range 192.0.2.100 192.0.2.199

The following file extract displays a minimal working configuration for DHCP IPv6.

interface Vlan1409
dhcp server ipv6
ipv6 address 2001:db8:0:10::1/64/10
dhcp server
subnet 2001:db8:0:10::/64
range 2001:db8:0:10::1000 2001:db8:0:10::1fff

Configuring DHCP Servers

The DHCP server options configured globally per address family apply to all subnets. Access the following commands under the config-dhcp-server level.

The following command enters the DHCP server global configuration mode.

switch# configure
switch(config)# dhcp server
switch(config-dhcp-server)#

Use the following command to disable the DHCP server.

switch(config-dhcp-server)# disabled

Use the following commands to configure the DNS servers. Only two servers can be configured globally per address family.

switch(config-dhcp-server)# dns server ipv4 192.0.2.4 192.0.2.5
switch(config-dhcp-server)# dns server ipv6 2001:db8:0:10::53 2001:db8:0:10::5353

The following commands configure the domain names for allocated IP addresses. For example, add a domain with the name podV4.example.com for DHCPv4 and a domain with the name podV6.example.com for DHCPv6.

switch(config-dhcp-server)# dns domain name ipv4 podV4.example.com
switch(config-dhcp-server)# dns domain name ipv6 podV6.example.com

The following commands configure lease time for the allocated IP addresses. For example, configure the lease time as one (1) day.

switch(config-dhcp-server)# lease time ipv4 1 days 0 hours 0 minutes
switch(config-dhcp-server)# lease time ipv6 1 days 0 hours 0 minutes

The following command configures the TFTP Server-Name. The server can be in the form of either an IPv4 address or a fully qualified domain name and only available in DHCPv4. For example, configure the TFTP server with the IPv4 address, 192.0.2.6.

switch(config-dhcp-server)# tftp server option 66 ipv4 192.0.2.6

The following command configures the TFTP Servers.

switch(config-dhcp-server)# tftp server option 150 ipv4 192.0.2.6 192.0.2.7

The following command configures the TFTP Server Bootfile-Name, only available in DHCPv4.

switch(config-dhcp-server)# tftp server file ipv4 bootfile.conf

The following command configures Vendor specific option. To enter the Vendor option submode config-dhcp-vendor-ipv4 from config-dhcp-server config mode, specify a vendor class identifier, only available in DHCPv4. For example, Vendor option for clients with vendor class identifier vendorClassIDA.

switch(config-dhcp-server)# vendor-option ipv4 vendorClassIDA

The following command configures default. If you do not configure the default, the DHCP Server sends the configured Vendor option to clients requesting a Vendor option with a vendor class identifier that does not match any configured Vendor option.

switch(config-dhcp-server)# vendor-option ipv4 default

The following command configures suboptions for the Vendor. The configuration sends the resulting Vendor option in a hexadecimal format to the desired client. The output displays aVendor option with a suboption with IPv4 address 192.0.2.8, for clients with the vendor class identifier vendorClassIDA, resulting in Vendor option 1:4:c0:0:2:8.

Sub option number is 1
Length of the Data is 4
Data is c0:0:2:8
dhcp server
vendor-option ipv4 vendorClassIDA
sub-option 1 type ipv4-address data 192.0.2.8

The following command configures the Vendor option with IPv4 addresses 192.0.2.8 and 192.0.2.9, for clients with the vendor class identifier vendorClassIDA, resulting in the Vendor option fe:8:c0:0:2:8:c0:0:2:9.

switch(config-dhcp-server)# vendor-option ipv4 vendorClassIDA sub-option 254 type array ipv4-address data 192.0.2.8 192.0.2.9

The following command configures Vendor option with a string “vendor”, for all clients whose vendor class identifier does not match any configured Vendor option, resulting in Vendor option 1e:3:46:4f:4f..

switch(config-dhcp-server)# vendor-option ipv4 default sub-option 30 type string data "vendor"

The following command sets up Vendor option holding two suboptions, suboption 1 holds the IPv4 address 192.0.2.8, and suboption 2 holds a string “vendor”, for all clients whose vendor class identifier does not match any configured Vendor option, resulting in Vendor option 1:4:c0:0:2:8:2:3:46:4f:4f.

switch(config-dhcp-server)# vendor-option ipv4 default sub-option 1 type ipv4-address data 192.0.2.8 sub-option 2 type string data “vendor"

Configuring DHCP Server Subnets

DHCP Server settings can also be configured per subnet and overrides the DHCP Server global mode configurations. There can be multiple subnets configured, but they must not overlap. EOS disables overlapping subnets.

The following command enters DHCP Server subnet mode under the IPv4 address family.

switch(config-dhcp-server)# subnet 192.0.2.0/32

The following command enters DHCP Server subnet mode under IPv6 address family.

switch(config-dhcp-server)# subnet 2001:db8:0:10::/64

The following command configures the name of the subnet. For example, name subnetV4 for DHCPv4 and subnetV6 for DHCPv6.

switch(config-dhcp-server)# subnet 192.0.2.0/24 name subnetV4
switch(config-dhcp-server)# subnet 2001:db8:0:10::/64 name subnetV6

The following command configures range of IP addresses of the subnet. The range must be within the subnet mask, otherwise the subnet becomes disabled.

switch(config-dhcp-server)# subnet 192.0.2.0/24 range 192.0.2.100 192.0.2.199
switch(config-dhcp-server)# subnet 2001:db8:0:10::/64 range 2001:db8:0:10::1000 2001:db8:0:10::1fff

The following command configures the DNS servers for a subnet. Configure up to 2 servers per subnet.

switch(config-dhcp-server)# subnet 192.0.2.0/24 dns server 192.0.2.1 192.0.2.10
switch(config-dhcp-server)# subnet 2001:db8:0:10::/64 dns server 2001:db8:0:10::10 2001:db8:0:10::11

The following command configures the lease time for allocated IP addresses of the subnet.

switch(config-dhcp-server)# subnet 192.0.2.0/24 lease time ipv4 3 days 0 hours 0 minutes
switch(config-dhcp-server)# subnet fe80::/10 lease time ipv4 3 days 0 hours 0 minutes

The following command configures the default-gateway for a subnet.

switch(config-dhcp-server)# subnet 192.0.2.0/24 default-gateway 192.0.2.3

The following command configures the TFTP Server-Name for a subnet. The server can be in the form of either an IPv4 address or a fully qualified domain name, but can only be configured for DHCPv4.

switch(config-dhcp-server)# subnet 192.0.2.0/24 tftp server option 66 subnet-tftp.example.com

The following command configures a list of TFTP servers. The server can only be in the form of an IP address, but can only be configured for DHCPv4.

switch(config-dhcp-server)# subnet 192.0.2.0/24 tftp server option 150 192.0.2.6 192.0.2.7

The following command configures the TFTP server Bootfile-Name for a subnet, but can only be configured for DHCPv4.

switch(config-dhcp-server)# subnet 192.0.2.0/24 tftp server file subnet-bootfile.conf

The following command configures a static IP address for exclusive use by a client. Enter the dhcp-server-subnet configuration submode, (config-dhcp-mac-address-ipv4) from and specify the client MAC Address. The IP address must not be used by another client. Only DHCPv4 addresses allowed for this configuration.

switch(config-dhcp-server)# subnet 192.0.2.0/24
switch(config-dhcp-server-subnet-ipv4)# reservations mac-address 1a1b.1c1d.1e1f ipv4-address 192.0.2.201

Displaying DHCP Information

Show DHCP Server Information

The following command displays the DHCP Server information.

switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 192.0.2.4 192.0.2.5
DNS domain name: podV4.example.com
Lease duration: 1 days 0 hours 0 minutes
TFTP server: 192.0.2.6 (Option 66)
192.0.2.6 192.0.2.7 (Option 150)
TFTP file: https://This email address is being protected from spambots. You need JavaScript enabled to view it.:123/example/one
Active Leases: 1
IPv4 DHCP interface status:
Interface   Status
-------------------------------------------------
Ethernet1   Inactive (Could not determine VRF)
Ethernet2   Inactive (Not in default VRF)
Ethernet3   Inactive (Kernel interface not created yet)
Ethernet4   Inactive (Not up)
Ethernet5   Inactive (No IP address)
Ethernet6   Inactive (No Link Local address)
Ethernet7   Inactive (DHCP relay is configured for this interface)
Ethernet8   Inactive (DHCP relay is always on)
Ethernet9   Active

Vendor information:
Vendor ID: default
Sub-options         Data       
---------------- ----------------
1          192.0.2.0
2          “vendor”

Vendor ID: vendorClassIDA
Sub-options       Data       
---------------- --------------------
254        192.0.2.8, 192.0.2.9

Subnet: 192.0.2.0/24
Subnet name: subnetFooV4
Range: 192.0.2.100 to 192.0.2.199
DNS server(s): 192.0.2.1 192.0.2.10
Lease duration: 3 days 0 hours 0 minutes
Default gateway address: 192.0.2.3
TFTP server:
 subnet-tftp.example.com (Option 66)
 192.0.2.6 192.0.2.7 (Option 150)
 TFTP boot file: subnet-bootfile.conf
 Active leases: 1
 Reservations:
 MAC address: 1a1b.1c1d.1e1f
 IPv4 address: 192.0.2.201
 MAC address: 2a2b.2c2d.2e2f    
 IPv4 address: 192.0.2.150

Displaying Disabled Subnets

When a subnet becomes disabled, the show dhcp server [ipv4|ipv6] output displays the disabled message under Disabled reason(s). None of the disabled subnets have active leases. Currently, the output displays only 2 disabled reasons.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface   Status
-------------------------------------------------
Ethernet1   Active

Subnet: 10.0.0.0/24 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Disabled reason(s):
Overlapping subnets: 10.0.0.0/8 

Subnet: 10.0.0.0/8 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.5.5.5
Default gateway address: 10.0.0.3
Active leases: 0
Disabled reason(s):
Overlapping subnets: 10.0.0.0/24 

For Overlapping ranges:
switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
Interface   Status
-------------------------------------------------
Ethernet1   Active

Subnet: 10.0.0.0/8 (Subnet is disabled)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0
Disabled reason(s):
Overlapping range: 10.0.0.9 to 10.0.0.12 

E.g. Duplicate static IP address reservation:
Subnet: 10.0.0.0/8 (Subnet is disabled)
Subnet name:
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.5.5.5
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f    
IPv4 address: 10.0.0.11

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.11

Disabled reason(s):
Duplicate IPv4 address reservation: 10.0.0.11

For DHCPv6, Direct and Relay indicates that the DHCP Server accepts broadcast and relayed messages.

switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled     
DNS server(s): fe80::6     
DNS domain name: aristanetworks.example.com        
Lease duration: 1 days 3 hours 30 minutes      
Active leases: 0               
IPv6 DHCP interface status:    
Interface    Status         
--------------- ------         
Ethernet1    Active
Ethernet3    Active        

Subnet: fe80::/10      
Subnet name: foo     
Range: fe80::1 to fe80::3
DNS server(s): fe80::4 fe80::5          
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active            
Active leases: 0

For DHCPv6, a subnet may match only one interface and vice versa. Otherwise the subnet is disabled and no lease assigned for that subnet.

interface Ethernet1
no switchport
ipv6 address 2001:db8:0:10::1/64
dhcp server ipv6
interface Ethernet3
no switchport
ipv6 address 2001:db8:0:11::1/64
dhcp server ipv6
dhcp server
subnet 2001:db8::/56

The following enables DHCPv6 on Ethernet1 (with address fc00::1/7 and fe80::1/10), and then configures subnets fc00::/7 and fe80::/64 for DHCPv6.

interface Ethernet1
no switchport
ipv6 address fc00::1/7
ipv6 address fe80::1/64 link-local 
dhcp server ipv6
dhcp server
subnet fc00::/7
subnet fe80::/64

#show dhcp server ipv6
IPv6 DHCP server is active     
DNS server(s):  fc00::2     
DNS domain name: aristanetworks.example.com        
Lease duration: 1 days 3 hours 30 minutes      
Active leases: 0               
IPv6 DHCP interface status:    
Interface    Status         
--------------- ------         
Ethernet1    Active        

Subnet: fc00::/7      
Subnet name: foo               
Range: fc00::1 to fc00::5       
DNS server(s): fc00::6 fc00::8          
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active

Active leases: 0

Subnet: fe80::/64      
Subnet name: subnetBarV6         
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active

Active leases: 0

Leases

The following output displays the IP addresses allocated by the DHCP Server with the show dhcp server [ipv4|ipv6] leases command. It also displays the expected end time for the address, the time when the address is assigned, and the equivalent MAC address.

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b 
End: 2019/06/20 18:06:33 UTC   
Last transaction: 2019/06/20 14:36:33 UTC      
MAC address: 165a.a86d.ffac

DHCP Relay Global Configuration Mode

Configure DHCP Relay using the dhcp relay command in the global configuration mode. The command places the switch in DHCP Relay mode and allows the configuration of DHCP Relay on several interfaces with a single command. The configuration entered in the DHCP Relay global configuration mode can be overridden by equivalent interface specific commands.

Examples

The dhcp relay command places the switch in the DHCP Relay configuration mode.

switch(config)# dhcp relay
switch(config-dhcp-relay)#

Specify the IP address of the default DHCP or DHCPv6 Server. Multiple IP addresses can be specified and DHCP requests forward to all specified helper addresses. Configure an ip helper-address IP_Address under each desired routing interface.

Use the following commands to forward DHCP broadcast packets received on interface Ethernet1 and Vlan2 to DHCP servers at 10.0.0.1, 10.0.0.2, and to hostname DefaultDHCPHostname:

switch(config)# interface ethernet1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/16
 
switch(config)# interface vlan2
switch(config-if-Et1)# ip address 172.16.1.1/16
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server 10.0.0.1
switch(config-dhcp-relay)# server 10.0.0.2
switch(config-dhcp-relay)# server DefaultDHCPHostname

Use the following commands to forward DHCPv6 broadcast packets received on interface ethernet1 to a DHCPv6 Server at fc00::3.

switch(config)# interface ethernet1                     
switch(config-if-Et1)# no switchport                        
switch(config-if-Et1)# ipv6 address fc00::1/10 
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server fc00::3

The configuration points a routed interface to the specified DHCP and DHCPv6 server, if the configuration meets following criteria:

The default VRF contains the routed interface.
The interface has an IP address configured.
The configuration does not occur on a Management or a Loopback interface.

Use the following commands to remove the default DHCP or DHCPv6 Server.

switch(config)# dhcp relay
switch(config-dhcp-relay)# no server 10.0.0.1
switch(config-dhcp-relay)# no server 10.0.0.2
switch(config-dhcp-relay)# no server DefaultDHCPHostname
switch(config-dhcp-relay)# no server fc00::3

To override the default DHCP Server on an interface, the parameter,ip helper-addressIP_Address, must be used.

Use the following commands to forward a DHCP broadcast packet received on interface Ethernet1 to DHCP Servers at 10.0.0.1, 10.0.0.2 and hostname DefaultDHCPHostname, but VLAN2 broadcasts packets to the DHCP Server at 10.0.0.3 only.

switch(config)# interface ethernet 1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/16
 
switch(config)# interface vlan2
switch(config-if-Et1)# ip address 172.16.1.1/16
switch(config-if-Et1)# ip helper-address 10.0.0.3
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server 10.0.0.1
switch(config-dhcp-relay)# server 10.0.0.2
switch(config-dhcp-relay)# server DefaultDHCPHostname

To override the default DHCPv6 Server on an interface, the parameter, ipv6 helper-address IPv6_Address> must be used.

Use the following commands to forward a DHCPv6 broadcast packet received on interface Ethernet1 to DHCPv6 Server at fc00::3, and VLAN2 broadcasts packets to DHCPv6 Server at fc00::4 only.

switch(config)# interface ethernet 1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ipv6 address fc00::1/10
 
switch(config)# interface vlan2
switch(config-if-Et1)# ipv6 address fc00::2/10
switch(config-if-Et1)# ipv6 helper-address fc00::4
 
switch(config)# dhcp relay
switch(config-dhcp-relay)# server fc00::3

You can disable DHCP or DHCPv6 Relay functionality from a specific interface. This disables both DHCP Relay global and interface mode configurations.

Use the following command to disable DHCP Relay functionality only.

switch(config)# interface vlan3
switch(config-if-Et1)# dhcp relay ipv4 disabled

Use the following to disable DHCPv6 Relay functionality only.

switch(config)# interface Vvlan3
switch(config-if-Et1)# dhcp relay ipv6 disabled

Displaying DHCP Relay

The show ip dhcp relay command displays all the interfaces enabled with DHCP Relay and the server configured on these interfaces.

Example

switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCPv6 Relay Link-layer Address Option (79) is disabled
DHCPv6 Relay Remote ID (Option 37) encoding format: MAC address:interface ID
DHCP Smart Relay is disabled
Default L3 interface DHCP servers:   
  DHCPv4 servers: 10.0.0.1
                  10.0.0.2
                  DefaultDHCPHostname 
  DHCPv6 servers: fc00::3
Interface: Ethernet1
  DHCP Smart Relay is disabled
  DHCPv6 all subnet relaying is disabled 
  Using default DHCPv4 servers        
  Using default DHCPv6 servers
Interface: Ethernet2                  
  DHCP Smart Relay is disabled         
  DHCPv6 all subnet relaying is disabled
  Using default DHCPv4 servers        
  DHCPv6 servers: fc00::4
Interface: Vlan2                   
  DHCP Smart Relay is disabled         
  DHCPv6 all subnet relaying is disabled
  DHCPv4 servers: 11.0.0.3       
  DHCPv6 servers: fc00::4 
Interface: Vlan3           
  DHCP Smart Relay is disabled         
  DHCPv6 all subnet relaying is disabled
  DHCPv4 Relay is disabled            
  DHCPv6 Relay is disabled

DHCP Relay Across VRF

The EOS DHCP relay agent supports forwarding of DHCP requests to DHCP servers located in a different VRF to the DHCP client interface VRF. In order to enable VRF support for the DHCP relay agent, Option 82 (DHCP Relay Agent Information Option) must first be enabled. The DHCP relay agent uses Option 82 to pass client specific information to the DHCP server.

These sections describe DHCP Relay across VRF features:

Configuring DHCP Relay
DHCP Relay Global Configuration Mode Show Command

The DHCP relay agent inserts Option 82 information into the DHCP forwarded request, which requires the DHCP server belongs to a network on an interface, and that interface belongs to a different VRF than the DHCP client interface. Option 82 information includes the following:

VPN identifier - The VRF name for the ingress interface of the DHCP request, inserted as sub-option 151.

Table 1. VPN Identifier

SubOpt Len ASCII VRF Identifier

151 7 V R F N A M E
Link selection - The subnet address of the interface that receives the DHCP request, inserted as sub-option 5. After enabling the DHCP smart relay, the link selection fills with the subnet of the active address. The relay agent sets the Gateway IP address (gIPaddr) to its IP address so that DHCP messages can be routed over the network to the DHCP server.
Table 2. Link Selection

SubOpt Len Subnet IP Address

5 4 A1 A2 A3 A4
Server identifier override - The primary IP address of the interface that receives the DHCP request, inserted as sub-option 11. After enabling the DHCP smart relay, the server identifier fills with the active address, one of the primary or secondary addresses chosen by smart relay mechanism.
Table 3. Link Selection

SubOpt Len Overriding Server Identifier Address

11 4 B1 B2 B3 B4
VSS control suboption as suboption 152 - The DHCP server strips out this suboption when sending the response to the relay, indicating that the DHCP server used VPN information to allocate IP address.
Circuit ID - Identifies the circuit, interface or VLAN, on the switch that received the request.
Remote ID - Identifies the remote host.

Table 1. VPN Identifier
SubOpt	Len	ASCII VRF Identifier
151	7	V	R	F	N	A	M	E

Table 2. Link Selection
SubOpt	Len	Subnet IP Address
5	4	A1	A2	A3	A4

Table 3. Link Selection
SubOpt	Len	Overriding Server Identifier Address
11	4	B1	B2	B3	B4

Note: The DHCP server must be capable of handling VPN identifier information in Option 82.

Direct communication between DHCP client and server may not be possible if they reside in separate VRFs. The Server identifier override and Link Selection sub-options set the relay agent to act as the DHCP server, and enable all DHCP communication to flow through the relay agent.

The relay agent adds all the appropriate sub-options, and forwards all request packets, including renew and release,to the DHCP server. When the relay receives the DHCP server response messages, EOS removes Option 82 information and forwards the response to the DHCP client in the client VRF.

Configuring DHCP Relay

The DHCP relay agent information option is inserted in DHCP messages relayed to the DHCP server. The ip helper-address command enables DHCP relay on an interface and relays DHCP messages to the specified IPv4 address.

Example

This command enables DHCP relay on the interface ethernet 1/2; and relays DHCP messages to the server at 1.1.1.1.

switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# ip helper-address 1.1.1.1
switch(config-if-Et1/2)#

The commands provided in the following examples enable the attachment of VRF-related tags in the relay agent information option. If both the DHCP client interface and server interface exist on the same VRF, default or non-default, then EOS does not insert the VRF-related DHCP relay agent information option.

Examples

This command configures the DHCP relay to add option 82 information.
```
switch(config)# ip dhcp relay information option
```

These commands configures two new VRF instances and assign them Route Distinguishers (RDs).

switch(config)# vrf instance mtxxg-vrf
switch(config-vrf-mtxxg-vrf)# router bgp 50
switch(config-router-bgp)# vrf mtxxg-vrf
switch(config-router-bgp-vrf-mtxxg-vrf)# rd 5546:5546
switch(config)# vrf instance qchyh-vrf
switch(config-vrf-qchyh-vrf)# router bgp 50
switch(config-router-bgp)# vrf qchyh-vrf
switch(config-router-bgp-vrf-qchyh-vrf)# rd 218:218

This command configures an interface connected to DHCP client in vrf mtxxg-vrf and assigns an IP address.
```
switch(config)# interface ethernet 9
switch(config-if-Et9)# no switchport
```

This command configures the DHCP client interface in VRF mtxxg-vrf.

switch(config-if-Et9)# vrf mtxxg-vrf
switch(config-if-Et9)# ip address 10.10.0.1/16

This command configures the server interface in VRF qchyh-vrf.

switch(config-if-Et11)# vrf qchyh-vrf
switch(config-if-Et11)# ip address 10.40.0.1/16

This command configures a helper address for a DHCP server in VRF qchyh-vrf.
```
switch(config-if-Et11)# ip helper-address 10.40.2.3 vrf qchyh-vrf
```

Configuring Option 82

Use the following commands to enter Information Option (Option 82) insertion and configure the format of information options:

switch(config)#dhcp relay
switch(config-dhcp-relay)#information option
switch(config-information-option)#

To specify the format for the circuit-id encoding, use the following command:

switch(config-information-option)#circuit-id encoding (%x | %p)

The default format uses string denoted by %p. Setting the encoding to %x enables hex encoding for the circuit ID. The configured value must be a valid hex number. If not configured, DHCP Relay uses the default format.

To specify the format for the remote-id encoding, use the following command:

switch(config-information-option)#remote-id encoding (%x | %p)

The default format uses string denoted by %p. Setting the encoding to %x enables hex encoding for the remote ID. The configured value must be a valid hex number. If not configured, DHCP Relay uses the default format.

DHCP Relay Global Configuration Mode Show Command

Example

This command displays the VRF specifier for the server:

switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is enabled
DHCP Smart Relay is disabled
Interface: Ethernet9
Option 82 Circuit ID: Ethernet9
DHCP Smart Relay is disabled
DHCP servers: 10.40.2.3
10.40.2.3:vrf=qchyh-vrf

DHCP Relay in VXLAN EVPN

The ip dhcp relay information option (Global) command enables the configuration of the DHCP server to uniquely identify the origin of the request using a source-interface and the helper address. Configure the source interface with a routable address used by the DHCP server to uniquely identify the DHCP relay agent that forwarded the client request.

Configuring DHCP Relay in VXLAN EVPN (IPv4)

Use the following command to enable the DHCP relay information option (Option 82) required to specify a source interface.

switch(config)# ip dhcp relay information option

The following configures a Loopback interface as the source interface.

switch(config)# interface Loopback1
switch(config-if-Lo1)# ip address 1.1.1.1/24

Use the following commands to configure the Loopback interface as the specified source interface for the helper address.

switch(config)# interface vlan100
switch(config-if-Vl100)# ip helper-address 10.1.1.4 source-interface Loopback1

Use the following commands to configure the Loopback interface when the DHCP server resides in a different VRF (red). The source interface must be configured in the DHCP server VRF for the command to take effect.

switch(config)# interface Loopback3
switch(config-if-Lo3)# vrf red
switch(config-if-Lo3)# ip address 1.1.1.1/24

switch(config)# interface vlan100
switch(config-if-Vl100)# ip helper-address 10.1.1.4 vrf red source-interface Loopback3

The following command disables the use of source interface along with the helper address.

switch(config)# interface vlan100
switch(config-if-Vl100)# no ip helper-address 10.1.1.4 source-interface Loopback1

Configuring DHCP Relay in VXLAN EVPN (IPv6)

Use the following commands to configure a local interface.

switch(config)# interface Loopback2
switch(config-if-Vl100)# ipv6 address 2001::10:20:30:1/128

Use the following commands to configure the Loopback interface as the local interface for the helper address.

switch(config)# interface vlan200
switch(config-if-Vl200)# ipv6 dhcp relay destination 2002::10:20:30:2 local-interface Loopback2

Use the following commands to configure the Loopback interface when the DHCP server is in a different VRF (red). The local interface must be configured in the DHCP server's VRF for the command to take effect.

switch(config)# interface Loopback4
switch(config-if-Lo4)# vrf red
switch(config-if-Lo4)# ipv6 address 2001::10:20:30:1/128

switch(config)# interface vlan200
switch(config-if-Vl200)# ipv6 dhcp relay destination 2002::10:20:30:2 vrf red local-interface Loopback4

Use the following command to disable the use of local interface along with the helper address.

switch(config-if-Vl200)# no ipv6 dhcp relay destination 2002::10:20:30:2 local-interface Loopback4

The following command displays the status of DHCP relay option (Option 82) and lists the configured DHCP servers.

switch# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is enabled
DHCP Smart Relay is disabled
Interface: Vlan100
  Option 82 Circuit ID: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 10.1.1.4
Interface: Vlan200
  Option 82 Circuit ID: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 2002::10:20:30:2

DHCP Snooping with Bridging

In this configuration, in addition to sending DHCP packets to relay after adding information option, the packets also be bridge within the VLAN. In the bridging mode, the switch intercepts DHCP packets, inserts option-82 if not already present, and bridges the packet within the VLAN. This mode of DHCP snooping can be configured without DHCP relay configuration.

Configuring DHCP Snooping with Bridging

Following are the steps to configure DHCP snooping with bridging:

Enable DHCP snooping feature using the ip dhcp snooping command.
```
switch# ip dhcp snooping
```
Enable the insertion of option-82 in DHCP request packets using the ip dhcp snooping information option command. By default, option-82 is disabled and must be enabled for DHCP Snooping to be functional.
```
switch# ip dhcp snooping information option
```
Enable DHCP snooping on the corresponding VLANs using the ip dhcp snooping vlan command. By default,EOS disables DHCP snooping on any VLAN.
```
switch# ip dhcp snooping vlan
```
Set the circuit-id information sent in option-82. By default, EOS sends the Interface name and VLAN ID. Remote circuit-id contains the MAC address of the relay agent.
```
switch# ip dhcp snooping information option circuit-id type 2 format
%h:%p  Hostname and interface name
%p:%v  Interface name and VLAN ID
```
Enable bridging capabilities of DHCP snooping using the ip dhcp snooping bridging command. This command enables DHCP snooping with or without DHCP relay configuration.
```
switch# ip dhcp snooping bridging
```

DHCP Snooping with Bridging Show Commands

The show ip dhcp snooping displays the DHCP snooping with bridging information.

switch# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
 650
DHCP Snooping bridging is operational on following VLANs:
 650
Insertion of Option-82 is enabled
 Circuit-id sub-option Type: 0
 Circuit-id format: Interface name:Vlan ID
 Remote-id: 00:1c:73:8d:eb:67 (Switch MAC)

Troubleshooting

Configure all the needed commands so that DHCP snooping is enabled and operational on all the VLANs.
show ip dhcp snooping displays whether the DHCP snooping is operational or not.
show ip dhcp snooping counters displays if snooped packets are getting dropped or not.

show ip dhcp snooping counters debug displays the reason for packets getting dropped.


switch# show ip dhcp snooping counters debug
Counter                           Requests          Responses
----------------------------- ----------------- -----------------
Received                                      3                 2
Forwarded                                     3                 2
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Info Option                 0                 0
Dropped - Snooping disabled                   0                 0

Check if the packets are hitting the TCAM rule.

switch# show platform trident tcam detail | grep -i dhcp
DHCP Snooping uses 3 entries.
…
655402               45 hits - DHCP client to relay trap-to-cpu

TCP MSS Clamping

TCP MSS clamping limits the value of the Maximum Segment Size (MSS) in the TCP header of TCP SYN packets transiting a specified Ethernet or tunnel interface. Setting the MSS ceiling can avoid IP fragmentation in tunnel scenarios by ensuring that the MSS is low enough to account for the extra overhead of GRE and tunnel outer IP headers. TCP MSS clamping can be used when connecting via GRE to cloud providers that require asymmetric routing.

When MSS clamping is configured on an interface, if the TCP MSS value in a SYN packet transiting that interface exceeds the configured ceiling limit it will be overwritten with the configured limit and the TCP checksum will be recomputed and updated.

TCP MSS clamping is handled by default in the software data path, but the process can be supported through hardware configuration to minimize possible packet loss and a reduction in the number of TCP sessions which the switch can establish per second.

Cautions

This feature should be used with caution. When the TCP MSS clamping feature is enabled by issuing the tcp mss ceiling command on any routed interface, all routed IPv4 TCP SYN packets (TCP packets with the “SYN” flag set) are sent by default to the CPU and switched through software, even on interfaces where no TCP MSS ceiling has been configured, as long as TCP MSS clamping is enabled. This limits the number of TCP sessions that can be established through the switch per second, and, because throughput for software forwarding is limited, this feature can also cause packet loss if the rate at which TCP SYN packets are sent to the CPU exceeds the limits configured in the control-plane policy map.

Packet loss and TCP session reductions can be minimized by enabling TCP MSS clamping in hardware, but only SYN packets in which MSS is the first TCP option are clamped in the hardware data path; other TCP SYN packets are still switched through software.

To disable MSS clamping, the MSS ceiling must be removed from every interface on which it has been configured by issuing the no tcp mss ceiling command on each configured interface.

Enabling TCP MSS Clamping

There is no global configuration to enable TCP MSS clamping. It is enabled as soon as an MSS ceiling is configured on at least one interface.

Disabling TCP MSS Clamping

To disable TCP MSS clamping, the MSS ceiling configuration must be removed from every interface by using the no or default form of the tcp mss ceiling command on every interface where a ceiling has been configured.

Configuring the TCP MSS Ceiling on an Interface

The TCP MSS ceiling limit is set on an interface using the tcp mss ceiling command. This also enables TCP MSS clamping on the switch as a whole.

Note: Configuring a TCP MSS ceiling on any interface enables TCP MSS clamping on the switch as a whole. Without hardware support, clamping routes all TCP SYN packets through software, even on interfaces where no TCP MSS ceiling has been configured. This significantly limits the number of TCP sessions the switch can establish per second, and can potentially cause packet loss if the CPU traffic exceeds control plane policy limits.

On Sand platform switches (Qumran-MX, Qumran-AX, Jericho, Jericho+), the following limitations apply:

This command works only on egress.
TCP MSS ceiling is supported on IPv4 unicast packets entering the switch; the configuration has no effect on GRE transit packets.
The feature is supported only on IPv4 routed interfaces. It is not supported on L2 (switchport) interfaces or IPv6 routed interfaces.
The feature is not supported for IPv6 packets even if they are going to be tunneled over an IPv4 GRE tunnel.
The feature is not supported on VXLAN, loopback or management interfaces.
The feature is only supported on IPv4 unicast packets entering the switch. The configuration has no effect on GRE transit packets or GRE decap, even if the egress interface has a TCP MSS ceiling configured.

Example

These commands configure interface ethernet 5 as a routed port, then specify a maximum MSS ceiling value of 1458 bytes for TCP SYN packets exiting that port.

switch(config)# interface ethernet 5
switch(config-if-Et5)# no switchport
switch(config-if-Et5)# tcp mss ceiling ipv4 1458 egress
switch(config-if-Et5)#

These commands apply TCP MSS clamping at 1436 bytes in the egress direction for IPv6 packets:
```
switch(config)# interface ethernet 26
switch(config)# tcp mss ceiling ipv6 1436 egress
```
These commands apply TCP MSS clamping at 1476 bytes for IPv4 packets and 1436 bytes for IPv6 packets in egress direction:
```
switch(config)# interface ethernet 27
switch(config)# tcp mss ceiling ipv4 1476 ipv6 1436 egress
```

Verifying the TCP MSS Clamping

If TCP MSS ceiling is configured on an interface and if the command show cpu counters queue | nz is incrementing in CoppSystemL3Ttl1IpOptUcast field for Tcp packet with Syn flag, then TCP MSS clamping is being performed in Software.

switch# show cpu counters queue | nz
Fap0.1:
CoPP Class                     Queue    Pkts   Octets   DropPkts   DropOctets
Aggregate
------------------------------------------------------------------------------
CoppSystemL3Ttl1IpOptUcast     TC0      1       82       0          0

Configuring TCP MSS Clamping

Interface Configuration

You can specify the TCP MSS value under the interface configuration mode. The command syntax is shown below:

tcp mss ceiling [ipv4 | ipv6] 64-65515 egress

The keyword egress specifies that the MSS clamping is applied on packets transmitted out on the interface in egress direction.

The following example applies TCP MSS clamping at 1436 bytes in the egress direction for IPv4 packets:

switch(config)# interface ethernet 25
switch(config)#tcp mss ceiling ipv4 1436 egress

the following example applies TCP MSS clamping at 1436 bytes in the egress direction for IPv6 packets:

switch(config)# interface ethernet 26
switch(config)# tcp mss ceiling ipv6 1436 egress

The following example applies TCP MSS clamping at 1476 bytes for IPv4 packets and 1436 bytes for IPv6 packets in egress direction:

switch(config)# interface ethernet 27
switch(config)# tcp mss ceiling ipv4 1476 ipv6 1436 egress

Hardware TCP MSS Clamping Configuration

Hardware MSS clamping requires the system TCAM profile to have TCP MSS clamping enabled. You can achieve this by creating a user defined TCAM profile as described below. The User Defined PMF Profiles - TOI provides general guidelines on how to create and configure TCAM profiles.

The system TCAM profile must have the feature tcp-mss-ceiling ip in it in order to use hardware MSS clamping. This is applicable regardless of whether the TCAM profile is copied from an existing profile or created from scratch.

Step 1: Create the user defined TCAM profile

The following example demonstrates copying any source profile and adding the feature tcp-mss-ceiling ip. In this example, the profile name is Pro1 and the source profile name is Source1.

(config)# hardware tcam
(config-hw-tcam)# profile Pro1 copy Source1
(config-hw-tcam-profile-Pro1)# feature tcp-mss-ceiling ip copy system-feature-source-profile

TCP MSS clamping is supported only for IPv4 routed packets. Set the packet type for the feature as follows. This is optional when using copy system-feature-source-profile. In this example, the system profile name is Pro1 and the feature name is Source1.

(config-hw-tcam-profile-Pro1-feature-Source1)# packet ipv4 forwarding routed

Set the key size limit to 160. This is also optional when the feature is copied from system-feature-source-profile. In this example, the system profile name is Pro1 and the feature name is Source1.

(config-hw-tcam-profile-Pro1-feature-Source1)# key size limit 160

Removing unused features to ensure that the TCP MSS TCAM DB is allocated. In this example, the system profile name is Pro1 and the feature name is Source1.

(config-hw-tcam-profile-Pro1-feature-Source1)# exit
(config-hw-tcam-profile-Pro1)# no feature mirror ip
(config-hw-tcam-profile-Pro1)# no feature acl port mac

Step 2: Apply the user defined TCAM profile to the system.

The following example sets the profile as the system profile under the hardware tcam mode. In this example, the system profile name is red.

(config-hw-tcam)# system profile red

When the system TCAM profile is changed, it is expected that some agents will restart. Also it might be necessary to remove some unused features from the TCAM profile to ensure that the TCP MSS feature gets allocated a TCAM DB. For more information about configuring TCAM profiles, refer to User Defined PMF Profiles.

Note: The hardware clamping only works for TCP packets with MSS as the first TCP option. Packets where MSS is not the first TCP option are still trapped to CPU for clamping in software even if the feature tcp-mss-ceiling is configured in the system TCAM profile.

Backward Compatibility

The tunnel mss ceiling command which provides the same functionality is deprecated with the introduction of tcp mss ceiling command. The configuration option tunnel mss ceiling was available only on GRE tunnel interfaces, while tcp mss ceiling is supported on other routed IPv4 interfaces as well.

TCP MSS Clamping Limitations

The TCP-MSS Clamping is not supported on L2 (switchport ) interfaces.
The TCP-MSS Clamping is NOT supported on VXLAN, Loopback and Management interfaces.
The TCP-MSS Clamping is supported only in the Egress direction.
The TCP-MSS Clamping is only supported on unicast routed packets entering the switch. The configuration has no effect on GRE transit packets and GRE decap case, even if the Egress interface has TCP MSS ceiling configured.

Software TCP MSS Clamping Limitations

Once the TCP-MSS Clamping is enabled, all routed TCP-SYN packets will be software switched, even on interfaces where there is no TCP-MSS ceiling configuration.
TCP SYN packets could get dropped under high CPU usage conditions or due to DOS attack protection mechanisms such as PDP/CoPP. These factors could limit the TCP connection establishment rate, i.e new TCP sessions established per second through the switch.

Hardware MSS Clamping Limitations

Hardware TCP-MSS clamping is not supported with host routes when the clamping is applied on a non-tunnel interface. This limitation does not apply to GRE tunnel interfaces.
TCP SYN packets where TCP-MSS is not the first TCP option are trapped to CPU for MSS adjustment even in hardware MSS clamping mode.
Hardware TCP-MSS clamping is not supported for IPv6 packets.

Configuring Hardware Support for TCP MSS Clamping

TCP MSS clamping can be supported in hardware, but some packets are still routed through the software data path, and an MSS ceiling value must be configured on each interface where clamping is to be applied.

Hardware support for clamping is accomplished through the use of a user-defined TCAM profile. The TCAM profile can be created from scratch or copied from an existing profile, but in either case it must include the tcp-mss-ceiling ip feature.

Guidelines

When the system TCAM profile is changed, some agents will restart.
To ensure that the TCP MSS feature is allocated a TCAM DB, it may be necessary to remove some unused features from the TCAM profile.
Hardware TCP MSS clamping only works for TCP packets with MSS as the first TCP option. Other TCP SYN packets are still trapped to the CPU for clamping in software.
Hardware TCP MSS clamping is not supported with host routes when the clamping is applied on a non-tunnel interface. This limitation does not apply to GRE tunnel interfaces.
The maximum MSS ceiling limit with hardware MSS clamping is 32727 even though the CLI allows configuration of much larger values.
For more information on the creation of user-defined TCAM profiles, see https://www.arista.com/en/support/toi/eos-4-20-5f/13977-user-defined-pmf-profile.

To configure hardware support for TCP MSS clamping, create a TCAM profile that includes the tcp mss ceiling feature, then apply it to the system.

Creating the TCAM Profile

A TCAM profile that supports TCP MSS clamping can be created from scratch, or the feature can be added to a copy of the default TCAM profile. When creating a profile from scratch, care must be taken to ensure that all needed TCAM features are included in the profile.

Modifying a Copy of the Default TCAM Profile

The following commands create a copy of the default TCAM profile, name it tcp-mss-clamping, and configure it to enable MSS clamping in hardware, then remove some unused features included in the default profile to ensure that there are sufficient TCAM resources for the clamping feature.

switch(config)# hardware tcam
switch(config-hw-tcam)# profile tcp-mss-clamping copy default
switch(config-hw-tcam-profile-tcp-mss-clampingl)# feature tcp-mss-ceiling ip copy system-feature-source-profile
switch(config-hw-tcam-profile-tcp-mss-clamping-feature-tcp-mss-ceiling)# key size limit 160
switch(config-hw-tcam-profile-tcp-mss-clamping-feature-tcp-mss-ceiling)# packet ipv4 forwarding routed
switch(config-hw-tcam-profile-tcp-mss-clamping-feature-tcp-mss-ceiling)# exit

switch(config-hw-tcam-profile-tcp-mss-clamping)# no feature mirror ip
switch(config-hw-tcam-profile-tcp-mss-clamping)# no feature acl port mac
switch(config-hw-tcam-profile-tcp-mss-clampingl)# exit

switch(config-hw-tcam)# exit

switch(config)#

Applying the TCAM Profile to the System

The following commands enter Hardware TCAM Configuration Mode and set the tcp-mss-clamping profile as the system profile.

switch(config)# hardware tcam
switch(config-hw-tcam)# system profile tcp-mss-clamping
switch(config-hw-tcam)#

Verifying the TCAM Profile Configuration

The following command displays hardware TCAM profile information to verify that the user-defined TCAM profile has been applied correctly.

switch(config)# show hardware tcam profile

Configuration        Status                  
FixedSystem          tcp-mss-clamping         tcp-mss-clamping 

switch(config)#

IPv4 GRE Tunneling

GRE tunneling supports the forwarding over IPv4 GRE tunnel interfaces. The GRE tunnel interfaces act as a logical interface that performs GRE encapsulation or decapsulation.

Note: The forwarding over GRE tunnel interface on DCS-7500R is supported only if all the line cards on the system have Jericho family chip-set.

Configuring GRE Tunneling Interface

On a Local Arista Switch

switch(config)# ip routing
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel mode gre
switch(config-if-Tu10)# ip address 192.168.1.1/24
switch(config-if-Tu10)# tunnel source 10.1.1.1
switch(config-if-Tu10)# tunnel destination 10.1.1.2
switch(config-if-Tu10)# tunnel path-mtu-discovery
switch(config-if-Tu10)# tunnel tos 10
switch(config-if-Tu10)# tunnel ttl 10

On a Remote Arista Switch

switch(config)# ip routing
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel mode gre
switch(config-if-Tu10)# ip address 192.168.1.2/24
switch(config-if-Tu10)# tunnel source 10.1.1.2
switch(config-if-Tu10)# tunnel destination 10.1.1.1
switch(config-if-Tu10)# tunnel path-mtu-discovery
switch(config-if-Tu10)# tunnel tos 10
switch(config-if-Tu10)# tunnel ttl 10

Alternative Configuration for Tunnel Source IPv4 Address

switch(config)# interface Loopback 10
switch(config-if-Lo10)# ip add 10.1.1.1/32
switch(config-if-Lo10)# exit

switch(config)# conf terminal
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel source interface Loopback 10

Configuration for Adding an IPv4 Route over the GRE Tunnel Interface

switch(config)# ip route 192.168.100.0/24 Tunnel 10

Tunnel Mode

Tunnel Mode needs to be configured as gre, for GRE tunnel interface. Default value is tunnel mode gre.

IP Address

Configures the IP address for the GRE tunnel interface. The IP address can be used for routing over the GRE tunnel interface. The configured subnet is reachable over the GRE tunnel interface and the packets to the subnet are encapsulated in the GRE header.

Tunnel Source

Specifies the source IP address for the outer IPv4 encapsulation header for packets going over the GRE tunnel interface. The tunnel source IPv4 address should be a valid local IPv4 address configured on the Arista Switch. The tunnel source can also be specified as any routed interface on the Arista Switch. The routed interface’s IPv4 address is assigned as the tunnel source IPv4 address.

Tunnel Destination

Specifies the destination IPv4 address for the outer IPv4 encapsulation header for packets going over the GRE tunnel interface. The tunnel destination IPv4 should be reachable from the Arista Switch.

Tunnel Path Mtu Discovery

Specifies if the “Do not Fragment” flag needs to set in the outer IPv4 encapsulation header for packets going over the GRE tunnel interface.

Tunnel TOS

Specifies the Tunnel Type of Service (ToS) value to be assigned to the outer IPv4 encapsulation header for packets going over the GRE tunnel interface. Default TOS value of 0 will be assigned if tunnel TOS is not configured.

Tunnel TTL

Specifies the TTL value to the assigned to the outer IPv4 encapsulation header for packet going over the GRE tunnel interface. The TTL value is copied from the inner IPv4 header if tunnel TTL is not configured. The tunnel TTL configuration requires the tunnel Path MTU Discovery to be configured.

Displaying GRE tunnel Information

The following commands display the tunnel configuration.

switch# show interfaces Tunnel 10
Tunnel10 is up, line protocol is up (connected)
 Hardware is Tunnel, address is 0a01.0101.0800
 Internet address is 192.168.1.1/24
 Broadcast address is 255.255.255.255
 Tunnel source 10.1.1.1, destination 10.1.1.2
 Tunnel protocol/transport GRE/IP
   Key disabled, sequencing disabled
   Checksumming of packets disabled
 Tunnel TTL 10, Hardware forwarding enabled
 Tunnel TOS 10
 Path MTU Discovery
 Tunnel transport MTU 1476 bytes
 Up 3 seconds

switch# show gre tunnel static

Name     Index  Source   Destination  Nexthop  Interface
-------- ------ -------- ------------ -------- -----------
Tunnel10 10     10.1.1.1 10.1.1.2     10.6.1.2 Ethernet6/1

switch# show tunnel fib static interface gre 10
Type 'Static Interface', index 10, forwarding Primary
   via 10.6.1.2, 'Ethernet6/1'
      GRE, destination 10.1.1.2, source 10.1.1.1, ttl 10, tos 0xa

Use the show platform fap tcam summary command to verify if the TCAM bank is allocated for GRE packet termination lookup.

switch# show platform fap tcam summary

           Tcam Allocation (Jericho0)
Bank        Used By     Reserved By
---------- ------------ -----------
0          dbGreTunnel   -

Use the show ip route command to verify if the routes over tunnel is setup properly.

switch# show ip route
 
VRF: default
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route

Gateway of last resort is not set

 C      192.168.1.0/24 is directly connected, Tunnel10, Static Interface GRE tunnel 
index 10, dst 10.1.1.2, src 10.1.1.1, TTL 10, TOS 10
 S      192.168.100.0/24 is directly connected, Tunnel10, Static Interface GRE 
tunnel index 10, dst 10.1.1.2, src 10.1.1.1, TTL 10, TOS 10

The following commands are used to verify the tunnel encapsulation programming.

switch# show platform fap eedb ip-tunnel gre interface Tunnel 10
 
-------------------------------------------------------------------------------
|                                                  Jericho0                   |
|                                 GRE Tunnel Egress Encapsulation DB                               
|
|-----------------------------------------------------------------------------|
| Bank/ | OutLIF | Next   | VSI  | Encap | TOS  | TTL | Source | Destination| 
OamLIF| OutLIF | Drop|
| Offset|        | OutLIF | LSB  | Mode  |      |     | IP     | IP         | Set  
| Profile|     |
|-----------------------------------------------------------------------------|
| 3/0   | 0x6000 | 0x4010 | 0    | 2     | 10   | 10  | 10.1.1.1 | 10.1.1.2 | No    
| 0      | No |

switch# show platform fap eedb ip-tunnel
 
-------------------------------------------------------------------------------
|                                                  Jericho0                    |
|                                     IP Tunnel Egress Encapsulation DB                         
|
|-----------------------------------------------------------------------------|
| Bank/ | OutLIF | Next   | VSI | Encap| TOS | TTL | Src | Destination | OamLIF 
| OutLIF  | Drop|
| Offset|        | OutLIF | LSB | Mode | Idx | Idx | Idx | IP          | Set    | 
Profile |     |
|-----------------------------------------------------------------------------|
| 3/0   | 0x6000 | 0x4010 | 0   | 2    | 9   | 0   | 0   | 10.1.1.2    | No     | 
0       | No |

GRE Tunneling Support

GRE tunneling supports the forwarding over IPv4 GRE tunnel interfaces. The GRE tunnel interfaces act as a logical interface that performs GRE encapsulation or decapsulation. A maximum of 256 GRE-tunnel interfaces are supported.

Note: GRE keepalives are not supported.

To configure a local Arista switch on a GRE-tunnel interface, consider the following an example.

switch(config)# ip routing
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel mode gre
switch(config-if-Tu10)# ip address 192.168.1.1/24
switch(config-if-Tu10)# tunnel source 10.1.1.1
switch(config-if-Tu10)# tunnel destination 10.1.1.2
switch(config-if-Tu10)# tunnel path-mtu-discovery
switch(config-if-Tu10)# tunnel tos 10
switch(config-if-Tu10)# tunnel ttl 10

To configure a remote Arista switch on a GRE-tunnel interface, consider the following an example.

switch(config)# ip routing
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel mode gre
switch(config-if-Tu10)# ip address 192.168.1.2/24
switch(config-if-Tu10)# tunnel source 10.1.1.2
switch(config-if-Tu10)# tunnel destination 10.1.1.1underlayVrf
switch(config-if-Tu10)# tunnel path-mtu-discovery
switch(config-if-Tu10)# tunnel tos 10
switch(config-if-Tu10)# tunnel ttl 10

To add a IPv4 route over the GRE-tunnel interface, configure simulare to the following.

switch(config)# ip route 192.168.100.0/24 Tunnel 10

Note: IPv6 GRE-Tunnels are not supported. This is only a data-plane limitation whereas IS-IS IPv6 (such as control-plane) can still work.

Use the show interfaces Tunnel command to display the interface tunnel.

switch(config)# show interfaces Tunnel 10
Tunnel10 is up, line protocol is up (connected)
  Hardware is Tunnel, address is 0a01.0101.0800
  Internet address is 192.168.1.1/24
  Broadcast address is 255.255.255.255
  Tunnel source 10.1.1.1, destination 10.1.1.2
  Tunnel protocol/transport GRE/IP
   Key disabled, sequencing disabled
   Checksumming of packets disabled
  Tunnel TTL 10, Hardware forwarding enabled
  Tunnel TOS 10
  Path MTU Discovery
  Tunnel transport MTU 1476 bytes
  Tunnel underlay VRF "underlayVrf"
  Up 3 seconds

Use the show gre tunnel static command to display a static interface tunnel.

switch(config)#show gre tunnel static
Name        Index      Source         Destination       Nexthop     Interface
----------- -------    -----------    -------------     ----------  ----------
Tunnel10    10         10.1.1.1       10.1.1.2          10.6.1.2    Ethernet6/1

Use the show tunnel fib static interface command to display a fib static interface tunnel.

switch(config)# show tunnel fib static interface gre 10
Type 'Static Interface', index 10, forwarding Primary
   via 10.6.1.2, 'Ethernet6/1'
      GRE, destination 10.1.1.2, source 10.1.1.1, ttl 10, tos 0xa

Tunnel Mode

Tunnel mode is GRE for a GRE-tunnel interface which is also the default tunnel mode.

IP address

Use this IP address for routing over the GRE-tunnel interface. The configuration subnet is reachable over the GRE-tunnel interface, and the packets to the subnet is encapsulated with the GRE header.

Tunnel Source

Specifies the source IP address for the encapsulating IPv4 header of a packet going over the GRE-tunnel interface. The tunnel source IPv4 address is a valid local IPv4 address configured on the Arista switch. It uses any route interface on the Arista switch. The routed interfaces IPv4 address assigns the tunnel source IPv4 address. Maximum of 16 unique tunnel source IPv4 addresses are supported across all GRE-tunnel interfaces.

The following is an example of an interface as a Tunnel source.

switch(config)# interface Loopback 10
switch(config-if-Lo10)# ip add 10.1.1.1/32
switch(config-if-Lo10)# exit
switch(config)# interface Tunnel 10
switch(config-if-Tu10)#  tunnel source interface Loopback 10

Note: Coexistence of GRE-tunnel interfaces and Decap-Groups is not supported.

Note: Coexistence of GRE-tunnel interfaces and VXLAN is not supported.

Note: GRE-tunnel is not supported with MLAG configuration.

Tunnel Destination

Specifies the destination IPv4 address for the encapsulating IPv4 header of a packet going over the GRE-tunnel interface. The tunnel destination IPv4 is reachable from the Arista switch.

Note:Multicast traffic over GRE-Tunnels is not supported.

Tunnel Path MTU Discovery

The tunnel path Maximum Transmition Unit (MTU) Discovery specifies if the Don't Fragment (DF) flag needs to be set in the encapsulating IPv4 header of a packet going over the GRE-Tunnel interface. MTU configuration on the GRE-tunnel interface is used by control plane protocols and not enforced in hardware for packets forwarded in data-plane. The MTU change on the tunnel interface does not take effect until the tunnel interface is flapped.

Tunnel TOS

The Tunnel TOS specifies the TOS value to be set in the encapsulating IPv4 header of a packet going over the GRE-Tunnel interface. The default value of 0 is assigned if tunnel TOS is not configured. Maximum of seven unique tunnel TOS values are supported across all GRE-tunnel interfaces.

Tunnel TTL

The Tunnel TTL specifies the TTL value to be set in the encapsulating IPv4 header of a packet going over the GRE-tunnel interface. The TTL value is copied from the inner IPv4 header if tunnel TTL is not configured. The tunnel TTL configuration requires the tunnel path MTU discovery to be configured. Maximum of four unique tunnel TTL values are supported across all GRE-tunnel interfaces.

VRF Forwarding (Overlay VRF)

The following configuration is an example of overlay VRF, for a GRE tunnel interface.

switch(config)# vrf instance overlayVrf
switch(config)# ip routing vrf overlayVrf
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# vrf overlayVrf

Note:Both the tunnels source and destination address must be in the underlay VRF. GRE key forwarding is not supported.

The following is an example of a static route configuration, with an overlay VRF.

switch(config)# ip route vrf overlayVrf 7.7.7.0/24 192.168.1.2

VRF Forwarding (Underlay VRF)

The following is an configuration example of a underlay VRF for a GRE tunnel interface.

switch(config)# vrf instance underlayVrf
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel underlay vrf underlayVrf

TCAM Bank Allocation

Note: Command to check if Ternary Content-Addressable Memory (TCAM) bank is allocated for GRE packet termination lookup.

switch(config)# show platform fap tcam summary

           Tcam Allocation (Jericho0)
Bank       Used By                   Reserved By
---------- ------------------------- -----------
0           dbGreTunnel               -

PBR is not supported on GRE terminated packets.

Verifing Tunnel Routes

Use the show ip route command to check if the routes over tunnel is setup correctly.

switch(config)# show ip route
VRF: default
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route

Gateway of last resort is not set

 C      192.168.1.0/24 is directly connected, Tunnel10, Static Interface GRE-Tunnel index 10, dst 10.1.1.2, src 10.1.1.1, TTL 10, TOS 10
 S      192.168.100.0/24 is directly connected, Tunnel10, Static Interface GRE-Tunnel index 10, dst 10.1.1.2, src 10.1.1.1, TTL 10, TOS 10

Verifing Tunnel Encap

Use the show platform fap eedb ip-tunnel gre interface Tunnel command to check the tunnel encap programming on the GRE interface.

switch(config)# show platform fap eedb ip-tunnel gre interface Tunnel 10
 ------------------------------------------------------------------------------------------------------------------
|                                                  Jericho0                                                        |
|                                 GRE Tunnel Egress Encapsulation DB                                               |
|------------------------------------------------------------------------------------------------------------------|
| Bank/   | OutLIF  | Next    | VSI   | Encap | TOS  | TTL  | Source   | Destination     | OamLIF | OutLIF  | Drop |
| Offset  |         | OutLIF  | LSB   | Mode  |      |      | IP       | IP              | Set    | Profile |      |
|------------------------------------------------------------------------------------------------------------------|
| 3/0     | 0x6000  | 0x4010  | 0     | 2     | 10   | 10   | 10.1.1.1 | 10.1.1.2        | No     | 0       | No   |

Use the show platform fap eedb ip-tunnel command to check the tunnel encap programming on the IP-tunnel interface.

switch(config)# show platform fap eedb ip-tunnel
 -----------------------------------------------------------------------------------------------------------
|                                                  Jericho0                                                 |
|                                     IP Tunnel Egress Encapsulation DB                                     |
|-----------------------------------------------------------------------------------------------------------|
| Bank/   | OutLIF  | Next    | VSI   | Encap | TOS | TTL | Src | Destination     | OamLIF | OutLIF  | Drop |
| Offset  |         | OutLIF  | LSB   | Mode  | Idx | Idx | Idx | IP              | Set    | Profile |      |
|-----------------------------------------------------------------------------------------------------------|
| 3/0     | 0x6000  | 0x4010  | 0     | 2     | 9   | 0   | 0   | 10.1.1.2        | No     | 0       | No   |

Verifing Tunnel VRF

Use the show ip interface tunnel command to check the overlay VRF.

switch(config)# show ip interface tunnel 10
Tunnel10 is up, line protocol is up (connected)
  Internet address is 192.168.1.1/24
  Broadcast address is 255.255.255.255
  IPv6 Interface Forwarding : None
  Proxy-ARP is disabled
  Local Proxy-ARP is disabled
  Gratuitous ARP is ignored
  IP MTU 1476 bytes
  VPN Routing/Forwarding "overlayVrf"

switch(config)# show ip route vrf overlayVrf 

VRF: overlayVrf
Codes: C - connected, S - static, K - kernel, 
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route, L - VRF Leaked

Gateway of last resort is not set

 C        1.1.1.0/24 is directly connected, Ethernet1
 S        7.7.7.0/24 [1/0] via 192.168.1.2, Tunnel10, Static Interface GRE-Tunnel index 10, dst 10.1.1.2, src 10.1.1.1
 C        192.168.1.0/24 is directly connected, Tunnel10, Static Interface GRE-Tunnel index 10, dst 10.1.1.2, src 10.1.1.1

Tunnel underlay VRF Configuration

Use the show interfaces Tunnel command to check the underlay VRF.

switch(config)# show interfaces Tunnel 10
Tunnel10 is up, line protocol is up (connected)
  Hardware is Tunnel, address is 0a01.0101.0800
  Internet address is 192.168.1.1/24
  Broadcast address is 255.255.255.255
  Tunnel source 10.1.1.1, destination 10.1.1.2
  Tunnel protocol/transport GRE/IP
   Key disabled, sequencing disabled
   Checksumming of packets disabled
  Tunnel TTL 10, Hardware forwarding enabled
  Tunnel TOS 10
  Path MTU Discovery
  Tunnel transport MTU 1476 bytes
  Tunnel underlay VRF "underlayVrf"
  Up 3 seconds

Use the show ip route vrf underlayVrf command to check the IP route VFR underlayVRF.

switch(config)# show ip route vrf underlayVrf
VRF: underlayVrf
Codes: C - connected, S - static, K - kernel, 
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route, L - VRF Leaked,

Gateway of last resort is not set

 C        10.1.1.0/24 is directly connected, Ethernet1

BfRuntime to Use Non-default VRFs

Use the following commands to configure the VRF for the BfRuntime connection for the management interface on the switches that support it. The management interface may be configured on a different VRF from the default one.

Configuring BfRuntime to Use Non-default VRFs

The platform barefoot bfrt vrf command configures the forwarding plane agent to restart and listen on the configured VRFs for connections.

switch(config)# platform barefoot bfrt vrf <VRF name>

If no VRF specified, the configuration uses the default VRF for the IP and port for the the BfRuntime server.

The following displays a typical configuration.

switch(config)# vrf instance management
switch(config-vrf-management)# exit
switch(config)# platform barefoot bfrt 0.0.0.0 50052
switch(config)# platform barefoot bfrt vrf <VRF name>
switch(config)# int management1
switch(config-if-Ma1)# vrf management

Displaying BfRuntime Configuration

The show platform barefoot bfrt command displays the existing configuration for the BfRuntime server.

switch# show platform barefoot bfrt
Namespace: management                    
FixedSystem:0.0.0.0:50052

IPv4 Commands

IP Routing and Address Commands

agent SandL3Unicast terminate
clear arp inspection statistics
clear snapshot counters ecmp
compress
ip arp inspection limit
ip arp inspection logging
ip arp inspection trust
ip arp inspection vlan
ip hardware fib ecmp resilience
ip hardware fib optimize
ip hardware fib next-hop resource optimization
ip icmp redirect
ip load-sharing
ip route
ip routing
ip source binding
ip verify
ip verify source
ipv4 routable 240.0.0.0/4
rib fib policy
show dhcp server
show hardware capacity
show ip
show ip arp inspection vlan
show ip arp inspection statistics
show ip hardware fib summary
show ip interface
show ip interface brief
show ip route
show ip route age
show ip route gateway
show ip route host
show ip route match tag
show ip route summary
show ip verify source
show platform arad ip route
show platform arad ip route summary
show rib route ip
show rib route fib policy excluded
show rib route summary
show routing-context vrf
show snapshot counters ecmp history
show vrf
start snapshot counters
tcp mss ceiling

IPv4 DHCP Relay Commands

clear ip dhcp relay counters
dhcp relay
ip dhcp relay all-subnets
ip dhcp relay all-subnets default
ip dhcp relay always-on
ip dhcp relay information option (Global)
ip dhcp relay information option circuit-id
ip helper-address
show ip dhcp relay
show ip dhcp relay counters

DHCP Server Configuration Commands

dhcp server
dhcp server client
dhcp server debug
dhcp server dns
dhcp server lease
dhcp server option
dhcp server private-option
dhcp server subnet
dhcp server subnet client
dhcp server tftp
dhcp server vendor-option
dhcp server vendor-option ipv4 sub-option
show dhcp server
show dhcp server leases

IPv4 DHCP Snooping Commands

clear ip dhcp snooping counters
ip dhcp snooping
ip dhcp snooping bridging
ip dhcp snooping information option
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping counters
show ip dhcp snooping hardware

IPv4 Multicast Counters Commands

clear ip multicast count
ip multicast count

ARP Table Commands

arp
arp aging timeout
arp cache persistent
arp gratuitous accept
arp proxy max-delay
clear arp-cache
clear arp
ip local-proxy-arp
ip proxy-arp
show arp
show ip arp

VRF Commands

cli vrf
description (VRF)
platform barefoot bfrt vrf
show platform barefoot bfrt
show routing-context vrf
show vrf
vrf (Interface mode)
vrf instance

Trident Forwarding Table Commands

platform trident forwarding-table partition
platform trident routing-table partition
show platform trident forwarding-table partition

IPv4 GRE Tunneling Commands

interface tunnel
show interface tunnel
show platform fap eedb ip-tunnel gre interface tunnel
show platform fap tcam summary
show tunnel fib static interface gre
tunnel

agent SandL3Unicast terminate

The agent SandL3Unicast terminate command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.

Command Mode

Global Configuration

Command Syntax

agent SandL3Unicast terminate

Related Commands

ip hardware fib optimize enables IPv4 route scale.
show platform arad ip route shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.
show platform arad ip route summary shows hardware resource usage of IPv4 routes.

Example

This configuration command restarts the platform Layer 3 agent to ensure IPv4 routes are optimized.

switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated

Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, which are re-added to the hardware.

arp

The arp command adds a static entry to an Address Resolution Protocol (ARP) cache. The switch uses ARP cache entries to correlate 32-bit IP addresses to 48-bit hardware addresses.

The no arp and default arp commands remove the ARP cache entry with the specified IP address. When multiple VRFs contain ARP cache entries for identical IP addresses, each entry can only be removed individually.

Command Mode

Global Configuration

Command Syntax

arp [VRF_INSTANCE] ipv4_addr mac_addr arpa

no arp [VRF_INSTANCE] ipv4_addr

default arp [VRF_INSTANCE] ipv4_addr

Parameters

VRF_INSTANCE Specifies the VRF instance being modified.
- no parameter Changes are made to the default VRF.
- vrf vrf_name Changes are made to the specified user-defined VRF.
ipv4_addr IPv4 address of ARP entry.
mac_addr Local data-link (hardware) address (48-bit dotted hex notation – H.H.H).

Examples

This command adds a static entry to the ARP cache in the default VRF.

switch(config)# arp 172.22.30.52 0025.900e.c63c arpa
switch(config)#

This command adds the same static entry to the ARP cache in the VRF named purple.

switch(config)# arp vrf purple 172.22.30.52 0025.900e.c63c arpa
switch(config)#

arp aging timeout

The arp aging timeout command specifies the duration of dynamic address entries in the Address Resolution Protocol (ARP) cache for addresses learned through the configuration mode interface. The default duration is 14400 seconds (four hours).

The arp aging timeout and default arp aging timeout commands restores the default ARP aging timeout for addresses learned on the configuration mode interface by deleting the corresponding arp aging timeout command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

arp aging timeout arp_time

no arp aging timeout

default arp aging timeout

Parameter

arp_time ARP aging timeout period (seconds). Values range from 60 to 65535. Default value is 14400.

Example

This command specifies an ARP cache duration of 7200 seconds (two hours) for dynamic addresses added to the ARP cache that were learned through vlan 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# arp aging timeout 7200
switch(config-if-Vl200)# show active
interface Vlan200
   arp aging timeout 7200
switch(config-if-Vl200)#

arp cache persistent

The arp cache persistent command restores the dynamic entries in the Address Resolution Protocol (ARP) cache after reboot.

The no arp cache persistent and default arp cache persistent commands remove the ARP cache persistent configuration from the running-config.

Command Mode

Global Configuration

Command Syntax

arp cache persistent

no arp cache persistent

default arp cache persistent

Example

This command restores the ARP cache after reboot.

switch(config)# arp cache persistent
switch(config)#

arp gratuitous accept

The arp gratuitous accept command configures the configuration mode interface to accept gratuitous ARP request packets received on that interface. Accepted gratuitous ARP requests are then learned by the ARP table.

The no and default forms of the command prevent the interface from accepting gratuitous ARP requests. Configuring gratuitous ARP acceptance on an L2 interface has no effect.

Command Mode

Interface-Ethernet Configuration

Interface-VLAN Configuration

Interface Port-channel Configuration

Command Syntax

arp gratuitous accept

no arp gratuitous accept

default arp gratuitous accept

Example

These commands configure interface ethernet 2/1 to accept gratuitous ARP request packets.

switch(config)# interface ethernet 2/1
switch(config-if-Et2/1)# arp gratuitous accept
switch(config-if-Et2/1)#

arp proxy max-delay

The arp proxy max-delay command enables delayingproxy ARP requests on the configuration mode interface. Proxy ARP is disabled by default. When proxy ARP is enabled, the switch responds to all ARP requests, including gratuitous ARP requests, with target IP addresses that match a route in the routing table. When a switch receives a proxy ARP request, EOS performs a check to send the response immediately or delay the response based on the configured maximum delay in milliseconds (ms).

Command Mode

Configuration mode

Command Syntax

arp proxy max-delay milliseconds

Parameters

milliseconds - Configure the maximum delay before returning a proxy ARP response in milliseconds. Use a range between 0 and 1000ms with a default value of 800ms.

Example

This command sets a delay of 500ms before returning a response to a proxy ARP request.

switch(config)# arp proxy max-delay 500ms

clear arp inspection statistics

The clear arp inspection statistics command clears ARP inspection statistics.

Command Mode

EXEC

Command Syntax

clear arp inspection statistics

Related Commands

ip arp inspection limit
ip arp inspection logging
ip arp inspection trust
ip arp inspection vlan
show ip arp inspection vlan
show ip arp inspection statistics

Example

This command clears ARP inspection statistics.

switch(config)# clear arp inspection statistics
switch(config)#

clear arp

The clear arp command removes the specified dynamic ARP entry for the specified IP address from the Address Resolution Protocol (ARP) table.

Command Mode

Privileged EXEC

Command Syntax

clear arp [VRF_INSTANCE] ipv4_addr

Parameters

VRF_INSTANCE Specifies the VRF instance for which arp data is removed.
- no parameter Specifies the context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
ipv4_addr IPv4 address of dynamic ARP entry.

Example

These commands display the ARP table before and after the removal of dynamic ARP entry for IP address 172.22.30.52.

switch# show arp

Address         Age (min)  Hardware Addr   Interface
172.22.30.1             0  001c.730b.1d15  Management1
172.22.30.52            0  0025.900e.c468  Management1
172.22.30.53            0  0025.900e.c63c  Management1
172.22.30.133           0  001c.7304.3906  Management1

switch# clear arp 172.22.30.52
switch# show arp

Address         Age (min)  Hardware Addr   Interface
172.22.30.1             0  001c.730b.1d15  Management1
172.22.30.53            0  0025.900e.c63c  Management1
172.22.30.133           0  001c.7304.3906  Management1

switch#

clear arp-cache

The clear arp-cache command refreshes dynamic entries in the Address Resolution Protocol (ARP) cache. Refreshing the ARP cache updates current ARP table entries and removes expired ARP entries not yet deleted by an internal, timer-driven process.

The command, without arguments, refreshes ARP cache entries for all enabled interfaces. With arguments, the command refreshes cache entries for the specified interface. Executing clear arp-cache for all interfaces can result in extremely high CPU usage while the tables are resolving.

Command Mode

Privileged EXEC

Command Syntax

clear arp-cache [VRF_INSTANCE][INTERFACE_NAME]

Parameters

VRF_INSTANCE Specifies the VRF instance for which arp data is refreshed.
- no parameter Specifies the context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
INTERFACE_NAME Interface upon which ARP cache entries are refreshed. Options include:
- no parameter All ARP cache entries.
- interface ethernet e_num ARP cache entries of specified Ethernet interface.
- interface loopback l_num ARP cache entries of specified loopback interface.
- interface management m_num ARP cache entries of specified management interface.
- interface port-channel p_num ARP cache entries of specified port-channel Interface.
- interface vlan v_num ARP cache entries of specified VLAN interface.
- interface VXLAN vx_num VXLAN interface specified by vx_num.

Related Commands

The cli vrf command specifies the context-active VRF.

Example

These commands display the ARP cache before and after ARP cache entries are refreshed.

switch# show arp

Address         Age (min)  Hardware Addr   Interface
172.22.30.1             0  001c.730b.1d15  Management1
172.22.30.118           0  001c.7301.6015  Management1

switch# clear arp-cache
switch# show arp

Address         Age (min)  Hardware Addr   Interface
172.22.30.1             0  001c.730b.1d15  Management1

switch#

clear ip dhcp relay counters

The clear ip dhcp relay counters command resets the DHCP relay counters. The configuration mode determines which counters are reset:.

The Interface configuration command clears the counter for the configuration mode interface.

Command Mode

Privileged EXEC

Command Syntax

clear ip dhcp relay counters [INTERFACE_NAME]

Parameters

INTERFACE_NAME Entity for which counters are cleared. Options include:

no parameter Clears counters for the switch and for all interfaces.
interface ethernet e_num Clears counters for the specified Ethernet interface.
interface loopback l_num Clears counters for the specified loopback interface.
interface port-channel p_num Clears counters for the specified port-channel Interface.
interface vlan v_num Clears counters for the specified VLAN interface.

Examples

These commands clear the DHCP relay counters for vlan 1045 and shows the counters before and after the clear command.

switch# show ip dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
 Vlan1001 |  207  148    0 | 4 days, 19:54:24 ago
 Vlan1045 |  376  277    0 | 4 days, 19:54:24 ago

switch# clear ip dhcp relay counters interface vlan 1045

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  380  380    0 | 4 days, 21:19:17 ago
 All Resp |  281  281    0 |
          |                |
 Vlan1000 |  207  148    0 | 4 days, 21:18:30 ago
 Vlan1045 |    0    0    0 |          0:00:07 ago

These commands clear all DHCP relay counters on the switch.

switch(config-if-Vl1045)# exit
switch(config)# clear ip dhcp relay counters
switch(config)# show ip dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop | Last Cleared
----------|----- ---- -----|-------------
  All Req |    0    0    0 |  0:00:03 ago
 All Resp |    0    0    0 |
          |                |
 Vlan1000 |    0    0    0 |  0:00:03 ago
 Vlan1045 |    0    0    0 |  0:00:03 ago

clear ip dhcp snooping counters

The clear ip dhcp snooping counters command resets the DHCP snooping packet counters.

Command Mode

Privileged EXEC

Command Syntax

clear ip dhcp snooping counters [COUNTER_TYPE]

Parameters

COUNTER_TYPE - Specify the type of counter to reset. Options include the following:

no parameter Counters for each VLAN.
debug Aggregate counters and drop cause counters.

Examples

This command clears the DHCP snooping counters for each VLAN.

switch# clear ip dhcp snooping counters
switch# show ip dhcp snooping counters

     | Dhcp Request Pkts | Dhcp Reply Pkts |
Vlan |  Rcvd  Fwdd  Drop | Rcvd Fwdd  Drop | Last Cleared
-----|------ ----- ------|----- ---- ------|-------------
 100 |     0     0     0 |    0    0     0 |  0:00:10 ago

switch#

This command clears the aggregate DHCP snooping counters.

switch# clear ip dhcp snooping counters debug
switch# show ip dhcp snooping counters debug

Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      0                 0
Forwarded                                     0                 0
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Info Option                 0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  0:00:08 ago

switch#

clear ip multicast count

The clear ip multicast count command clears all counters associated with the multicast traffic.

Command Mode

Gobal Configuration

Command Syntax

clear ip multicast count [group_address [source_address]]

Parameters

no parameters Clears all counts of the multicast route traffic.
group_address Clears the multicast traffic count of the specified group address.
- source_address Clears the multicast traffic count of the specified group and source addresses.

Guidelines

This command functions only when the ip multicast count command is enabled.

Examples

This command clears all counters associated with the multicast traffic.
```
switch(config)# clear ip multicast count
```
This command clears the multicast traffic count of the specified group address.
```
switch(config)# clear ip multicast count 16.39.24.233
```

clear snapshot counters ecmp

The clear shapshot counters ecmp deletes previous snapshots.

Command Mode

EXEC

Command Syntax

clear snapshot counters ecmp req_id_range

Parameters

req_id_range - Specify the Request ID of the snapshot to delete. If none specified, all previous snapshots delete from the switch.

Example

To delete previous snapshots, use the following command:

switch#clear snapshot counters ecmp id_range

cli vrf

The cli vrf command specifies the context-active VRF. The context-active VRF determines the default VRF that VRF-context aware commands use when displaying routing table data.

Command Mode

Privileged EXEC

Command Syntax

cli vrf [VRF_ID]

Parameters

VRF_ID Name of VRF assigned as the current VRF scope. Options include:

vrf_name Name of user-defined VRF.
default System-default VRF.

Guidelines

VRF-context aware commands include:

show ip route gateway

show ip route host

Related Commands

The show routing-context vrf command displays the context-active VRF.

Example

These commands specify magenta as the context-active VRF, then display the context-active VRF.

switch# cli vrf magenta
switch# show routing-context vrf
Current VRF routing-context is magenta
switch#

compress

The compress command increases the hardware resources available for the specified prefix lengths.

The no compress command removes the 2-to-1 compression configuraion from the running-config.

Note: The compress command is supported only on 7500R, 7280R, 7500R2 and 7280R2 platforms.

Command Mode

Global Configuration

Command Syntax

ip hardware fib optimize prefix-length prefix-lengthexpand prefix-length compress

no ip hardware fib optimize prefix-length prefix-lengthexpand prefix-length compress

Parameters

compress Allows configuring up to one compressed prefix length.

Example

In the following example we are configuring prefix length 20 and 24, expanding prefix length 19 and 23, and compressing prefix length 25.

switch(config)# ip hardware fib optimize prefix-length 20 24 expand 19 23 compress 25
 ! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

description (VRF)

The description command adds a text string to the configuration mode VRF. The string has no functional impact on the VRF.

The no description and default description commands remove the text string from the configuration mode VRF by deleting the corresponding description command from running-config.

Command Mode

VRF Configuration

Command Syntax

description label_text

no description

default description

Parameters

label_text Character string assigned to the VRF configuration.

Related Commands

The vrf instance command places the switch in VRF configuration mode.

Example

These commands add description text to the magenta VRF.

switch(config)# vrf instance magenta
switch(config-vrf-magenta)# description This is the first vrf
switch(config-vrf-magenta)# show active
 vrf instance magenta
   description This is the first vrf

switch(config-vrf-magenta)#

dhcp relay

The dhcp relay command places the switch in the DHCP relay mode. This command is executed under global configuration mode.

The no dhcp relay command removes DHCP relay configuration from the running-config.

Command Mode

Global Configuration Mode

Command Syntax

dhcp relay

no dhcp relay

Example

The dhcp relay command places the switch in the DHCP relay configuration mode.

switch(config)# dhcp relay
switch(config-dhcp-relay)#

dhcp server

The dhcp server command places the switch in the DHCP relay mode. Execute this command in the DHCP Server Configuration Mode.

The no dhcp server command removes DHCP relay configuration from the running-config.

Command Mode

Global Configuration Mode

Command Syntax

dhcp server

no dhcp server

Example

The dhcp server command places the switch in the DHCP relay configuration mode.

switch(config)# dhcp server
switch(config-dhcp-server)#

dhcp server client

The dhcp server client command configures client options for the DHCP server.Execute this command under the dhcp server configuration mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

Parameters

[ipv4|ipv6] - Select the IP address family.
definition client_class - Add a class for the client definition.
default-gateway - Configure the client class default gateway sent to DHCP clients.
dns - Configure the client class DNS.
lease - Configure the client class lease.
option - Configure the client class DHCP options.
private-option - Configure the client class's private options.
tftp - Configure the client class's TFTP options.

Example

Use the dhcp server client class default-gateway command to add a client definition for the IPv4 DHCP client class default gateway of 10.0.0.1. options.

switch(config-dhcp-server)# client class ipv4 definition test1 default-gateway 10.0.0.1

dhcp server debug

The dhcp server debug log command configures DHCP server debugging configuration. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server debug log file

Parameters

log file - Specify the file location to store debugging logs.

Example

Use the dhcp server log command to add a file location for debugging logs.

switch(config-dhcp-server)#debug log

dhcp server dns

The dhcp server dns command configures DHCP server DNS options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server dns [domain name domain_name ] [server [ipv4|ipv6] ip_address

Parameters

domain name domain_name - Specify the domain name of the DNS server.
server [ipv4|ipv6] ip_address - Specify the DNS server as IPv4 or IPv6 and the IP address of the server.

Example

Use the dhcp server dns command to add an IPv4 DNS server, 192.168.10.5, to the DHCP configuration. options.

switch(config-dhcp-server)# dns server ipv4 192.168.10.5

dhcp server lease

The dhcp server lease command configures DHCP server lease options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server lease time [ipv4|ipv6] days days hourshours minutesminutes

Parameters

[ipv4|ipv6] - Configure the lease for IPv4 or IPv6.
days days - Specify the number of days for the lease to be in effect from 0 to 2000 days.
hourshours - Specify the number of hours for the lease to be in effect from 0 to 23 hours.
minutesminutes - Specify the number of minutes for the lease to be in effect from 0 to 59 minutes.

Example

Use the dhcp server lease command to add an IPv4 lease to be in effect for 10 days, to the DHCP configuration.

switch(config-dhcp-server)# dns lease time ipv4 10 days

dhcp server option

The dhcp server option command configures DHCP server options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server option [ipv4|ipv6] code [always-send data type [hex |string] data]] >quoted_string >hex [client-id disable] hourshours minutesminutes

Parameters

[ipv4|ipv6] - Configure the option for IPv4 or IPv6.
code- Specify the option number from the DHCP options.
[always-send data type [hex |string] data]] >quoted_string >hex - Specify to send the option whether or not the client requested it.
client-id disable - Prevent the DHCPv4 server from sending back the client ID.

Example

Use the dhcp server option command to add an IPv4 DHCP code, 67, to the DHCP configuration.

switch(config-dhcp-server)# option ipv4 option 67

dhcp server private-option

The dhcp server private-option command configures DHCP server private options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server private-option [ipv4|ipv6] code [always-send data type [hex |string] data]] >quoted_string >hex

Parameters

[ipv4|ipv6] - Configure the option for IPv4 or IPv6.
code- Specify the option number from 224 to 254.
[always-send data type [hex |string] data]] quoted_string >hex - Specify to send the option whether or not the client requested it.

Example

Use the dhcp server option command to add an IPv4 private option code, 225, and to always send the option to the DHCP configuration.

switch(config-dhcp-server)# option ipv4 private-option 225 always-send private-option ipv4 225 always-send type string data "Code Sent"

dhcp server subnet

The dhcp server subnet command configures DHCP server subnet options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server subnet ipv4_address ipv6_address

Parameters

ipv4_address> - Configure the IPv4 subnet.
ipv6_address - Configure the IPv6 subnet.

Example

Use the dhcp server subnet command to add an IPv4 subnet, 198.168.0.0/24, to the DHCP configuration.

switch(config-dhcp-server)# subnet 198.168.0.0/24

dhcp server subnet client

The dhcp server subnet [ipv4 | ipv6] client command configures client options for the DHCP server. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

Parameters

[ipv4|ipv6] - Select the IP address family.
definition client_class - Add a class for the client definition.
default-gateway ip_address - Configure the client class default gateway sent to DHCP clients.
dns server - Configure the client class DNS.
lease days hourshours minutesminutes - Configure the client class lease in days, hours, and minutes.
name name - Configure the subnet name.
range ip_address_start ip_address_end - Configure the range of IP addresses for the subnet.
reservations mac-address mac_address [hostname | ipv4-address]- Configure the MAC address to use for reservations.
tftp - Configure the client class's TFTP options.

Example

Use the dhcp server subnet ipv4 client class default-gateway command to add a client definition for the IPv4 DHCP client class default gateway of 10.0.0.1. options.

switch(config-dhcp-server)#subnet ipv4 client class ipv4 definition test1 default-gateway 10.0.0.1

dhcp server tftp

The dhcp server tftp command configures DHCP server TFTP options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server tftp server [file [ipv4|ipv6] file_name] [option [150|66]] ipv4

Parameters

file [ipv4|ipv6] file_name> - Configure the IPv4 or IPv6 boot file name.
option [150|66]] ipv4 ip_address - Configure the TFTP DHCP option as 150 or 66 with an IPv4 address.

Example

Use the dhcp server tftp command to add option 150 with an IPv4 address 198.168.0.11, to the DHCP configuration.

switch(config-dhcp-server)# tftp option 150 ipv4 198.168.0.11

dhcp server vendor-option

The dhcp server vendor-option command configures the DHCP server vendor identifier options. Execute this command under the dhcp server configuration mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server vendor-option ipv4 vendor_id default vendor_id sub-option sub-option_code

Parameters

vendor_id - Configure the vendor identifier.
default vendor_id - Set as the default vendor specific option.
sub-option sub-option_code - Set the sub-option code from 1-254.

Example

Use the dhcp server vendor-option command to add vendor option, 1:4:c0:0:2:8 , to the DHCP configuration.

switch(config-dhcp-server)# vendor-option 1:4:c0:0:2:8

dhcp server vendor-option ipv4 sub-option

The dhcp server vendor-option command configures the DHCP server vendor identifier options. Execute this command in the DHCP Server Configuration Mode.

Command Mode

DHCP Server Configuration Mode

Command Syntax

dhcp server vendor-option ipv4 vendor_id default vendor_id sub-option sub-option_code type [array | ipv4-address | string] array [ipv4-address data ip_address [string data quoted_string

Parameters

vendor_id - Configure the vendor identifier.
default vendor_id - Set as the default vendor specific option.
sub-option sub-option_code - Set the sub-option code from 1-254.

Example

Use the dhcp server vendor-option command to add the vendor option, 1:4:c0:0:2:8, to the DHCP Server configuration.

switch(config-dhcp-server)# vendor-option 1:4:c0:0:2:8

interface tunnel

The interface tunnel command places the switch in interface-tunnel configuration mode.

Interface-tunnel configuration mode is not a group change mode; running-config is changed immediately after commands are executed.

The no interface tunnel command deletes the specified interface tunnel configuration.

The exit command returns the switch to the global configuration mode.

Command Mode

Global Configuration

Command Syntax

interface tunnel number

no interface tunnel number

Parameter

number Tunnel interface number. Values range from 0 to 255.

Example

This command places the switch in interface-tunnel configuration mode for tunnel interface 10.

switch(config)# interface tunnel 10
switch(config-if-Tu10)#

ip arp inspection limit

The ip arp inspection limit command disables the interface if the incoming ARP rate exceeds the configured value rate limit of the incoming ARP packets on an interface.

Command Mode

EXEC

Command Syntax

ip arp inspection limit [ RATE pps] [BURST_INTERVAL sec | none]

no ip arp inspection limit [ RATE pps] [BURST_INTERVAL sec | none]

default ip arp inspection limit [ RATE pps] [BURST_INTERVAL sec | none]

Parameters

RATE - Specifies the ARP inspection limit rate in packets per second.
- pps - Specify the number of ARP inspection limit rate packets per second.
BURST_INTERVAL - Specifies the ARP inspection limit burst interval.
- sec - Specify the burst interval in seconds.

Related Commands

ip arp inspection limit
ip arp inspection trust
ip arp inspection vlan
show ip arp inspection vlan

Examples

This command configures the rate limit of incoming ARP packets to disable the interface when the incoming ARP rate exceeds the configured value, sets the rate to 512, the upper limit for the number of invalid ARP packets allowed per second, and sets the burst consecutive interval to monitor the interface for a high ARP rate to 11 seconds.
```
switch(config)# ip arp inspection limit rate 512 burst interval 11
switch(config)#
```

This command displays verification of the interface specific configuration.

switch(config)# interface ethernet 3/1
switch(config)# ip arp inspection limit rate 20 burst interval 5
switch(config)# interface Ethernet 3/3
switch(config)# ip arp inspection trust
switch(config)# show ip arp inspection interfaces
 
 Interface      Trust State  Rate (pps) Burst Interval
 -------------  -----------  ---------- --------------
 Et3/1          Untrusted    20         5
 Et3/3          Trusted      None       N/A

switch(config)#

ip arp inspection logging

The ip arp inspection logging command enables logging of incoming ARP packets on the interface if the rate exceeds the configured value.

Command Mode

EXEC

Command Syntax

ip arp inspection logging [RATE pps ][BURST_INTERVAL sec | none]

no ip arp inspection logging [RATE pps ][BURST_INTERVAL sec | none]

default ip arp inspection logging [RATE pps ][BURST_INTERVAL sec | none]

Parameters

RATE - Specifies the ARP inspection limit rate in packets per second.
- <pps> -Specifies the number of ARP inspection limit rate packets per second.
BURST_INTERVAL - Specifies the ARP inspection limit burst interval.
- sec - Specify the number of burst interval seconds.

Related Commands

ip arp inspection limit
ip arp inspection trust
ip arp inspection vlan
show ip arp inspection vlan

Example

This command enables logging of incoming ARP packets when the incoming ARP rate exceeds the configured value on the interface, sets the rate to monitor the interface for a high ARP rate to 15 seconds.

switch(config)# ip arp inspection logging rate 2048 burst interval 15
switch(config)#

ip arp inspection trust

The ip arp inspection trust command configures the trust state of an interface. By default, all interfaces are untrusted.

Command Mode

EXEC

Command Syntax

ip arp inspection trust

no ip arp inspection trust

default ip arp inspection trust

Related Commands

ip arp inspection limit
ip arp inspection logging
show ip arp inspection vlan
ip arp inspection vlan

Examples

This command configures the trust state of an interface.

switch(config)# ip arp inspection trust
switch(config)#

This command configures the trust state of an interface to untrusted.
```
switch(config)# no ip arp inspection trust
switch(config)#
```
This command configures the trust state of an interface to the default.
```
switch(config)# default ip arp inspection trust
switch(config)#
```

ip arp inspection vlan

The ip arp inspection vlan command enables ARP inspection. EOS intercepts ARP requests and responses on untrusted interfaces on specified VLANs, and verifies intercepted packets with valid IP-MAC address bindings. EOS drops all invalid ARP packets. On trusted interfaces, EOS processes all incoming ARP packets and forwards without verification. By default, EOS disables ARP inspection on all VLANs.

Command Mode

EXEC

Command Syntax

ip arp inspection vlan [LIST]

Parameters

LIST Specifies the VLAN interface number.

Related Commands

ip arp inspection limit
ip arp inspection trust
ip arp inspection vlan

Example

This command enables ARP inspection on VLANs 1 through 150.

switch(config)# ip arp inspection vlan 1 - 150
switch(config)#

This command disables ARP inspection on VLANs 1 through 150.

switch(config)# no ip arp inspection vlan 1 - 150
switch(config)#

This command sets the ARP inspection default to VLANs 1 through 150.

switch(config)# default ip arp inspection vlan 1 - 150
switch(config)#

These commands enable ARP inspection on multiple VLANs 1 through 150 and 200 through 250.
```
switch(config)# ip arp inspection vlan 1-150,200-250
switch(config)#
```

ip dhcp relay all-subnets

The ip dhcp relay all-subnets command configures the DHCP smart relay status on the configuration mode interface. DHCP smart relay supports forwarding DHCP requests with a client secondary IP addresses in the gateway address field. Enabling DHCP smart relay on an interface requires that you enable DHCP relay on that interface.

By default, an interface assumes the global DHCP smart relay setting as configured by the ip dhcp relay all-subnets default command. The ip dhcp relay all-subnets command, when configured, takes precedence over the global smart relay setting.

The no ip dhcp relay all-subnets command disables DHCP smart relay on the configuration mode interface. The default ip dhcp relay all-subnets command restores the interface’s to the default DHCP smart relay setting, as configured by the ip dhcp relay all-subnets default command, by removing the corresponding ip dhcp relay all-subnets or no ip dhcp relay all-subnets statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip dhcp relay all-subnets

no ip dhcp relay all-subnets

default ip dhcp relay all-subnets

Examples

This command enables DHCP smart relay on VLAN interface 100.

switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# ip dhcp relay all-subnets
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  DHCP Smart Relay is enabled
  DHCP servers: 10.4.4.4
switch(config-if-Vl100)#

This command disables DHCP smart relay on VLAN interface 100.

switch(config-if-Vl100)# no ip dhcp relay all-subnets
switch(config-if-Vl100)# show active
 interface Vlan100
   no ip dhcp relay all-subnets
   ip helper-address 10.4.4.4
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 10.4.4.4
switch(config-if-Vl100)#

This command enables DHCP smart relay globally, configures VLAN interface 100 to use the global setting, then displays the DHCP relay status.

switch(config)# ip dhcp relay all-subnets default
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# default ip dhcp relay
switch(config-if-Vl100)# show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  Option 82 Circuit ID: 333
  DHCP Smart Relay is enabled
  DHCP servers: 10.4.4.4
switch(config-if-Vl100)#

ip dhcp relay all-subnets default

The ip dhcp relay all-subnets default command configures the global DHCP smart relay setting. DHCP smart relay supports forwarding DHCP requests with a client secondary IP addresses in the gateway address field. The default global DHCP smart relay setting is disabled.

The global DHCP smart relay setting applies to all interfaces for which an ip dhcp relay all-subnets statement does not exist. Enabling DHCP smart relay on an interface requires that you also enable DHCP relay on that interface.

The no ip dhcp relay all-subnets default and default ip dhcp relay all-subnets default commands restore the global DHCP smart relay default setting of disabled by removing the ip dhcp relay all-subnets default command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay all-subnets default

no ip dhcp relay all-subnets default

default ip dhcp relay all-subnets default

Example

This command configures the global DHCP smart relay setting to enabled.

switch(config)# ip dhcp relay all-subnets default
switch(config)#

ip dhcp relay always-on

The ip dhcp relay always-on command enables the DHCP relay agent on the switch regardless of the DHCP relay agent status on any interface. By default, the DHCP relay agent is enabled only if at least one routable interface is configured with an ip helper-address statement.

The no ip dhcp relay always-on and default ip dhcp relay always-on commands remove the ip dhcp relay always-on command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay always-on

no ip dhcp relay always-on

default ip dhcp relay always-on

Example

This command enables the DHCP relay agent.

switch(config)# ip dhcp relay always-on
switch(config)#

ip dhcp relay information option (Global)

The ip dhcp relay information option command configures the switch to attach tags to DHCP requests before forwarding them to the DHCP servers designated by the ip helper-address commands. The command specifies the tag contents for packets forwarded by the configured interface. The default value for each interface configured with an ip helper-address is the name and number of the interface.

The no ip dhcp relay information option and default ip dhcp relay information option commands restore the switch default setting of not attaching tags to DHCP requests by removing the ip dhcp relay information option command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp relay information option

no ip dhcp relay information option

default ip dhcp relay information option

Example

This command enables the attachment of tags to DHCP requests forwarded to DHCP server addresses.

switch(config)# ip dhcp relay information option
switch(config)#

ip dhcp relay information option circuit-id

The ip dhcp relay information option circuit-id command specifies the content of tags that the switch attaches to DHCP requests before forwarding them from the configuration mode interface to DHCP server addresses specified by ip helper-address commands. Tags attach to outbound DHCP requests only if you enable the information option on the switch (ip dhcp relay information option circuit-id).

The no ip dhcp relay information option circuit-id and default ip dhcp relay information option circuit-id commands restore the default content setting for the configuration mode interface by removing the corresponding command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip dhcp relay information option circuit-id id_label

no ip dhcp relay information option circuit-id

default ip dhcp relay information option circuit-id

Parameters

id_label- Specify the tag content. Use a format in alphanumeric characters (maximum 15 characters).

Example

This command configures x-1234 as the tag content for packets send from VLAN 200.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ip dhcp relay information option circuit-id x-1234
switch(config-if-Vl200)#

ip dhcp snooping

The ip dhcp snooping command enables DHCP snooping globally on the switch. Configure DHCP snooping as a set of Layer 2 processes and use it with DHCP servers to control network access to clients with specific IP/MAC addresses. The switch supports Option-82 insertion,a DHCP snooping process that allows relay agents to provide remote-ID and circuit-ID information to DHCP reply and request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port. DHCP servers use port information to track host location and IP address usage by authorized physical ports.

DHCP snooping uses the information option (Option-82) to include the switch MAC address as the router-ID along with the physical interface name and VLAN number as the circuit-ID in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server as specified by the DHCP protocol.

DHCP snooping on a specified VLAN requires all of these conditions to be met:

Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.

The no ip dhcp snooping and default ip dhcp snooping commands disables global DHCP snooping by removing the ip dhcp snooping command from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping

no ip dhcp snooping

default ip dhcp snooping

Related Commands

ip dhcp snooping information option enables insertion of option-82 snooping data.
ip helper-address enables the DHCP relay agent on a configuration mode interface.

Example

This command globally enables snooping on the switch, displaying DHCP snooping status prior and after invoking the command.

switch(config)# show ip dhcp snooping
DHCP Snooping is disabled
switch(config)# ip dhcp snooping
switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is not operational
DHCP Snooping is configured on following VLANs:
  None
DHCP Snooping is operational on following VLANs:
  None
Insertion of Option-82 is disabled
switch(config)#

ip dhcp snooping bridging

The ip dhcp snooping bridging command enables the DHCP snooping bridging configuration.

The no ip dhcp snooping bridging command removes the DHCP snooping bridging configuration from the running-config.

Command Mode

Global Configuration Mode

Command Syntax

ip dhcp snooping bridging

no ip dhcp snooping bridging

Example

This command configures the DHCP snooping bridging.

switch# configure
switch(config)# ip dhcp snooping bridging

ip dhcp snooping information option

The ip dhcp snooping information option command enables the insertion of option-82 DHCP snooping information in DHCP packets on VLANs where DHCP snooping is enabled. DHCP snooping is a Layer 2 switch process that allows relay agents to provide remote-ID and circuit-ID information to DHCP reply and request packets. DHCP servers use this information to determine the originating port of DHCP requests and associate a corresponding IP address to that port.

DHCP snooping uses information option (Option-82) to include the switch MAC address (router-ID) along with the physical interface name and VLAN number (circuit-ID) in DHCP packets. After adding the information to the packet, the DHCP relay agent forwards the packet to the DHCP server through DHCP protocol processes.

DHCP snooping on a specified VLAN requires all of these conditions to be met:

Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.

Ifnot enabling DHCP snooping globally, the ip dhcp snooping information option command persists in running-config without any operational effect.

The no ip dhcp snooping information option and default ip dhcp snooping information option commands disable the insertion of option-82 DHCP snooping information in DHCP packets by removing the ip dhcp snooping information option statement from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping information option

no ip dhcp snooping information option

default ip dhcp snooping information option

Example

These commands enable DHCP snooping on DHCP packets from ports on snooping-enabled VLANs. DHCP snooping was previously enabled on the switch.

switch(config)# ip dhcp snooping information option
switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
  100
DHCP Snooping is operational on following VLANs:
  100
Insertion of Option-82 is enabled
  Circuit-id format: Interface name:Vlan ID
  Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#

ip dhcp snooping vlan

The ip dhcp snooping vlan command enables DHCP snooping on specified VLANs. DHCP snooping provides a Layer 2 process that allows relay agents to provide remote-ID and circuit-ID information in DHCP packets. DHCP servers use this data to determine the originating port of DHCP requests and associate a corresponding IP address to that port. Configure DHCP snooping on a global and VLAN basis.

VLAN snooping on a specified VLAN requires each of these conditions:

Enable DHCP snooping globally.
Enabled insertion of option-82 information in DHCP packets.
Enable DHCP snooping on the specified VLAN.
Enable DHCP relay on the corresponding VLAN interface.

If not enabling global DHCP snooping, the ip dhcp snooping vlan command persists in running-config without any operational affect.

The no ip dhcp snooping information option and default ip dhcp snooping information option commands disable DHCP snooping operability by removing the ip dhcp snooping information option statement from running-config.

Command Mode

Global Configuration

Command Syntax

ip dhcp snooping vlan v_range

no ip dhcp snooping vlan v_range

default ip dhcp snooping vlan v_range

Parameters

v_range - Specify the range of VLANs to enable DHCP snooping. Formats include a number, a number range, or a comma-delimited list of numbers and ranges. Numbers range from 1 to 4094.

Example

These commands enable DHCP snooping globally, DHCP snooping on VLAN interface 100, and DHCP snooping on vlan100.

switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping information option
switch(config)# ip dhcp snooping vlan 100
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip helper-address 10.4.4.4
switch(config-if-Vl100)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
  100
DHCP Snooping is operational on following VLANs:
  100
Insertion of Option-82 is enabled
  Circuit-id format: Interface name:Vlan ID
  Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch(config)#

ip hardware fib ecmp resilience

The ip hardware fib ecmp resilience command enables resilient ECMP for the specified IP address prefix and configures a fixed number of next hop entries in the hardware ECMP table for that prefix. In addition to specifying the maximum number of next hop addresses that the table can contain for the prefix, the command includes a redundancy factor that allows duplication of each next hop address. The fixed table space for the address is the maximum number of next hops multiplied by the redundancy factor.

Resilient ECMP is useful when it is not desirable for routes to be rehashed due to link flap, as when ECMP is being used for load balancing.

The no ip hardware fib ecmp resilience and default ip hardware fib ecmp resilience commands restore the default hardware ECMP table management by removing the ip hardware fib ecmp resilience command from running-config .

Command Mode

Global Configuration

Command Syntax

ip hardware fib ecmp resilience net_addr capacity nhop_max redundancy duplicates

no ip hardware fib ecmp resilience net_addr

default ip hardware fib ecmp resilience net_addr

Parameters

net_addr IP address prefix managed by command. (CIDR or address-mask).
nhop_max Maximum number of nexthop addresses for specified IP address prefix.
Value range varies by platform:
- Helix: <2 to 64>
- Trident: <2 to 32>
- Trident II: <2 to 64>
duplicates Specifies the redundancy factor. Value ranges from 1 to 128.

Example

This command configures a hardware ECMP table space of 24 entries for the IP address 10.14.2.2/24. A maximum of six next-hop addresses can be specified for the IP address. When the table contains six next-hop addresses, each appears in the table four times. When the table contains fewer than six next-hop addresses, each is duplicated until the 24 table entries are filled.

switch(config)# ip hardware fib ecmp resilience 10.14.2.2/24 capacity 6 redundancy 4
switch(config)#

ip hardware fib next-hop resource optimization

The ip hardware fib next-hop resource optimization command is used to enable or disable the resource optimization features on the switch. By default, RECMP is enabled on the switch.

The no hardware fib next-hop resource optimization command removes all the resource optimization features running on the switch.

Command Mode

Global Configuration Mode

Command Syntax

ip hardware fib next-hop resource optimization OPTIONS

no ip hardware fib next-hop resource optimization OPTIONS

Parameters

The following two options are allowed to configure with this command:
- disabled Disable hardware resource optimization for adjacency programming.
- thresholds Utilization percentage for starting or stopping optimization. The resource utilization percentage value ranges from 0 to 100. It can be set to low and high.

Examples

The following command is used to disable all hardware resource optimization features on the switch:

switch# configure terminal
switch(config)# ip hardware fib next-hop resource optimization disabled

The following command is used to configure the thresholds for starting and stopping the optimization:
```
switch(config)# ip hardware fib next-hop resource optimization thresholds low 20 high 80
```

ip hardware fib optimize

The ip hardware fib optimize command enables IPv4 route scale. Restart the platform Layer 3 agent to ensure optimization of IPv4 routes with the agent SandL3Unicast terminate command for the configuration mode interface.

Command Mode

Global Configuration

Command Syntax

ip hardware fib optimize exact-match prefix-length prefix-length prefix-length

Parameters

prefix-length The length of the prefix equal to 12, 16, 20, 24, 28, or 32. Optionally, add one additional prefix-length limited to the prefix-length of 32.

Related Commands

The agent SandL3Unicast terminate command restarts the Layer 3 agent to ensure optimization of IPv4 routes.
The show platform arad ip route command shows resources for all IPv4 routes in hardware. Routes with additional hardware resources appear with an asterisk (*).
The show platform arad ip route summary command displays hardware resource usage of IPv4 routes.

Examples

This configuration command allows configuring prefix lengths 12 and 32
```
switch(config)# ip hardware fib optimize exact-match prefix-length 12 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
```
One of the two prefixes in this command has a prefix-length of 32, required in the instance when adding two prefixes. For this command to take effect, restart the platform Layer 3 agent.
This configuration command restarts the platform Layer 3 agent to ensure optimization of IPv4 routes.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, and then re-added to the hardware.
This configuration command allows configuring prefix lengths 32 and 16.
```
switch(config)# ip hardware fib optimize exact-match prefix-length 32 16
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
```
One of the two prefixes in this command is a prefix-length of 32, required when adding two prefixes. For this command to take effect, restart the platform Layer 3 agent.
This configuration command restarts the platform Layer 3 agent to ensure optimization of IPv4 routes.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, and then re-added to the hardware.
This configuration command allows configuring prefix length 24.
```
switch(config)# ip hardware fib optimize exact-match prefix-length 24
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized
```
In this instance, add one prefix-length, and does not require a prefix-length of 32. For this command to take effect, restart the platform Layer 3 agent.
This configuration command restarts the platform Layer 3 agent to ensure optimization of IPv4 routes.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, and then re-added to the hardware.

This configuration command allows configuring the prefix length of 32.

switch(config)# ip hardware fib optimize exact-match prefix-length 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are optimized

For this command to take effect, restart the platform Layer 3 agent.

This configuration command restarts the platform Layer 3 agent to ensure optimization of IPv4 routes.
```
switch(config)# agent SandL3Unicast terminate
SandL3Unicast was terminated
```
Restarting the platform Layer 3 agent results in deletion of all IPv4 routes, and then re-added to the hardware.
This configuration command disables configuring prefix lengths 12 and 32.
```
switch(config)# no ip hardware fib optimize exact-match prefix-length 12 32
! Please restart layer 3 forwarding agent to ensure IPv4 routes are not optimized
```
One of the two prefixes in this command has a prefix-length of 32, required when configuring two prefixes. For this command to take effect, restart the platform Layer 3 agent.

ip helper-address

The ip helper-address command enables the DHCP relay agent on the configuration mode interface and specifies a forwarding address for DHCP requests. An interface that is configured with multiple helper-addresses forwards DHCP requests to all specified addresses.

The no ip helper-address and default ip helper-address commands remove the corresponding ip helper-address command from running-config. Commands that do not specify an IP helper-address remove all helper-addresses from the interface.

Command Mode

Interface-Ethernet Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip helper-address ipv4_addr [vrf vrf_name][source-address ipv4_addr | source-interface INTERFACES]

no ip helper-address [ipv4_addr]

default ip helper-address [ipv4_addr]

Parameters

vrf vrf_name Specifies the user-defined VRF for DHCP server.
ipv4_addr Specifies the DHCP server address accessed by interface.
source-address ipv4_addr Specifies the source IPv4 address to communicate with DHCP server.
source-interface INTERFACES Specifies the source interface to communicate with DHCP server. Options include:
- Ethernet eth_num Specifies the Ethernet interface number.
- Loopback lpbck_num Specifies the loopback interface number. Value ranges from 0 to 1000.
- Management mgmt_num Specifies the management interface number. Accepted values are 1 and 2.
- Port-Channel {int_num | sub_int_num} Specifies the port-channel interface or subinterface number. Value of interface ranges from 1 to 2000. Value of sub-interface ranges from 1 to 4094.
- Tunnel tnl_num Specifies the tunnel interface number. Value ranges from 0 to 255.
- VLAN vlan_num Specifies the Ethernet interface number. Value ranges from 1 to 4094.

Related Commands

ip dhcp relay always-on
ip dhcp relay information option (Global)
ip dhcp relay information option circuit-id

Guidelines

If the source-address parameter is specified, then the DHCP client receives an IPv4 address from the subnet of source IP address. The source-address must be one of the configured addresses on the interface.

Examples

This command enables DHCP relay on the VLAN interface 200; and configure the switch to forward DHCP requests received on this interface to the server at 10.10.41.15.

switch(config)# interface vlan 200
switch(config-if-Vl200)# ip helper-address 10.10.41.15
switch(config-if-Vl200)# show active
interface Vlan200
   ip helper-address 10.10.41.15
switch(config-if-Vl200)#

This command enables DHCP relay on the interface ewthernet 1/2; and configures the switch to use 2.2.2.2 as the source IP address when relaying IPv4 DHCP messages to the server at 1.1.1.1.
```
switch(config)# interface ethernet 1/2
switch(config-if-Et1/2)# ip helper-address 1.1.1.1 source-address 2.2.2.2
switch(config-if-Et1/2)#
```

ip icmp redirect

The ip icmp redirect command enables the transmission of ICMP redirect messages. Routers send ICMP redirect messages to notify data link hosts of the availability of a better route for a specific destination.

The no ip icmp redirect disables the switch from sending ICMP redirect messages.

Command Mode

Global Configuration

Command Syntax

ip icmp redirect

no ip icmp redirect

default ip icmp redirect

Example

This command disables the redirect messages.

switch(config)# no ip icmp redirect
switch(config)# show running-config
              <-------OUTPUT OMITTED FROM EXAMPLE-------->
!
no ip icmp redirect
ip routing
!
               <-------OUTPUT OMITTED FROM EXAMPLE-------->
switch(config)#

ip load-sharing

The ip load-sharing command provides the hash seed to an algorithm that the switch uses to distribute data streams among multiple equal-cost routes to an individual IPv4 subnet.

In a network topology using Equal-Cost Multipath routing, all switches performing identical hash calculations may result in hash polarization, leading to uneven load distribution among the data paths. Hash polarization is avoided when switches use different hash seeds to perform different hash calculations.

The no ip load-sharing and default ip load-sharing commands return the hash seed to the default value of zero by removing the ip load-sharing command from running-config.

Command Mode

Global Configuration

Command Syntax

ip load-sharing HARDWARE seed

no ip load-sharing HARDWARE

default ip load-sharing HARDWARE

Parameters

HARDWARE The ASIC switching device. The available option depend on the switch platform. Verify available options with the CLI ? command.
- arad
- fm6000
- petraA
- trident
seed The hash seed. Value range varies by switch platform. The default value on all platforms is 0.
- when HARDWARE=arad seed ranges from 0 to 2.
- when HARDWARE=fm6000 seed ranges from 0 to 39.
- when HARDWARE=petraA seed ranges from 0 to 2.
- when HARDWARE=trident seed ranges from 0 to 5.

Example

This command sets the IPv4 load sharing hash seed to one on FM6000 platform switches.

switch(config)# ip load-sharing fm6000 1
switch(config)#

ip local-proxy-arp

The ip local-proxy-arp command enables local proxy ARP (Address Resolution Protocol) on the configuration mode interface. When local proxy ARP is enabled, ARP requests received on the configuration mode interface will return an IP address even when the request comes from within the same subnet.

The no ip local-proxy-arp and default ip local-proxy-arp commands disable local proxy ARP on the configuration mode interface by removing the corresponding ip local-proxy-arp command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip local-proxy-arp

no ip local-proxy-arp

default ip local-proxy-arp

Example

These commands enable local proxy ARP on VLAN interface 140.

switch(config)# interface vlan 140
switch(config-if-Vl140)# ip local-proxy-arp
switch(config-if-Vl140)# show active
interface Vlan140
   ip local-proxy-arp
switch(config-if-Vl140)#

ip multicast count

The ip multicast count command enables the IPv4 multicast route traffic counter of group and source addresses in either bytes or packets.

The no ip multicast count command deletes all multicast counters including the routes of group and source addresses.

The no ip multicast count group_address source_addresscommand removes the current configuration of the specified group and source addresses. It does not delete the counter because the wildcard is still active.

The default ip multicast count command reverts the current counter configuration of multicast route to the default state.

Command Mode

Global Configuration

Command Syntax

ip multicast count [group_address [source_address] | bytes | packets]

no ip multicast count [group_address [source_address] | bytes | packets]

default ip multicast count [group_address [source_address] | bytes | packets]

Parameters

group_address Configures the multicast route traffic count of the specified group address.
- source_address Configures the multicast route traffic count of the specified group and source addresses.
bytes Configures the multicast route traffic count to bytes.
packets Configures the multicast route traffic count to packets.

Guidelines

This command is supported on the FM6000 platform only.

Examples

This command configures the multicast route traffic count to bytes.
```
switch(config)# ip multicast count bytes
```
This command configures the multicast route traffic count of the specified group and source addresses.
```
switch(config)# ip multicast count 10.50.30.23 45.67.89.100
```
This command deletes all multicast counters including the routes of group and source addresses.
```
switch(config)# no ip multicast count
```
This command reverts the current multicast route configuration to the default state.
```
switch(config)# default ip multicast count
```

ip proxy-arp

The ip proxy-arp command enables proxy ARP on the configuration mode interface. Proxy ARP is disabled by default. When proxy ARP is enabled, the switch responds to all ARP requests, including gratuitous ARP requests, with target IP addresses that match a route in the routing table.

The no ip proxy-arp and default ip proxy-arp commands disable proxy ARP on the configuration mode interface by removing the corresponding ip proxy-arp command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

ip proxy-arp

no ip proxy-arp

default ip proxy-arp

Example

This command enables proxy ARP on interface ethernet 4.

switch(config)# interface ethernet 4
switch(config-if-Et4)# ip proxy-arp
switch(config-if-Et4)#

ip route

The ip route command creates a static route. The destination is a network segment; the nexthop address is either an IPv4 address or a routable port. When multiple routes exist to a destination prefix, the route with the lowest administrative distance takes precedence.

By default, the administrative distance assigned to static routes is 1. Assigning a higher administrative distance to a static route configures it to be overridden by dynamic routing data. For example, a static route with an administrative distance value of 200 is overridden by OSPF intra-area routes, which have a default administrative distance of 110.

Tags are used by route maps to filter routes. The default tag value on static routes is 0.

Multiple routes with the same destination and the same administrative distance comprise an Equal Cost Multi-Path (ECMP) route. The switch attempts to spread outbound traffic equally through all ECMP route paths. All paths comprising an ECMP are assigned identical tag values; commands that change the tag value of a path change the tag value of all paths in the ECMP.

The no ip route and default ip route commands delete the specified static route by removing the corresponding ip route command from running-config. Commands that do not list a nexthop address remove all ip route statements with the specified destination from running-config. If an ip route statement exists for the same IP address in multiple VRFs, each must be removed separately. All static routes in a user-defined VRF are deleted when the VRF is deleted.

Command Mode

Global Configuration

Command Syntax

ip route [VRF_INSTANCE] dest_net NEXTHOP [DISTANCE][TAG_OPTION][RT_NAME]

no ip route [VRF_INSTANCE] dest_net [NEXTHOP][DISTANCE]

default ip route [VRF_INSTANCE] dest_net [NEXTHOP][DISTANCE]

Parameters

VRF_INSTANCE Specifies the VRF instance being modified.
- no parameter Changes are made to the default VRF.
- vrf vrf_name Changes are made to the specified VRF.
dest_net Destination IPv4 subnet (CIDR or address-mask notation).
NEXTHOP Location or access method of next hop device. Options include:
- ipv4_addr An IPv4 address.
- null0 Null0 interface.
- ethernet e_num Ethernet interface specified by e_num.
- loopback l_num Loopback interface specified by l_num.
- management m_num Management interface specified by m_num.
- port-channel p_num Port-channel interface specified by p_num.
- vlan v_num VLAN interface specified by v_num.
- VXLAN vx_num VXLAN interface specified by vx_num.
DISTANCE Administrative distance assigned to route. Options include:
- no parameter Route assigned default administrative distance of one.
- 1-255 The administrative distance assigned to route.
TAG_OPTION Static route tag. Options include:
- no parameter Assigns default static route tag of 0.
- tag t_value Static route tag value. t_value ranges from 0 to 4294967295.
RT_NAME Associates descriptive text to the route. Options include:
- no parameter No text is associated with the route.
- name descriptive_text The specified text is assigned to the route.

Related Command

The ip route nexthop-group command creates a static route that specifies a Nexthop Group to determine the Nexthop address.

Example

This command creates a static route in the default VRF.

switch(config)# ip route 172.17.252.0/24 vlan 2000
switch(config)#

ip routing

The ip routing command enables IPv4 routing. When IPv4 routing is enabled, the switch attempts to deliver inbound packets to destination IPv4 addresses by forwarding them to interfaces or next hop addresses specified by the forwarding table.

The no ip routing and default ip routing commands disable IPv4 routing by removing the ip routing command from running-config. When IPv4 routing is disabled, the switch attempts to deliver inbound packets to their destination MAC addresses. When this address matches the switch’s MAC address, the packet is delivered to the CPU. IP packets with IPv4 destinations that differ from the switch’s address are typically discarded. The delete-static-routes option removes static entries from the routing table.

IPv4 routing is disabled by default.

Command Mode

Global Configuration

Command Syntax

ip routing [VRF_INSTANCE]

no ip routing [DELETE_ROUTES][VRF_INSTANCE

default ip routing [DELETE_ROUTES][VRF_INSTANCE]

Parameters

DELETE_ROUTES Resolves routing table static entries when routing is disabled.
- no parameter Routing table retains static entries.
- delete-static-routes Static entries are removed from the routing table.
VRF_INSTANCE Specifies the VRF instance being modified.
- no parameter Changes are made to the default VRF.
- vrf vrf_name Changes are made to the specified user-defined VRF.

Example

This command enables IPv4 routing.

switch(config)# ip routing
switch(config)#

ip source binding

IP source guard (IPSG) is supported on Layer 2 Port-Channels, not member ports. The IPSG configuration on port channels supersedes the configuration on the physical member ports. Hence, source IP MAC binding entries should be configured on port channels. When configured on a port channel member port, IPSG does not take effect until this port is deleted from the port channel configuration.

Note: IP source bindings are also used by static ARP inspection.

The no ip source binding and default ip source binding commands exclude parameters from IPSG filtering, and set the default for ip source binding.

Command Mode

Interface-Ethernet Configuration

Command Syntax

ip source binding [IP_ADDRESS][MAC_ADDRESS] vlan [VLAN_RANGE] interface [INTERFACE]

no ip source binding [IP_ADDRESS][MAC_ADDRESS] vlan [VLAN_RANGE] interface [INTERFACE]

default ip source binding [IP_ADDRESS][MAC_ADDRESS] vlan [VLAN_RANGE] interface [INTERFACE]

Parameters

IP_ADDRESS Specifies the IP ADDRESS.
MAC_ADDRESS Specifies the MAC ADDRESS.
VLAN_RANGE Specifies the VLAN ID range.
INTERFACE Specifies the Ethernet interface.

Related Commands

ip verify source
show ip verify source

Example

This command configures source IP-MAC binding entries to IP address 10.1.1.1, MAC address 0000.aaaa.1111, VLAN ID 4094, and interface ethernet 36.

switch(config)# ip source binding 10.1.1.1 0000.aaaa.1111 vlan 4094 interface 
ethernet 36
switch(config)#

ip verify source

The ip verify source command configures IP source guard (IPSG) applicable only to Layer 2 ports. When configured on Layer 3 ports, IPSG does not take effect until this interface is converted to Layer 2.

IPSG is supported on Layer 2 Port-Channels, not member ports. The IPSG configuration on port channels supersedes the configuration on the physical member ports. Therefore, source IP MAC binding entries should be configured on port channels. When configured on a port channel member port, IPSG does not take effect until this port is deleted from the port channel configuration.

The no ip verify source and default ip verify source commands exclude VLAN IDs from IPSG filtering, and set the default for ip verify source.

Command Mode

Interface-Ethernet Configuration

Command Syntax

ip verify source vlan [VLAN_RANGE]

no ip verify source [VLAN_RANGE]

default ip verify source

Parameters

VLAN_RANGE Specifies the VLAN ID range.

Related Commands

ip source binding
show ip verify source

Example

This command excludes VLAN IDs 1 through 3 from IPSG filtering. When enabled on a trunk port, IPSG filters the inbound IP packets on all allowed VLANs. IP packets received on VLANs 4 through 10 on Ethernet 36 will be filtered by IPSG, while those received on VLANs 1 through 3 are permitted.

switch(config)# no ip verify source vlan 1-3
switch(config)# interface ethernet 36
switch(config-if-Et36)# switchport mode trunk
switch(config-if-Et36)# switchport trunk allowed vlan 1-10
switch(config-if-Et36)# ip verify source
switch(config-if-Et36)#

ip verify

The ip verify command configures Unicast Reverse Path Forwarding (uRPF) for inbound IPv4 packets on the configuration mode interface. uRPF verifies the accessibility of source IP addresses in packets that the switch forwards.

uRPF defines two operational modes: strict mode and loose mode.

Strict mode: uRPF verifies that a packet is received on the interface that its routing table entry specifies for its return packet.
Loose mode: uRPF validation does not consider the inbound packet’s ingress interface only that there is a valid return path.

The no ip verify and default ip verify commands disable uRPF on the configuration mode interface by deleting the corresponding ip verify command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-Channel Configuration

Interface-VLAN Configuration

Command Syntax

ip verify unicast source reachable-via RPF_MODE

no ip verify unicast

default ip verify unicast

Parameters

RPF_MODE Specifies the uRPF mode. Options include:

any Loose mode.
rx Strict mode.
rx allow-default Strict mode. All inbound packets are forwarded if a default route is defined.

Guidelines

The first IPv4 uRPF implementation briefly disrupts IPv4 unicast routing. Subsequent ip verify commands on any interface do not disrupt IPv4 routing.

Examples

This command enables uRPF loose mode on VLAN interface 17.

switch(config)# interface vlan 17
switch(config-if-Vl17)# ip verify unicast source reachable-via any
switch(config-if-Vl17)# show active
 interface Vlan17
   ip verify unicast source reachable-via any
switch(config-if-Vl17)#

This command enables uRPF strict mode on VLAN interface 18.

switch(config)# interface vlan 18
switch(config-if-Vl18)# ip verify unicast source reachable-via rx
switch(config-if-Vl18)# show active
 interface Vlan18
   ip verify unicast source reachable-via rx
switch(config-if-Vl18)#

ipv4 routable 240.0.0.0/4

The ipv4 routable 240.0.0.0/4 command assignes an class E addresses to an interface. When configured, the class E address traffic are routed through BGP, OSPF, ISIS, RIP, static routes and programmed to the FIB and kernel. By default, this command is disabled.

The no ipv4 routable 240.0.0.0/4 and default ipv4 routable 240.0.0.0/4 commands disable IPv4 Class E routing by removing the ipv4 routable 240.0.0.0/4 command from running-config.

IPv4 routable 240.0.0.0/4 routing is disabled by default.

Command Mode

Router General Configuration

Command Syntax

ipv4 routable 240.0.0.0/4

no ipv4 routable 240.0.0.0/4

default ipv4 routable 240.0.0.0/4

Example

These commands configure an IPv4 Class E (240/4) address to an interface.

switch(config)# router general
switch(config-router-general)# ipv4 routable 240.0.0.0/4

platform barefoot bfrt vrf

The platform barefoot bfrt vrf command configures the forwarding plane agent on supported platforms to restart and listen on the configured VRF for connections. If left unconfigured, the default VRF is used for the IP and port for theBfRuntime server.

Command Mode

Global Configuration

Command Syntax

platform barefoot bfrt vrf VRF name

Parameters

VRF name configured VRF for connections.

Example

These commands configure the forwarding plane agent to restart and listen on the configured VRF for connections.

switch(config)# vrf instance management
switch(config-vrf-management)# exit
switch(config)# platform barefoot bfrt 0.0.0.0 50052
switch(config)# platform barefoot bfrt vrf <VRF name>
switch(config)# int management1
switch(config-if-Ma1)# vrf management

platform trident forwarding-table partition

The platform trident forwarding-table partition command provides a shared table memory for L2, L3 and algorithmic LPM entries that can be partitioned in different ways.

Instead of having fixed-size tables for L2 MAC entry tables, L3 IP forwarding tables, and Longest Prefix Match (LPM) routes, the tables can be unified into a single shareable forwarding table.

Note: Changing the Unified Forwarding Table mode causes the forwarding agent to restart, briefly disrupting traffic forwarding on all ports.

The no platform trident forwarding-table partition and default platform trident forwarding-table partition commands remove the platform trident forwarding-table partition command from running-config.

Command Mode

Global Configuration

Command Syntax

platform trident forwarding-table partition SIZE

no platform trident forwarding-table partition

default platform trident forwarding-table partition

Parameters

SIZE Size of partition. Options include:

0 288k l2 entries, 16k host entries, 16k lpm entries.
1 224k l2 entries, 80k host entries, 16k lpm entries.
2 160k l2 entries, 144k host entries, 16k lpm entries.
3 96k l2 entries, 208k host entries, 16k lpm entries.

The default value is 2 (160k l2 entries, 144k host entries, 16k lpm entries).

Examples

This command sets the single shareable forwarding table to option 2 that supports 160k L2 entries, 144k host entries, and 16k LPM entries.
```
switch(config)# platform trident forwarding-table partition 2
switch(config)
```
This command sets the single shareable forwarding table to option 3 that supports 96k L2 entries, 208k host entries, and 16k LPM entries. Since the switch was previously configured to option 2, you’ll see a warning notice before the changes are implemented.
```
switch(config)# platform trident forwarding-table partition 3

Warning: StrataAgent will restart immediately
```

platform trident routing-table partition

The platform trident routing-table partition command manages the partition sizes for the hardware LPM table that stores IPv6 routes of varying sizes.

An IPv6 route of length /64 (or shorter) requires half the hardware resources of an IPv6 route that is longer than /64. The switch installs routes of varying lengths in different table partitions. This command specifies the size of these partitions to optimize table usage.

Note: Changing the routing table partition mode causes the forwarding agent to restart, briefly disrupting traffic forwarding on all ports.

The no platform trident routing-table partition and default platform trident routing-table partition commands restore the default partitions sizes by removing the platform trident routing-table partition command from running-config.

Command Mode

Global Configuration

Command Syntax

platform trident routing-table partition SIZE

no platform trident routing-table partition

default platform trident routing-table partition

Parameters

SIZE Size of partition. Options include:

1 16k IPv4 entries, 6k IPv6 (/64 and smaller) entries, 1k IPv6 (any prefix length).
2 16k IPv4 entries, 4k IPv6 (/64 and smaller) entries, 2k IPv6 (any prefix length).
3 16k IPv4 entries, 2k IPv6 (/64 and smaller) entries, 3k IPv6 (any prefix length).
The default value is 2 (16k IPv4 entries, 4k IPv6 (/64 and smaller) entries, 2k IPv6 (any prefix length).

Restrictions

Partition allocation cannot be changed from the default setting when uRPF is enabled for IPv6 traffic.

Example

This command sets the shareable routing table to option 1 that supports 6K prefixes equal to or shorter than /64 and 1K prefixes longer than /64.

switch(config)# platform trident routing-table partition 1
switch(config)

rib fib policy

The rib fib policy command enables FIB policy for a particular VRF under router general configuration mode. The FIB policy can be configured to advertise only specific RIB routes and exclude all other routes.

For example, a FIB policy can be configured that will not place routes associated with a specific origin in the routing table. These routes will not be used to forward data packets and these routes are not advertised by the routing protocol to neighbors.

The no rib fib policy and default rib fib policy commands restore the switch to its default state by removing the corresponding rib fib policy command from running-config .

Command Mode

Router General Configuration

Command Syntax

rib [ipv4 | ipv6] fib policy name

no rib [ipv4 | ipv6] fib policy name

default rib [ipv4 | ipv6] fib policy name

Parameters

ipv4 IPv4 configuration commands.
ipv6 IPv6 configuration commands.
name Route map name.

Example

The following example enables FIB policy for IPv4 in the default VRF, using the route map, map1.

Switch(config)# router general
Switch(config-router-general)# vrf default
Switch(config-router-general-vrf-default)# rib ipv4 fib policy map1

show arp

The show arp command displays all ARP tables. This command differs from the show ip arp command in that it shows MAC bindings for all protocols, whereas show ip arp only displays MAC address – IP address bindings. Addresses are displayed as their host name by including the resolve argument.

Command Mode

EXEC

Command Syntax

show arp [VRF_INST][FORMAT][HOST_ADD][HOST_NAME][INTF][MAC_ADDR][DATA]

Parameters

The VRF_INST and FORMAT parameters are always listed first and second. The DATA parameter is always listed last. All other parameters can be placed in any order.

VRF_INST Specifies the VRF instance for which data is displayed.
- no parameter Context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
FORMAT Displays format of host address. Options include:
- no parameter Entries associate hardware address with an IPv4 address.
- resolve Enter associate hardware address with a host name (if it exists).
HOST_ADD IPv4 address by which routing table entries are filtered. Options include:
- no parameter Routing table entries are not filtered by host address.
- ipv4_addr Table entries matching specified IPv4 address.
HOST_NAME Host name by which routing table entries are filtered. Options include:
- no parameter Routing table entries are not filtered by host name.
- host hostname Entries matching hostname (text).
INTF Interfaces for which command displays status.
- no parameter Routing table entries are not filtered by interface.
- interface ethernet e_num Routed Ethernet interface specified by e_num.
- interface loopback l_num Routed loopback interface specified by l_num.
- interface management m_num Routed management interface specified by m_num.
- interface port-channel p_num Routed port channel Interface specified by p_num.
- interface vlan v_num VLAN interface specified by v_num.
- interface VXLAN vx_num VXLAN interface specified by vx_num.
MAC_ADDR MAC address by which routing table entries are filtered. Options include:
- no parameter Routing table entries are not filtered by interface MAC address.
- mac_address mac_address Entries matching mac_address (dotted hex notation – H.H.H).
DATA Detail of information provided by command. Options include:
- no parameter Routing table entries.
- summary Summary of ARP table entries.
- summary total Number of ARP table entries.

Related Commands

The cli vrf command specifies the context-active VRF.

Example

This command displays the ARP table.

switch> show arp
Address         Age (min)  Hardware Addr   Interface
172.22.30.1             0  001c.730b.1d15  Management1
172.22.30.133           0  001c.7304.3906  Management1
switch>

show dhcp server

Use the show dhcp server command to display DHCP server information.

Command Mode

EXEC

Command Syntax

show dhcp server [ ipv4|ipv6 |leases|vrf]

Parameters

ipv4 - Displays details related to IPv4.
ipv6 - Displays details related to IPv6.
leases- - Displays active leases.
- A.B.C.D/E - Displays IPv4 lease details.
- A:B:C:D:E:F:G:H/I Displays IPv6 lease details.
- NAME Displays the lease name.

Examples

Display DHCPv4 information.

switch# show dhcp server ipv4
IPv4 DHCP Server is active
Debug log is enabled
DNS server(s): 10.2.2.2
DNS domain name: domainFoo
Lease duration: 1 days 0 hours 0 minutes
TFTP server:
serverFoo (Option 66)
10.0.0.3 (Option 150)
TFTP file: fileFoo
Active Leases: 1
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Inactive (Could not determine VRF)
   Ethernet2   Inactive (Not in default VRF)
   Ethernet3   Inactive (Kernel interface not created yet)
   Ethernet4   Inactive (Not up)
   Ethernet5   Inactive (No IP address)
   Ethernet6   Active

Vendor information:
Vendor ID: default
  Sub-options         Data       
---------------- ----------------
      1          192.0.2.0, 192.0.2.1

Vendor ID: vendorFoo
  Sub-options       Data       
---------------- -----------
      2            192.0.2.2
      3            “Foo”

Subnet: 10.0.0.0/8
Subnet name: subnetFoo
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.1.1.1 10.2.2.2
Lease duration: 3 days 3 hours 3 minutes
Default gateway address: 10.0.0.3
TFTP server:
subnetServerFoo (Option 66)
10.0.0.4 (Option 150)
TFTP boot file: subnetFileFoo
Active leases: 1
Reservations:
MAC address: 1a1b.1c1d.1e1f
IPv4 address: 10.0.0.1

MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.2

In this example, DHCPv6 is configured with subnet fe80::/10 while enabled on Ethernet1 with address fe80::1/64 and on Ethernet3 with address fe80::2/64.

switch# show dhcp server ipv6
IPv6 DHCP server is active
Debug log is enabled 
DNS server(s): fe80::6 
DNS domain name: testaristanetworks.com 
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0 
IPv6 DHCP interface status:
Interface    Status
----------   ------
Ethernet1    Active
Ethernet3    Active 
Subnet: fe80::/10 
Subnet name: foo                                    
Direct: Inactive (Multiple interfaces match this subnet: Ethernet1 Ethernet3)
Relay: Active
Active leases: 0

This example illustrates when multiple subnets match an interface. In this example, DHCPv6 is configured with subnets fc00::/7 and fe80::/10 while enabled on Ethernet1 with address fe80::1/10 and fc00::1/7.

switch# show dhcp server ipv6
IPv6 DHCP server is active
DNS server(s):  fc00::2
DNS domain name: testaristanetworks.com 
Lease duration: 1 days 3 hours 30 minutes
Active leases: 0 
IPv6 DHCP interface status: 
Interface    Status   
-----------  ------   
Ethernet1    Active 
Subnet: fc00::/7  
Subnet name: foo 
Range: fc00::1 to fc00::5  
DNS server(s): fc00::6 fc00::8 
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active 

Active leases: 0  
Subnet name: bar
Direct: Inactive (This and other subnets match interface Ethernet1)
Relay: Active 
Active leases: 0

When a subnet is disabled, the show dhcp server command displays the disable message with a reason. The number of active leases of the disabled subnets are 0. In this example, there are overlapping subnets.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------  ---------
   Ethernet1   Active

Subnet: 10.0.0.0/24 (Subnet is disabled - overlapping subnet 10.0.0.0/8)
Range: 10.0.0.1 to 10.0.0.10
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

Subnet: 10.0.0.0/8 (Subnet is disabled - overlapping subnet 10.0.0.0/24)
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0

In this example, the display output shows overlapping ranges.

switch# show dhcp server
IPv4 DHCP Server is active
DNS server(s): 10.2.2.2
Lease duration: 1 days 0 hours 0 minutes
Active Leases: 0
IPv4 DHCP interface status:
   Interface   Status
-------------------------------------------------
   Ethernet1   Active

Subnet: 10.0.0.0/8 (Subnet is disabled - range 10.0.0.9-10.0.0.12 overlaps with an existing pool)
Range: 10.0.0.1 to 10.0.0.10
Range: 10.0.0.9 to 10.0.0.12
DNS server(s): 10.3.3.3 10.4.4.4
Default gateway address: 10.0.0.4
Active leases: 0

This example displays duplicate static IP address reservation.

Subnet: 10.0.0.0/8 (Subnet is disabled - ipv4-address 10.0.0.11 is reserved more than once)
Subnet name:
DNS server(s):
Default gateway address: 10.0.0.3
Active leases: 0
Reservations:
MAC address: 1a1b.1c1d.1e1f    
IPv4 address: 10.0.0.11
MAC address: 2a2b.2c2d.2e2f    
IPv4 address: 10.0.0.11

Use the show dhcp server leases command to display detailed information about the IP addresses allocated by the DHCP Server including the IP address, the expected end time for that address, the time when the address is handed out, and the equivalent MAC address.
```
switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a
2000:0:0:40::b  
End: 2019/06/20 18:06:33 UTC 
Last transaction: 2019/06/20 14:36:33 UTC
MAC address: 165a.a86d.ffac
```

show dhcp server leases

Use the show dhcp server leases command to display DHCP server lease information.

Command Mode

EXEC

Command Syntax

show dhcp server leases [ ipv4 | ipv6

Parameters

ipv4 Displays details related to IPv4.
ipv6 Displays details related to IPv6.
leases Displays active leases.

Example

Use the show dhcp server leases command to display detailed information about the IP addresses allocated by the DHCP Server including the IP address, the expected end time for that address, the time when assigning the address, and the equivalent MAC address.

switch# show dhcp server leases
10.0.0.10
End: 2019/06/20 17:44:34 UTC
Last transaction: 2019/06/19 17:44:34 UTC
MAC address: 5692.4c67.460a

2000:0:0:40::b                                                                                                                                                                                                                                 
End: 2019/06/20 18:06:33 UTC                                                                                                                                                                                                                   
Last transaction: 2019/06/20 14:36:33 UTC                                                                                                                                                                                                      
MAC address: 165a.a86d.ffac

show hardware capacity

The show hardware capacity command displays the utilization of the hardware resources:

Command Mode

Privileged EXEC

Command Syntax

show hardware capacity

Example

The following command is used to show the utilization of the hardware resources:

switch# show hardware capacity
Forwarding Resources Usage

Table    Feature         Chip      Used	Used      Free	Committed    Best Case    High
                                   Entries   (%)	 Entries    Entries      Max          Watermark
                                                                                             Entries
------- --------------- ---------- ---------- --------- ---------- ------------ ------------ ---------
ECMP                                0  	 0%        4095       0     	4095          0
ECMP      Mpls                      0  	 0%        4095       0     	4095          0
ECMP      Routing                   0  	 0%        4095       0     	4095          0
ECMP      VXLANOverlay              0  	 0%        4095       0     	4095          0
ECMP      VXLANTunnel               0  	 0%        3891       0     	3891          0

show interface tunnel

The show interface tunnel command displays the interface tunnel information.

Command Mode

EXEC

Command Syntax

show interface tunnel number

Parameter

number Specifies the tunnel interface number.

Example

This command displays tunnel interface configuration information for tunnel interface 10.

switch# show interface tunnel 10

Tunnel10 is up, line protocol is up (connected)
 Hardware is Tunnel, address is 0a01.0101.0800
 Internet address is 192.168.1.1/24
 Broadcast address is 255.255.255.255
 Tunnel source 10.1.1.1, destination 10.1.1.2
 Tunnel protocol/transport GRE/IP
   Key disabled, sequencing disabled
   Checksumming of packets disabled
 Tunnel TTL 10, Hardware forwarding enabled
 Tunnel TOS 10
 Path MTU Discovery
 Tunnel transport MTU 1476 bytes
 Up 3 seconds

show ip

The show ip command displays IPv4 routing, IPv6 routing, IPv4 multicast routing, and VRRP status on the switch.

Command Mode

EXEC

Command Syntax

show ip

Example

This command displays IPv4 routing status.

switch> show ip

IP Routing : Enabled
IP Multicast Routing : Disabled
VRRP: Configured on 0 interfaces

IPv6 Unicast Routing : Enabled
IPv6 ECMP Route support : False
IPv6 ECMP Route nexthop index: 5
IPv6 ECMP Route num prefix bits for nexthop index: 10

switch>

show ip arp

The show ip arp command displays ARP cache entries that map an IPv4 address to a corresponding MAC address. The table displays addresses by the host names when the command includes the resolve argument.

Command Mode

EXEC

Command Syntax

show ip arp [VRF_INST][FORMAT][HOST_ADD][HOST_NAME][INTF][MAC_ADDR][DATA]

Parameters

The VRF_INST and FORMAT parameters list first and second. The DATA parameter lists last. All other parameters can be placed in any order.

VRF_INST - Specifies the VRF instance to display data.
- no parameter - Specifies the Context-active VRF.
- vrf vrf_name - Specifies name of VRF instance. Specifies the system default VRF default.
FORMAT - Displays format of host address. The options include the following:
- no parameter - Displays entries associated hardware address with an IPv4 address.
- resolve -Displays the specific associated hardware address with a host name (if it exists).
HOST_ADDR -Specifies the IPv4 address to filter routing table entries. The options include the following:
- no parameter - Routing table entries not filtered by host address.
- ipv4_addr - Table entries matching specified IPv4 address.
HOST_NAME - Host name by to filter routing table entries. The options include the following:
- no parameter - Routing table entries not filtered by host name.
- host hostname - Entries with matching hostname (text).
INTERFACE_NAME - Interfaces to display status.
- no parameter - Routing table entries not filtered by interface.
- interface ethernet e_num - Routed Ethernet interface specified by e_num.
- interface loopback l_num - Routed loopback interface specified by l_num.
- interface management m_num - Routed management interface specified by m_num.
- interface port-channel p_num - Routed port channel Interface specified by p_num.
- interface vlan v_num - VLAN interface specified by v_num.
- interface VXLAN vx_num - VXLAN interface specified by vx_num.
MAC_ADDR - MAC address to filter routing table entries. The options include the following:
- no parameter - Routing table entries not filtered by interface MAC address.
- mac_address mac_address - Entries with matching mac_address (dotted hex notation – H.H.H).
DATA - Details of information provided by command. The options include the following:
- no parameter - Routing table entries.
- summary - Summary of ARP table entries.
- summary total - Number of ARP table entries.

Examples

This command displays ARP cache entries that map MAC addresses to IPv4 addresses.

switch> show ip arp

Address         Age (min)  Hardware Addr   Interface
172.25.0.2              0  004c.6211.021e  Vlan101, Port-Channel2
172.22.0.1              0  004c.6214.3699  Vlan1000, Port-Channel1
172.22.0.2              0  004c.6219.a0f3  Vlan1000, Port-Channel1
172.22.0.3              0  0045.4942.a32c  Vlan1000, Ethernet33
172.22.0.5              0  f012.3118.c09d  Vlan1000, Port-Channel1
172.22.0.6              0  00e1.d11a.a1eb  Vlan1000, Ethernet5
172.22.0.7              0  004f.e320.cd23  Vlan1000, Ethernet6
172.22.0.8              0  0032.48da.f9d9  Vlan1000, Ethernet37
172.22.0.9              0  0018.910a.1fc5  Vlan1000, Ethernet29
172.22.0.11             0  0056.cbe9.8510  Vlan1000, Ethernet26
switch>

This command displays ARP cache entries that map MAC addresses to IPv4 addresses. The ouput displays host names assigned to IP addresses in place of the address.

switch> show ip arp resolve

Address         Age (min)  Hardware Addr   Interface
green-vl101.new         0  004c.6211.021e  Vlan101, Port-Channel2
172.22.0.1              0  004c.6214.3699  Vlan1000, Port-Channel1
orange-vl1000.n         0  004c.6219.a0f3  Vlan1000, Port-Channel1
172.22.0.3              0  0045.4942.a32c  Vlan1000, Ethernet33
purple.newcompa         0  f012.3118.c09d  Vlan1000, Port-Channel1
pink.newcompany         0  00e1.d11a.a1eb  Vlan1000, Ethernet5
yellow.newcompa         0  004f.e320.cd23  Vlan1000, Ethernet6
172.22.0.8              0  0032.48da.f9d9  Vlan1000, Ethernet37
royalblue.newco         0  0018.910a.1fc5  Vlan1000, Ethernet29
172.22.0.11             0  0056.cbe9.8510  Vlan1000, Ethernet26
switch>

show ip arp inspection statistics

The show ip arp inspection statistics command displays the statistics of inspected ARP packets. For a specified VLAN specified, the output displays only VLANs with ARP inspection enabled. If no VLAN specified, the output displays all VLANs with ARP inspection enabled.

Command Mode

EXEC

Command Syntax

show ip arp inspection statistics [vlan [VID]|[INTERFACE] interface intf_slot | intf_port]

Parameters

VID - Specifies the VLAN interface ID.
INTERFACE - Specifies the interface (e.g., Ethernet).
- intf_slot - Specifies the Interface slot.
- intf_port - Specifies the Interface port.
INTF - Specifies the VLAN interface slot and port.

Related Commands

ip arp inspection limit
ip arp inspection trust
ip arp inspection vlan

Examples

This command display statistics of inspected ARP packets for VLAN 10.

switch(config)# show ip arp inspection statistics vlan 10

Vlan : 10
--------------
ARP
Req Forwarded = 20
ARP Res Forwarded = 20
ARP Req Dropped = 1
ARP Res Dropped = 1
Last invalid ARP:
Time: 10:20:30 ( 5 minutes ago )
Reason: Bad IP/Mac match
Received on: Ethernet 3/1
Packet:
  Source MAC: 00:01:00:01:00:01
  Dest MAC: 00:02:00:02:00:02
  ARP Type: Request
  ARP Sender MAC: 00:01:00:01:00:01
  ARP Sender IP: 1.1.1

switch(config)#

This command displays ARP inspection statistics for Ethernet interface 3/1.

switch(config)# show ip arp inspection statistics ethernet interface 3/1
Interface : 3/1
--------
ARP Req Forwarded = 10
ARP Res Forwarded = 10
ARP Req Dropped = 1
ARP Res Dropped = 1

Last invalid ARP:
Time: 10:20:30 ( 5 minutes ago )
Reason: Bad IP/Mac match
Received on: VLAN 10
Packet:
  Source MAC: 00:01:00:01:00:01
  Dest MAC: 00:02:00:02:00:02
  ARP Type: Request
  ARP Sender MAC: 00:01:00:01:00:01
  ARP Sender IP: 1.1.1

switch(config)#

show ip arp inspection vlan

The show ip arp inspection vlan command displays the configuration and operation state of ARP inspection. For a VLAN range specified, the output displays only VLANs with ARP inspection enabled. If no VLAN specified, the output displays all VLANs with ARP inspection enabled. The operation state turns to Active when hardware becomes ready to trap ARP packets for inspection.

Command Mode

EXEC

Command Syntax

show ip arp inspection vlan [LIST]

Parameters

LIST - Specifies the VLAN interface number.

Related Commands

ip arp inspection limit
ip arp inspection trust
show ip arp inspection statistics

Example

This command displays the configuration and operation state of ARP inspection for VLANs 1 through 150.

switch(config)# show ip arp inspection vlan 1 - 150

VLAN 1
----------
Configuration
: Enabled
Operation State : Active
VLAN 2
----------
Configuration
: Enabled
Operation State : Active
{...}
VLAN 150
----------
Configuration
: Enabled
Operation State : Active

switch(config)#

show ip dhcp relay counters

The show ip dhcp relay counters command displays the number of DHCP packets received, forwarded, or dropped on the switch and on all interfaces enabled as DHCP relay agents.

Command Mode

EXEC

Command Syntax

show ip dhcp relay counters

Example

This command displays the IP DHCP relay counter table.

switch> show ip dhcp relay counters

          |  Dhcp Packets  |
Interface | Rcvd Fwdd Drop |         Last Cleared
----------|----- ---- -----|---------------------
  All Req |  376  376    0 | 4 days, 19:55:12 ago
 All Resp |  277  277    0 |
          |                |
 Vlan1000 |    0    0    0 | 4 days, 19:54:24 ago
 Vlan1036 |  376  277    0 | 4 days, 19:54:24 ago

switch>

show ip dhcp relay

The show ip dhcp relay command displays the DHCP relay agent configuration status on the switch.

Command Mode

EXEC

Command Syntax

show ip dhcp relay

Example

This command displays the DHCP relay agent configuration status.

switch> show ip dhcp relay
DHCP Relay is active
DHCP Relay Option 82 is disabled
DHCP Smart Relay is enabled
Interface: Vlan100
  DHCP Smart Relay is disabled
  DHCP servers: 10.4.4.4
switch>

show ip dhcp snooping counters

The show ip dhcp snooping counters command displays counters that track the quantity of DHCP request and reply packets received by the switch. The output displays data for each VLAN or aggregated for all VLANs with counters for packets dropped.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping counters [COUNTER_TYPE]

Parameters

COUNTER_TYPE-Displays the type of counter.

no parameter Command displays counters for each VLAN.
debug Command displays aggregate counters and drop cause counters.

Examples

This command displays the number of DHCP packets sent and received on each VLAN.

switch> show ip dhcp snooping counters

     | Dhcp Request Pkts | Dhcp Reply Pkts |
Vlan |  Rcvd  Fwdd  Drop | Rcvd Fwdd  Drop | Last Cleared
-----|------ ----- ------|----- ---- ------|-------------
 100 |     0     0     0 |    0    0     0 |  0:35:39 ago

switch>

This command displays the number of DHCP packets sent on the switch.

switch> show ip dhcp snooping counters debug
Counter                       Snooping to Relay Relay to Snooping
----------------------------- ----------------- -----------------
Received                                      0                 0
Forwarded                                     0                 0
Dropped - Invalid VlanId                      0                 0
Dropped - Parse error                         0                 0
Dropped - Invalid Dhcp Optype                 0                 0
Dropped - Invalid Info Option                 0                 0
Dropped - Snooping disabled                   0                 0

Last Cleared:  3:37:18 ago
switch>

show ip dhcp snooping hardware

The show ip dhcp snooping hardware command displays internal hardware DHCP snooping status on the switch.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping hardware

Example

This command DHCP snooping hardware status.

switch> show ip dhcp snooping hardware
DHCP Snooping is enabled
DHCP Snooping is enabled on following VLANs:
    None
    Vlans enabled per Slice
        Slice:  FixedSystem
        None
switch>

show ip dhcp snooping

The show ip dhcp snooping command displays the DHCP snooping configuration.

Command Mode

EXEC

Command Syntax

show ip dhcp snooping

Example

This command displays the switch’s DHCP snooping configuration.

switch> show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
  100
DHCP Snooping is operational on following VLANs:
  100
Insertion of Option-82 is enabled
  Circuit-id format: Interface name:Vlan ID
  Remote-id: 00:1c:73:1f:b4:38 (Switch MAC)
switch>

show ip hardware fib summary

The show ip hardware fib summary command displays the statistics of the RECMP.

Command Mode

Privileged EXEC

Command Syntax

show ip hardware fib summary

Example

The following command is used to show the statistics of RECMP:

switch# show ip hardware fib summary
Fib summary
-----------
Adjacency sharing: disabled
BFD peer event: enabled
Deletion Delay: 0
Protect default route: disabled
PBR: supported
URPF: supported
ICMP unreachable: enabled
Max Ale ECMP: 600
UCMP weight deviation: 0.0
Maximum number of routes: 0
Fib compression: disabled
Resource optimization for adjacency programming: enabled
Adjacency resource optimization thresholds: low 20, high 80

About the Output

The last two lines of the output shows whether the feature is enabled and what are the corresponding threshold values for starting and stopping the optimization process.

show ip interface

The show ip interface command displays the status of specified interfaces that are configured as routed ports. The command provides the following information:

Interface description
Internet address
Broadcast address
Address configuration method
Proxy-ARP status
MTU size

Command Mode

EXEC

Command Syntax

show ip interface [INTERFACE_NAME][VRF_INST]

Parameters

INTERFACE_NAME Interfaces for which command displays status.
- no parameter All routed interfaces.
- ipv4_addr Neighbor IPv4 address.
- ethernet e_range Routed Ethernet interfaces specified by e_range.
- loopback l_range Routed loopback interfaces specified by l_range.
- management m_range Routed management interfaces specified by m_range.
- port-channel p_range Routed port channel Interfaces specified by p_range.
- vlan v_range VLAN interfaces specified by v_range.
- VXLAN vx_range VXLAN interfaces specified by vx_range.
VRF_INST Specifies the VRF instance for which data is displayed.
- no parameter Context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Examples

This command displays IP status of configured VLAN interfaces numbered between 900 and 910.

switch> show ip interface vlan 900-910
! Some interfaces do not exist
Vlan901 is up, line protocol is up (connected)
  Description: ar.pqt.mlag.peer
  Internet address is 170.23.254.1/30
  Broadcast address is 255.255.255.255
  Address determined by manual configuration
  Proxy-ARP is disabled
  MTU 9212 bytes
Vlan903 is up, line protocol is up (connected)
  Description: ar.pqt.rn.170.23.254.16/29
  Internet address is 170.23.254.19/29
  Broadcast address is 255.255.255.255
  Address determined by manual configuration
  Proxy-ARP is disabled
  MTU 9212 bytes

This command displays the configured TCP Maximum Segment Size (MSS) ceiling value of 1436 bytes for an Ethernet interface 25.

switch> show ip interface ethernet 25
Ethernet25 is up, line protocol is up (connected)
  Internet address is 10.1.1.1/24
  Broadcast address is 255.255.255.255
  IPv6 Interface Forwarding : None
  Proxy-ARP is disabled
  Local Proxy-ARP is disabled
  Gratuitous ARP is ignored
  IP MTU 1500 bytes
  IPv4 TCP MSS egress ceiling is 1436 bytes

show ip interface brief

Use the show ip interface brief command output to display the status summary of the specified interfaces that are configured as routed ports. The command provides the following information for each specified interface:

IP address
Operational status
Line protocol status
MTU size

Command Mode

EXEC

Command Syntax

show ip interface [INTERFACE_NAME][VRF_INST] brief

Parameters

INTERFACE_NAME Interfaces for which command displays status.
- no parameter All routed interfaces.
- ipv4_addr Neighbor IPv4 address.
- ethernet e_range Routed Ethernet interfaces specified by e_range.
- loopback l_range Routed loopback interfaces specified by l_range.
- management m_range Routed management interfaces specified by m_range.
- port-channel p_range Routed port channel Interfaces specified by p_range.
- vlan v_range VLAN interfaces specified by v_range.
- VXLAN vx_range VXLAN interface range specified by vx_range.
VRF_INST Specifies the VRF instance for which data is displayed.
- no parameter Context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Example

This command displays the summary status of VLAN interfaces 900-910.

switch> show ip interface vlan 900-910 brief

! Some interfaces do not exist
Interface              IP Address         Status     Protocol         MTU
Vlan901                170.33.254.1/30    up         up              9212
Vlan902                170.33.254.14/29   up         up              9212
Vlan905                170.33.254.17/29   up         up              1500
Vlan907                170.33.254.67/29   up         up              9212
Vlan910                170.33.254.30/30   up         up              9212

show ip route

The show ip route command displays routing table entries that are in the Forwarding Information Base (FIB), including static routes, routes to directly connected networks, and dynamically learned routes. Multiple equal-cost paths to the same prefix are displayed contiguously as a block, with the destination prefix displayed only on the first line.

The show running-config command displays configured commands not in the FIB.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE][ADDRESS][ROUTE_TYPE][INFO_LEVEL][PREFIX]

Parameters

The VRF_INSTANCE and ADDRESS parameters are always listed first and second, respectively. All other parameters can be placed in any order.

VRF_INSTANCE Specifies the VRF instance for which data is displayed.
- no parameter Context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
ADDRESS Filters routes by IPv4 address or subnet.
- no parameter All routing table entries.
- ipv4_addr Routing table entries matching specified address.
- ipv4_subnet Routing table entries matching specified subnet (CIDR or address-mask).
ROUTE_TYPE Filters routes by specified protocol or origin. Options include:
- no parameter All routing table entries.
- aggregate Entries for BGP aggregate routes.
- bgp Entries added through BGP protocol.
- connected Entries for routes to networks directly connected to the switch.
- isis Entries added through ISIS protocol.
- kernel Entries appearing in Linux kernel but not added by EOS software.
- ospf Entries added through OSPF protocol.
- rip Entries added through RIP protocol.
- static Entries added through CLI commands.
- vrf Displays routes in a VRF.
INFO_LEVEL Filters entries by next hop connection. Options include:
- no parameter Filters routes whose next hops are directly connected.
- detail Displays all routes.
PREFIX Filters routes by prefix.
- no parameter Specific route entry that matches the ADDRESS parameter.
- longer-prefixes All subnet route entries in range specified by ADDRESS parameter.

Related Command

The cli vrf command specifies the context-active VRF.

Examples

This command displays IPv4 routes learned through BGP.

switch> show ip route bgp
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, A - Aggregate

 B E    170.44.48.0/23 [20/0] via 170.44.254.78
 B E    170.44.50.0/23 [20/0] via 170.44.254.78
 B E    170.44.52.0/23 [20/0] via 170.44.254.78
 B E    170.44.54.0/23 [20/0] via 170.44.254.78
 B E    170.44.254.112/30 [20/0] via 170.44.254.78
 B E    170.53.0.34/32 [1/0] via 170.44.254.78
 B I    170.53.0.35/32 [1/0] via 170.44.254.2
                             via 170.44.254.13
                             via 170.44.254.20
                             via 170.44.254.67
                             via 170.44.254.35
                             via 170.44.254.98

This command displays the unicast IP routes installed in the system.

switch# show ip route
 VRF name: default
Codes: C - connected, S - static, K - kernel,
 O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
 E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
 N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
 R - RIP, I - ISIS, A B - BGP Aggregate, A O - OSPF Summary,
 NG - Nexthop Group Static Route

Gateway of last resort is not set
 C 10.1.0.0/16 is directly connected, Vlan2659
 C 10.2.0.0/16 is directly connected, Vlan2148
 C 10.3.0.0/16 is directly connected, Vlan2700
 S 172.17.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.18.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.19.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.20.0.0/16 [1/0] via 172.24.0.1, Management1
 S 172.22.0.0/16 [1/0] via 172.24.0.1, Management1
 C 172.24.0.0/18 is directly connected, Management1

This command displays the leaked routes from a source VRF.

switch# show ip route vrf VRF2 20.0.0.0/8
...
S L      20.0.0.0/8 [1/0] (source VRF VRF1) via 10.1.2.10, Ethernet1

This example displays an IPv4 route with Forwarding Equivalency Class (FEC) with an IPv4 next hop and an IPv6 next hop route.

switch# show ip route 10.1.0.0/23
   VRF: default
   Source Codes:
   C - connected, S - static, K - kernel,
   O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
   E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
   N2 - OSPF NSSA external type2, B - Other BGP Routes,
   B I - iBGP, B E - eBGP, R - RIP, I L1 - IS-IS level 1,
   I L2 - IS-IS level 2, O3 - OSPFv3, A B - BGP Aggregate,
   A O - OSPF Summary, NG - Nexthop Group Static Route,
   V - VXLAN Control Service, M - Martian,
   DH - DHCP client installed default route,
   DP - Dynamic Policy Route, L - VRF Leaked,
   G  - gRIBI, RC - Route Cache Route,
   CL - CBF Leaked Route
                    
S       10.1.0.0/23 [1/0]
                    via 2000:0:0:43::2, Ethernet2
                    via 10.0.1.2, Ethernet4

show ip route age

The show ip route age command displays the time when the route for the specified network was present in the routing table. It does not account for the changes in parameters like metric, next-hop etc.

Command Mode

EXEC

Command Syntax

show ip route ADDRESS age

Parameters

ADDRESS Filters routes by IPv4 address or subnet.

ipv4_addr Routing table entries matching specified address.
ipv4_subnet Routing table entries matching specified subnet (CIDR or address-mask).

Example

This command shows the amount of time since the last update to ip route 172.17.0.0/20.

switch> show ip route 172.17.0.0/20 age
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I - ISIS, A - Aggregate

 B E    172.17.0.0/20 via 172.25.0.1, age 3d01h
switch>

show ip route gateway

The show ip route gateway command displays IP addresses of all gateways (next hops) used by active routes.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] gateway

Parameters

VRF_INSTANCE Specifies the VRF instance for which data is displayed.

no parameter Context-active VRF.
vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Related Commands

The cli vrf command specifies the context-active VRF.

Example

This command displays next hops used by active routes.

switch> show ip route gateway
The following gateways are in use:
   172.25.0.1 Vlan101
   172.17.253.2 Vlan3000
   172.17.254.2 Vlan3901
   172.17.254.11 Vlan3902
   172.17.254.13 Vlan3902
   172.17.254.17 Vlan3903
   172.17.254.20 Vlan3903
   172.17.254.66 Vlan3908
   172.17.254.67 Vlan3908
   172.17.254.68 Vlan3908
   172.17.254.29 Vlan3910
   172.17.254.33 Vlan3911
   172.17.254.35 Vlan3911
   172.17.254.105 Vlan3912
   172.17.254.86 Vlan3984
   172.17.254.98 Vlan3992
   172.17.254.99 Vlan3992
switch>

show ip route host

The show ip route host command displays all host routes in the host forwarding table. Host routes are those whose destination prefix is the entire address (mask = 255.255.255.255 or prefix = /32). Each entry includes a code of the route’s purpose:

F static routes from the FIB.
R routes defined because the IP address is an interface address.
B broadcast address.
A routes to any neighboring host for which the switch has an ARP entry.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] host

Parameters

VRF_INSTANCE Specifies the VRF instance for which data is displayed.

no parameter Context-active VRF.
vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Related Commands

The cli vrf command specifies the context-active VRF.

Example

This command displays all host routes in the host forwarding table.

switch> show ip route host
R - receive B - broadcast F - FIB, A - attached

F   127.0.0.1 to cpu
B   172.17.252.0 to cpu
A   172.17.253.2 on Vlan2000
R   172.17.253.3 to cpu
A   172.17.253.10 on Vlan2000
B   172.17.253.255 to cpu
B   172.17.254.0 to cpu
R   172.17.254.1 to cpu
B   172.17.254.3 to cpu
B   172.17.254.8 to cpu
A   172.17.254.11 on Vlan2902
R   172.17.254.12 to cpu

F   172.26.0.28 via 172.17.254.20 on Vlan3003
                via 172.17.254.67 on Vlan3008
                via 172.17.254.98 on Vlan3492
                via 172.17.254.2 on Vlan3601
                via 172.17.254.13 on Vlan3602
via 172.17.253.2 on Vlan3000
F   172.26.0.29 via 172.25.0.1 on Vlan101
F   172.26.0.30 via 172.17.254.29 on Vlan3910
F   172.26.0.32 via 172.17.254.105 on Vlan3912
switch>

show ip route match tag

The show ip route match tag command displays the route tag assigned to the specified IPv4 address or subnet. Route tags are added to static routes for use by route maps.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] ADDRESS match tag

Parameters

VRF_INSTANCE Specifies the VRF instance for which data is displayed.
- no parameter Context-active VRF.
- vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.
ADDRESS Displays routes of specified IPv4 address or subnet.
- ipv4_addr Routing table entries matching specified IPv4 address.
- ipv4_subnet Routing table entries matching specified IPv4 subnet (CIDR or address-mask).

Example

This command displays the route tag for the specified subnet.

switch> show ip route 172.17.50.0/23 match tag
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian

 O E2   172.17.50.0/23 tag 0

switch>

show ip route summary

The show ip route summary command displays the number of routes, categorized by destination prefix, in the routing table.

Command Mode

EXEC

Command Syntax

show ip route [VRF_INSTANCE] summary

Parameters

VRF_INSTANCE Specifies the VRF instance for which data is displayed.

no parameter Context-active VRF.
vrf vrf_name Specifies name of VRF instance. System default VRF is specified by default.

Example

This command displays a summary of the routing table contents.

switch> show ip route summary
Route Source         Number Of Routes
-------------------------------------
connected                   15
static                       0
ospf                        74
  Intra-area: 32 Inter-area:33 External-1:0 External-2:9
  NSSA External-1:0 NSSA External-2:0
bgp                          7
  External: 6 Internal: 1
internal                    45
attached                    18
aggregate                    0
switch>

show ip verify source

The show ip verify source command displays the IP source guard (IPSG) configuration, operational states, and IP-MAC binding entries for the configuration mode interface.

Command Mode

EXEC

Command Syntax

show ip verify source [VLAN | DETAIL]

Parameters

VLAN Displays all VLANs configured in no ip verify source vlan.
DETAIL Displays all source IP-MAC binding entries configured for IPSG.

Related Commands

ip source binding
ip verify source

Examples

This command verifies the IPSG configuration and operational states.

switch(config)# show ip verify source
Interface       Operational State
--------------- ------------------------
Ethernet1       IP source guard enabled
Ethernet2       IP source guard disabled

This command displays all VLANs configured in no ip verify source vlan. Hardware programming errors, e.g.,VLAN classification failed, are indicated in the operational state. If an error occurs, this VLAN will be considered as enabled for IPSG. Traffic on this VLAN will still be filtered by IPSG.
```
switch(config)# show ip verify source vlan
IPSG disabled on VLANS: 1-2
VLAN            Operational State
--------------- ------------------------
1               IP source guard disabled
2               Error: vlan classification failed
```
This command displays all source IP-MAC binding entries configured for IPSG. A source binding entry is considered active if it is programmed in hardware. IP traffic matching any active binding entry will be permitted. If a source binding entry is configured on an interface or a VLAN whose operational state is IPSG disabled, this entry will not be installed in the hardware, in which case an “IP source guard disabled” state will be shown. If a port channel has no member port configured, binding entries configured for this port channel will not be installed in hardware, and a “Port-Channel down” state will be shown.
```
switch(config)#show ip verify source detail
Interface      IP Address  MAC Address     VLAN  State
-------------- ----------- --------------- ----- ------------------------
Ethernet1      10.1.1.1    0000.aaaa.1111   5     active
Ethernet1      10.1.1.5    0000.aaaa.5555   1     IP source guard disabled
Port-Channel1  20.1.1.1    0000.bbbb.1111   4     Port-Channel down
```

show platform arad ip route summary

The show platform arad ip route summary command shows hardware resource usage of IPv4 routes.

Command Mode

EXEC

Command Syntax

show platform arad ip route summary

Related Commands

The agent SandL3Unicast terminate command enables restarting the layer 3 agent to ensure IPv4 routes are optimized.
The ip hardware fib optimize command enables IPv4 route scale.
The show platform arad ip route command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.

Example

This command shows hardware resource usage of IPv4 routes.

switch(config)# show platform arad ip route summary
Total number of VRFs: 1
Total number of routes: 25
Total number of route-paths: 21
Total number of lem-routes: 4

switch(config)#

show platform arad ip route

The show platform arad ip route command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.

Command Mode

EXEC

Command Syntax

show platform arad ip route

Related Commands

The agent SandL3Unicast terminate command enables restarting the Layer 3 agent to ensure IPv4 routes are optimized.
The ip hardware fib optimize command enables IPv4 route scale.
The show platform arad ip route summary command shows hardware resource usage of IPv4 routes.

Examples

This command displays the platform unicast forwarding routes. In this example, the ACL label field in the following table is 4094 by default for all routes. If an IPv4 egress RACL is applied to an SVI, all routes corresponding to that VLAN will have an ACL label value. In this case, the ACL Label field value is 2.

switch# show platform arad ip route
 Tunnel Type: M(mpls), G(gre)
 
-------------------------------------------------------------------------------
|                                Routing Table                                |               
|
|------------------------------------------------------------------------------
|VRF|   Destination    |      |                    |     | Acl   |             | 
ECMP| FEC | Tunnel
| ID|   Subnet         | Cmd  |       Destination  | VID | Label |  MAC / CPU 
Code |Index|Index|T Value
 
-------------------------------------------------------------------------------
|0  |0.0.0.0/8         |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1031 | -
|0  |10.1.0.0/16       |TRAP | CoppSystemL3DstMiss|2659 | - | ArpTrap | - |1030 | -
|0  |10.2.0.0/16       |TRAP | CoppSystemL3DstMiss|2148 | - | ArpTrap | - |1026 | -
|0  |172.24.0.0/18     |TRAP | CoppSystemL3DstMiss|0    | - | ArpTrap | - |1032 | -
|0  |0.0.0.0/0         |TRAP | CoppSystemL3LpmOver|0    | - | SlowReceive | - 
|1024 | -
|0  |10.1.0.0/32*      |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.1.0.1/32*      |TRAP | CoppSystemIpUcast  |0    | - | Receive | - |32766| -
|0  |10.1.255.1/32*    |ROUTE| Po1                |2659 |4094 | 00:1f:5d:6b:ce:45 
| - |1035 | -
|0  |10.1.255.255/32*  |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.3.0.0/32*      |TRAP | CoppSystemIpBcast  |0    | - | BcastReceive | - 
|1027 | -
|0  |10.3.0.1/32*      |TRAP | CoppSystemIpUcast  |0    | - | Receive | - |32766| -
|0  |10.3.255.1/32*    |ROUTE| Et18               |2700 |2 | 00:1f:5d:6b:00:01 
| - |1038 | -
...........................................................

This command shows resources for all IPv4 routes in hardware. Routes that use the additional hardware resources will appear with an asterisk.

switch(config)# show platform arad ip route
Tunnel Type: M(mpls), G(gre)
* - Routes in LEM
 
-------------------------------------------------------------------------------
|                              Routing Table                     |             |
|------------------------------------------------------------------------------
|VRF|  Destination |     |                   |    |Acl  |                 |ECMP 
| FEC | Tunnel
|ID |    Subnet    | Cmd |    Destination    |VID |Label| MAC / CPU Code  
|Index|Index|T Value
 
-------------------------------------------------------------------------------
|0  |0.0.0.0/8       |TRAP |CoppSystemL3DstMiss|0   | -   |ArpTrap          |  -  
|1030 |   -   
|0  |100.1.0.0/32    |TRAP |CoppSystemIpBcast  |0   | -   |BcastReceive     |  -  
|1032 |   -   
|0  |100.1.0.0/32    |TRAP |CoppSystemIpUcast  |0   | -   |Receive          |  -  
|32766|   -   
|0  |100.1.255.255/32|TRAP |CoppSystemIpBcast  |0   | -   |BcastReceive     |  -  
|1032 |   -   
|0  |200.1.255.255/32|TRAP |CoppSystemIpBcast  |0   | -   |BcastReceive     |  -  
|1032 |   -   
|0  |200.1.0.0/16    |TRAP |CoppSystemL3DstMiss|1007| -   |ArpTrap          |  -  
|1029 |   -   
|0  |0.0.0.0/0       |TRAP |CoppSystemL3LpmOver|0   | -   |SlowReceive      |  -  
|1024 |   -   
|0  |4.4.4.0/24*     |ROUTE|Et10               |1007| -   |00:01:00:02:00:03|  -  
|1033 |   -   
|0  |10.20.30.0/24*  |ROUTE|Et9                |1006| -   |00:01:00:02:00:03|  -  
|1027 |   -

switch(config)#

show platform barefoot bfrt

The show platform barefoot bfrt command displays information about the current BfRuntime server configuration.

Command Mode

EXEC

Command Syntax

show platform barefoot bfrt

Parameters

no parameter state of the system.

Example

The following output is for a system where the BfRuntime server has been configured.

(switch)# show platform barefoot bfrt
Namespace: management                    
FixedSystem:0.0.0.0:50052

show platform fap eedb ip-tunnel gre interface tunnel

The show platform fap eedb ip-tunnel gre interface tunnel command verifies the tunnel encapsulation programming for the tunnel interface.

Command Mode

EXEC

Command Syntax

show platform fap eedb ip-tunnel gre interface tunnel number

Parameter

number Specifies the tunnel interface number.

Example

These commands verify the tunnel encapsulation programming for the tunnel interface 10.

switch# show platform fap eedb ip-tunnel gre interface tunnel 10
----------------------------------------------------------------------------
|                                                  Jericho0                   |
|                                 GRE Tunnel Egress Encapsulation DB                               
|
|--------------------------------------------------------------------------|
| Bank/ | OutLIF | Next   | VSI  | Encap | TOS  | TTL | Source | Destination| 
OamLIF| OutLIF | Drop|
| Offset|        | OutLIF | LSB  | Mode  |      |     | IP     | IP         | Set   
| Profile|     |
|--------------------------------------------------------------------------|
| 3/0   | 0x6000 | 0x4010 | 0    | 2     | 10   | 10  | 10.1.1.1 | 10.1.1.2 | No    
| 0      | No  |

switch# 
show platform fap eedb ip-tunnel
-------------------------------------------------------------------------------
|                                                  Jericho0                     |
|                                     IP Tunnel Egress Encapsulation DB                         
|
|------------------------------------------------------------------------------
| Bank/ | OutLIF | Next   | VSI | Encap| TOS | TTL | Src | Destination | OamLIF 
| OutLIF  | Drop|
| Offset|        | OutLIF | LSB | Mode | Idx | Idx | Idx | IP          | Set    | 
Profile |     |
|------------------------------------------------------------------------------
| 3/0   | 0x6000 | 0x4010 | 0   | 2    | 9   | 0   | 0   | 10.1.1.2    | No     | 
0       | No  |

show platform fap tcam summary

The show platform fap tcam summary command displays information about the TCAM bank that is allocated for GRE packet termination lookup.

Command Mode

EXEC

Command Syntax

show platform fap tcam summary

Example

This command verifies if the TCAM bank is allocated for GRE packet termination lookup.

switch# show platform fap tcam summary

Tcam Allocation (Jericho0)
Bank        Used By                Reserved By
---------- ----------------------- -----------
0           dbGreTunnel             -

show platform trident forwarding-table partition

The show platform trident forwarding-table partition command displays the size of the L2 MAC entry tables, L3 IP forwarding tables, and Longest Prefix Match (LPM) routes.

Command Mode

Privileged EXEC

Command Syntax

show platform trident forwarding-table partition

show platform trident forwarding-table partition flexible

Examples

The show platform trident forwarding-table partition command shows the Trident forwarding table information.

switch(config)# show platform trident forwarding-table partition
L2 Table Size: 96k
L3 Host Table Size: 208k
LPM Table Size: 16k
switch(config)#

The show platform trident forwarding-table partition flexible shows the banks allocated for ALPM as well.

switch(config)# show platform trident forwarding-table partition flexible
--------------------------------------------------
Minimum L2 entries             = 32768
Minimum L3 entries             = 16384
Maximum L2 entries             = 262144
Maximum L3 entries             = 262144
Maximum Exact Match entries    = 131072
L2 entries per bucket          = 4
L3 entries per bucket          = 4
Exact Match entries per bucket = 2
Maximum entries per bucket     = 4
Maximum shared buckets         = 65536
Maximum entries per bank       = 32768
Maximum shared banks           = 8
ALPM entries per bank          = 46080
ALPM                           = Enabled
--------------------
# UFT bank details #
--------------------
S - Shared UFT bank, D - Dedicated UFT bank
+-------------+------------+------+------------+--------------+
| Physical ID |  Feature   | Type | Logical ID | Hash Offset  |
+-------------+------------+------+------------+--------------+
|      0      |     L2     |  D   |     0      |     0x4      |
|      1      |     L2     |  D   |     1      |     0xe      |
|      2      |    ALPM    |  S   |    N/A     |      0       |
|      3      |    ALPM    |  S   |    N/A     |      0       |
|      4      |    ALPM    |  S   |    N/A     |      0       |
|      5      |    ALPM    |  S   |    N/A     |      0       |
|      6      |     L2     |  S   |     2      |     0xc      |
|      7      | ExactMatch |  S   |     0      |     0xc      |
|      8      | ExactMatch |  S   |     1      |     0xf      |
|      9      |     L3     |  S   |     2      |     0xc      |
|      10     |     L3     |  D   |     0      |     0x0      |
|      11     |     L3     |  D   |     1      |     0x8      |
+-------------+------------+------+------------+--------------+

show rib route ip

The show rib route ip command displays a list of IPv4 Routing Information Base (RIB) routes.

Command Mode

EXEC

Command Syntax

show rib route ip [vrf vrf_name][PREFIX][ROUTE TYPE]

Parameters

vrf vrf_name Displays RIB routes from the specified VRF.
PREFIX dDisplays routes filtered by the specified IPv4 information. Options include:
- ip_address Displays RIB routes filtered by the specified IPv4 address.
- ip_subnet_mask Displays RIB routes filtered by the specified IPv4 address and subnet mask.
- ip_prefix Displays RIB routes filtered by the specified IPv4 prefix.
ROUTE TYPE Displays routes filtered by the specified route type. Options include:
- bgp Displays RIB routes filtered by BGP.
- connected Displays RIB routes filtered by connected routes.
- dynamicPolicy Displays RIB routes filtered by dynamic policy routes.
- host Displays RIB routes filtered by host routes.
- isis Displays RIB routes filtered by ISIS routes.
- ospf Displays RIB routes filtered by OSPF routes.
- ospf3 Displays RIB routes filtered by OSPF3 routes.
- reserved Displays RIB routes filtered by reserved routes.
- route-input Displays RIB routes filtered by route-input routes.
- static Displays RIB routes filtered by static routes.
- vrf Displays routes in a VRF.
- vrf-leak Displays leaked routes in a VRF.

Examples

This command displays IPv4 RIB static routes.

switch# show rib route ip static
VRF name: default, VRF ID: 0xfe, Protocol: static
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
>S    10.80.0.0/12 [1/0]
         via 172.30.149.129 [0/1]
            via Management1, directly connected
>S    172.16.0.0/12 [1/0]
         via 172.30.149.129 [0/1]
            via Management1, directly connected
switch#

This command displays IPv4 RIB connected routes.

switch# show rib route ip connected
VRF name: default, VRF ID: 0xfe, Protocol: connected
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
>C    10.1.0.0/24 [0/1]
         via 10.1.0.102, Ethernet1
>C    10.2.0.0/24 [0/1]
         via 10.2.0.102, Ethernet2
>C    10.3.0.0/24 [0/1]
         via 10.3.0.102, Ethernet3
switch#

This command displays routes leaked through VRF leak agent.

switch# show rib route ip vrf VRF2 vrf-leak
VRF: VRF2, Protocol: vrf-leak
...
>VL    20.0.0.0/8 [1/0] source VRF: VRF1
          via 10.1.2.10 [0/0] type ipv4
             via 10.1.2.10, Ethernet1

show rib route fib policy excluded

The show rib route fib policy excluded command displays the RIB routes filtered by FIB policy. The fib policy excluded option displays the RIB routes that have been excluded from being programmed into FIB, by FIB policy.

Command Mode

EXEC

Command Syntax

show rib route [ipv4 | ipv6] fib policy excluded

Example

The following example displays the RIB routes excluded by the FIB policy using the fib policy excluded option of the show rib route command.

switch# show rib route ipv6 fib policy excluded
switch# show rib route ip bgp fib policy excluded

VRF name: default, VRF ID: 0xfe, Protocol: bgp
Codes: C - Connected, S - Static, P - Route Input
       B - BGP, O - Ospf, O3 - Ospf3, I - Isis
       > - Best Route, * - Unresolved Nexthop
       L - Part of a recursive route resolution loop
>B    10.1.0.0/24 [200/0]
         via 10.2.2.1 [115/20] type tunnel
            via 10.3.5.1, Ethernet1
         via 10.2.0.1 [115/20] type tunnel
            via 10.3.4.1, Ethernet2
            via 10.3.6.1, Ethernet3 
>B    10.1.0.0/24 [200/0]
         via 10.2.2.1 [115/20] type tunnel
            via 10.3.5.1, Ethernet1
         via 10.2.0.1 [115/20] type tunnel 
            via 10.3.4.1, Ethernet2
            via 10.3.6.1, Ethernet3

show rib route summary

The show rib route summary command displays information about the routes present in the Routing Information Base.

Command Mode

EXEC

Command Syntax

show rib route summary [INFO_LEVEL]

Parameters

no parameter variable displays data in one table with the summary of all routes in the RIB for default VRF.
brief keyword displays one table with the summary of all routes across all configured VRFs.
ip keyword displays one table with the summary of all IPv4 in the RIB for default VRF.
ipv6 keyword displays one table with the summary of all IPv4 in the RIB for default VRF.
vrf vrf_Name keyword displays one table with the summary of all routes in the Routing Information Base for the specified VRF.
vrf all keyword displays one table with the summary of all routes in the Routing Information Base for each configured VRF.
INFO_LEVEL amount of information that is displayed. Options include:
- Display Values
  - VRF VRF RIB displayed.
  - Route Source Source for the route.
  - Number of Routes Number of routes for each source.

Examples

The following displays data in one table with the summary of all routes in the RIB for default VRF.

switch> show rib route summary
VRF: default
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 1
Connected                           4
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         2
Static                              0
VRF leak                            0

The following displays data in one table with the summary of all routes across all configured VRFs.

switch> show rib route summary brief
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 2
Connected                           8
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         4
Static                              0
VRF leak                            0

The following displays data in one table with the summary of all IPv4 routes in the RIB for default VRF.

switch> show rib route summary ip
VRF: default
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 1
Connected                           4
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         2
Static                              0
VRF leak                            0

The following displays data in one table with the summary of all IPv6 routes in the RIB for default VRF.

switch> show rib route summary ipv6
VRF: default
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 0
Connected                           0
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         0
Static                              0
VRF leak                            0

The following displays data in one table with the summary of all routes in the RIB for the VRF named red.

switch> show rib route summary vrf red
VRF: red
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 1
Connected                           4
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         2
Static                              0
VRF leak                            0

The following displays data in one table with the summary of all routes in the RIB for each configured VRF.

switch> show rib route summary vrf all
VRF: red
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 1
Connected                           4
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         2
Static                              0
VRF leak                            0

VRF: default
Route Source         Number Of Routes
-------------------- ----------------
BGP                                 1
Connected                           4
Dynamic policy                      0
IS-IS                               0
OSPF                                0
OSPFv3                              0
RIP                                 0
Route input                         2
Static                              0
VRF leak                            0

show routing-context vrf

The show routing-context vrf command displays the context-active VRF. The context-active VRF determines the default VRF that VRF-context aware commands use when displaying routing table data from a specified VRF.

Command Mode

EXEC

Command Syntax

show routing-context vrf

Related Commands

The cli vrf command specifies the context-active VRF.

Example

This command displays the context-active VRF.

switch> show routing-context vrf
Current VRF routing-context is PURPLE
switch>

show snapshot counters ecmp history

The show snapshot counters ecmp history displays information about the AGM configuration.

Command Mode

EXEC

Command Syntax

show snapshot counters ecmp history

Parameters

Request ID - Identifies the snapshot Request ID to use for the clear command.
Output directory URL - Identifies the snapshot storage location.
Complete - Identifies the snapshot completion status.
Poll Interval - Identifies the configured polling interval for the snapshot.
Total poll count - Identifies the total number of hardware counters collected.
Start time and Stopped time - Identifies the system time when the snapshot started and stopped.
L2 Adjacency ID and Interfaces - The summary of the ECMP groups monitored by AGM.

Example

Use the show snapshot counters ecmp history to display information about the configuration.

switch#show snapshot counters ecmp history
Request ID: 17
Output directory URL: file:/var/tmp/ecmpMonitor
Output file name(s): ecmpMonitor-17-adj1284.ctr, ecmpMonitor-17-adj1268.ctr
Complete: True
Poll interval: 1000 microseconds
Total poll count: 59216
Start time: 2024-06-17 17:58:36
Stop time: 2024-06-17 17:59:36
                
L2 Adjacency ID    Interfaces
--------------------- ----------------------------------------------------              
1268                  Ethernet54/1, Ethernet41/1, Ethernet1/1, Ethernet57/1
1284                  Ethernet20/1, Ethernet35/1, Ethernet41/1, Ethernet8/1, Ethernet1/1

show tunnel fib static interface gre

The show tunnel fib static interface gre command displays the Forwarding Information Base (FIB) information for a static interface GRE tunnel.

Command Mode

EXEC

Command Syntax

show tunnel fib static interface gre number

Parameter

number Specifies the tunnel index number.

Example

This command display the interface tunnel configuration with GRE configured.

switch# show tunnel fib static interface gre 10

Type 'Static Interface', index 10, forwarding Primary
   via 10.6.1.2, 'Ethernet6/1'
      GRE, destination 10.1.1.2, source 10.1.1.1, ttl 10, tos 0xa

show vrf

The show vrf command displays the VRF name, RD, supported protocols, state and included interfaces for the specified VRF or for all VRFs on the switch.

Command Mode

EXEC

Command Syntax

show vrf [VRF_INSTANCE]

Parameters

VRF_INSTANCE Specifies the VRF instance to display.

no parameter Information is displayed for all VRFs.
vrf vrf_name Information is displayed for the specified user-defined VRF.

Example

This command displays information for the VRF named purple.

switch> show vrf purple
Vrf      RD          Protocols  State       Interfaces
-------- ----------- ---------- ----------- --------------
purple   64496:237   ipv4       no routing  Vlan42, Vlan43

switch>

start snapshot counters

The start snapshot counters ecmp allows the monitoring of packets and bytes traversing the members of the configured ECMP groups on the switch with a high time resolution.

Command Mode

Global Configuration Mode

Command Syntax

start snapshot counters ecmp poll interval interval [milliseconds | microseconds] duration duration seconds destination_url

Parameters

interval interval - Specify at least 100 microseconds. EOS does not guarantee the interval, and the actual poll interval may depend on the system load as well as the number and size of configured ECMP groups. Valid values include milliseconds and microseconds.
duration duration seconds - Specify the duration for collecting data. A maximum of 3600 seconds can be configured.
destination_url - Optionally, provide a destination URL for data storage.
- file - The path must start with /tmp or /tmp. The files store in the non-persistent storage.
- flash - Files store in persistent storage.

Example

To begin collecting data on the switch at 100 millisecond intervals for 1800 seconds, use the following command:

switch(config)#start snapshot counters ecmp poll interval 100 milliseconds duration 1800 seconds

tcp mss ceiling

The tcp mss ceiling command configures the Maximum Segment Size (MSS) limit in the TCP header on the configuration mode interface and enables TCP MSS clamping.

The no tcp mss ceiling and the default tcp mss ceiling commands remove any MSS ceiling limit previously configured on the interface.

Note: Configuring a TCP MSS ceiling on any Ethernet or tunnel interface enables TCP MSS clamping on the switch as a whole. Without hardware support, clamping routes all TCP SYN packets through software, even on interfaces where no TCP MSS ceiling has been configured. This significantly limits the number of TCP sessions the switch can establish per second, and can potentially cause packet loss if the CPU traffic exceeds control plane policy limits.

Command Mode

Interface-Ethernet Configuration

Subinterface-Ethernet Configuration

Interface-Port-channel Configuration

Subinterface-Port-channel Configuration

Interface-Tunnel Configuration

Interface-VLAN Configuration

Command Syntax

tcp mss ceiling {ipv4 segment size | ipv6 segment size}{egress | ingress}

no tcp mss ceiling

default tcp mss ceiling

Parameters

ipv4 segment size The IPv4 segment size value in bytes. Values range from 64 to 65515.
ipv6 segment size The IPv6 segment size value in bytes. Values range from 64 to 65495. This option is not supported on Sand platform switches (Qumran-MX, Qumran-AX, Jericho, Jericho+).
egress The TCP SYN packets that are forwarded from the interface to the network.
ingress The TCP SYN packets that are received from the network to the interface. Not supported on Sand platform switches.

Guidelines

On Sand platform switches (Qumran-MX, Qumran-AX, Jericho, Jericho+), this command works only for egress, and is supported only on IPv4 unicast packets entering the switch.
Clamping can only be configured in one direction per interface and works only on egress on Sand platform switches.
To configure ceilings for both IPv4 and IPv6 packets, both configurations must be included in a single command; re-issuing the command overwrites any previous settings.
Clamping configuration has no effect on GRE transit packets.

Example

These commands configure interface ethernet 5 as a routed port, then specify a maximum MSS ceiling value of 1458 bytes in TCP SYN packets exiting that port. This enables TCP MSS clamping on the switch.

switch(config)# interface ethernet 5
switch(config-if-Et5)# no switchport
switch(config-if-Et5)# tcp mss ceiling ipv4 1458 egress
switch(config-if-Et5)#

tunnel

The tunnel command configures options for protocol-over-protocol tunneling. Because interface-tunnel configuration mode is not a group change mode, running-config is changed immediately after commands are executed. The exit command does not affect the configuration.

The no tunnel command deletes the specified tunnel configuration.

Command Mode

Interface-tunnel Configuration

Command Syntax

tunnel options

no tunnel options

Parameters

options Specifies the various tunneling options as listed below.
- destination Destination address of the tunnel.
- ipsec Secures the tunnel with the IPsec address.
- key Sets the tunnel key.
- mode Tunnel encapsulation method.
- path-mtu-discovery Enables the Path MTU discovery on tunnel.
- source Source of the tunnel packets.
- tos Sets the IP type of service value.
- ttl Sets time to live value.
- underlay Tunnel underlay.

Example

These commands place the switch in interface-tunnel configuration mode for interface Tunnel 10 and with GRE tunnel configured on the interfaces specified.

switch(config)# ip routing
switch(config)# interface Tunnel 10
switch(config-if-Tu10)# tunnel mode gre
switch(config-if-Tu10)# ip address 192.168.1.1/24
switch(config-if-Tu10)# tunnel source 10.1.1.1
switch(config-if-Tu10)# tunnel destination 10.1.1.2
switch(config-if-Tu10)# tunnel path-mtu-discovery
switch(config-if-Tu10)# tunnel tos 10
switch(config-if-Tu10)# tunnel ttl 10

vrf (Interface mode)

The vrf command adds the configuration mode interface to the specified VRF. You must create the VRF first, using the vrf instance command.

The no vrf and default vrf commands remove the configuration mode interface from the specified VRF by deleting the corresponding vrf command from running-config.

All forms of the vrf command remove all IP addresses associated with the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

vrf [vrf_name]

no vrf [vrf_name]

default vrf [vrf_name]

Parameters

vrf_name Name of configured VRF.

Examples

These commands add the configuration mode interface (vlan 20) to the VRF named purple.

switch(config)# interface vlan 20
switch(config-if-Vl20)# vrf purple
switch(config-if-Vl20)#

These commands remove the configuration mode interface from VRF purple.

switch(config)#  interface vlan 20
switch(config-if-Vl20)# no vrf purple
switch(config-if-Vl20)#

vrf instance

The vrf instance command places the switch in VRF configuration mode for the specified VRF. If the named VRF does not exist, this command creates it. The number of user-defined VRFs supported varies by platform.

To add an interface to the VRF once it is created, use the vrf (Interface mode) command.

The no vrf instance and default vrf instance commands delete the specified VRF instance by removing the corresponding vrf instance command from running-config. This also removes all IP addresses associated with interfaces that belong to the deleted VRF.

The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

vrf instance [vrf_name]

no vrf instance [vrf_name]

default vrf instance [vrf_name]

Parameters

vrf_name Name of VRF being created, deleted or configured. The names main and default are reserved.

Example

This command creates a VRF named purple and places the switch in VRF configuration mode for that VRF.

switch(config)# vrf instance purple
switch(config-vrf-purple)#

Interface Configuration

This chapter describes Ethernet ports supported by Arista switches as well as channel groups, port channels, port channel interfaces, Link Aggregation Control Protocol (LACP), and Multi-Chassis Link Aggregation. This chapter contains the following sections:

Ethernet Ports

This section describes Ethernet ports supported by Arista switches. Topics covered in this section include:

Ethernet Ports Introduction
Ethernet Standards
Ethernet Physical Layer
Interfaces
MRU Enforcement
Displaying Interface Interactions
Dynamic Link Flap Damping
Ethernet Configuration Procedures
Ethernet Configuration Commands

Ethernet Ports Introduction

Arista switches support a variety of Ethernet network interfaces. This chapter describes the configuration and monitoring options available in Arista switching platforms.

Ethernet Standards

Ethernet, standardized in IEEE 802.3, is a group of technologies used for communication over local area networks. Ethernet communication divides data streams into frames containing addresses (source and destination), payload, and Cyclical Redundancy Check (CRC) information.

IEEE 802.3 also describes two types of optical fiber: Single-Mode Fiber (SMF) and Multi-Mode Fiber (MMF). MMF range limits from 50 to 500 meters range.

100 Gigabit Ethernet

The 100 Gigabit Ethernet (100GbE) standard defines an Ethernet implementation with a nominal data rate of 100 billion bits per second over 10x10G, 4x25G, or 1x100G. 100 Gigabit Ethernet implements full duplex point-to-point links connected by network switches. Arista switches support 100GBASE-10SR through MXP ports.

40 Gigabit Ethernet

The 40 Gigabit Ethernet (40GbE) standard defines an Ethernet implementation with a nominal data rate of 40 billion bits per second over multiple 10 gigabit lanes. 40 Gigabit Ethernet implements full duplex point to point links connected by network switches. 40 Gigabit Ethernet standards use the “40GBASE-xyz" naming scheme, as explained in 40GBASE-xyz Interpretation.

Table 1. 40GBASE-xyz Interpretation
x	y	z
Non-fiber media type, or fiber wavelength	PHY encoding	Number of WWDM wavelengths or XAUI Lanes
C = Copper F = Serial SMF K = Backplane L = Long (1310 nm) S = Short (850 nm)	R = LAN PHY (64B/66B)	No value = 1 (serial) 4 = 4 WWDM wavelengths or XAUI Lanes

10 Gigabit Ethernet

The 10 Gigabit Ethernet (10GbE) standard defines an Ethernet implementation with a nominal data rate of 10 billion bits per second. 10 Gigabit Ethernet implements full duplex point-to-point links connected by network switches. Half duplex operation, hubs, and CSMA/CD do not exist in 10GbE. The standard encompasses several PHY standards; a networking device may support different PHY types through pluggable PHY modules. 10GbE standards are named 10GBASE-xyz, as interpreted by 10GBASE-xyz Interpretation.

Table 2. 10GBASE-xyz Interpretation
x	y	z
media type or wavelength, if media type is fiber	PHY encoding type	Number of WWDM wavelengths or XAUI Lanes
C = Copper (twin axial) T = Twisted Pair S = Short (850 nm) L = Long (1310 nm) E = Extended (1550 nm) Z = Ultra extended (1550 nm)	R = LAN PHY (64B/66B) X = LAN PHY (8B/10B) W = WAN PHY(*) (64B/66B)	If omitted, value = 1 (serial) 4 = 4 WWDM wavelengths or XAUI Lanes

Gigabit Ethernet

The Gigabit Ethernet (GbE) standard, defined by IEEE 802.3-2008, describes an Ethernet version with a nominal data rate of one billion bits per second. GbE cables and equipment are similar to those used in previous standards. While full-duplex links in switches are the typical implementation, the specification permits half-duplex links connected through hubs.

Gigabit Ethernet physical layer standards that Arista switches support include 1000BASE-X (optical fiber), 1000BASE-T (twisted pair cable), and 1000BASE-CX (balanced copper cable).

1000BASE-SX is a fiber optic standard that utilizes multi-mode fiber supporting 770 to 860 nm, near-infrared (NIR) light wavelength to transmit data over distances ranging from 220 to 550 meters. Network designs typically leverage 1000BASE-SX for intra-building links in large office buildings, co-location facilities, and carrier-neutral Internet exchanges.
1000BASE-LX is a fiber standard that utilizes a long wavelength laser (1,2701,355 nm) with an RMS spectral width of 4 nm to transmit data up to 5 km. 1000BASE-LX can run on all common types of multi-mode fiber with a maximum segment length of 550 m.
1000BASE-T is a standard for gigabit Ethernet over copper wiring. Each 1000BASE-T network segment can be a maximum length of 100 meters.

10/100/1000BASE-T

Arista switches provide 10/100/1000BASE-T Ethernet out-of-band management ports. Auto-negotiation is enabled on these interfaces. Speed (10/100/1000), duplex (half/full), and flow control settings are available using the appropriate speed and flowcontrol commands.

Power over Ethernet (PoE)

Selected Arista switches provide Power over Ethernet (PoE) to power connected devices. Arista’s PoE implementation is compliant with IEEE standards 802.3af and 802.3at and includes partial support for 802.3bt.

When a standards-compliant Powered Device (PD) is connected to a PoE-enabled Ethernet port, it is recognized by a specific resistor signature, and its power class is determined by hardware negotiation; more granular power adjustments can then be managed by the Link Layer Discovery Protocol (LLDP).

Link Fault Signaling

Link Fault Signaling (LFS) is a mechanism by which a port transmits remote link fault signals to its peer over the link that is experiencing problems by configuring specific actions. LFS operates between the remote Reconciliation Sublayer (remote RS) and the local Reconciliation Sub-layer (local RS). The local RS treats faults detected between the remote RS and the local RS as local faults.

LFS enables monitoring FCS and symbol errors on an interface, and if they exceed a configured threshold, one of the following three actions is enabled:

Disable the error on the interface.
Generate system log messages.
Generate a link fault.

Ethernet Physical Layer

The Ethernet Physical Layer (PHY) includes hardware components connecting a switch's MAC layer to a transceiver, a cable, and ultimately to a peer link partner.

Data exist in digital form at the MAC layer. On the line side of the PHY, data exist as analog signals: light blips on optical fiber or voltage pulses on copper cable. Signals may be distorted while in transit and recovery may require signal processing. Ethernet physical layer components include a PHY and a transceiver.

PHYs

The PHY provides translation services between the MAC layer and the transceiver. It also helps to establish links between the local MAC layer and peer devices by detecting and signaling fault conditions. The PHY line-side interface receives Ethernet frames from the link partner as analog waveforms. The PHY uses signal processing to recover the encoded bits, then sends them to the MAC layer.

PHY line-side interface components and their functions include:

Physical Medium Attachment (PMA): Framing, octet synchronization, scrambling/ sdescrambling.
Physical Medium Dependent (PMD): Consists of the transceiver.
Physical Coding Sublayer (PCS): Performs auto-negotiation and coding (8B/10B or 64B/66B).

The MAC sublayer of the PHY provides a logical connection between the MAC layer and the peer device by initializing, controlling, and managing the connection with the peer.

The PHY's system-side interface receives Ethernet frames transmitted by the switch as a sequence of digital bits. The PHY encodes them into a media-specific waveform for transmission through the line-side interface and transceiver to the link peer. This encoding may include signal processing, such as pre-distortion and forward error correction.

PHY system-side interface components and their functions include:

10 Gigabit Attachment Unit Interface (XAUI): Connects an Ethernet MAC to a 10 Gb/s PHY.
Serial Gigabit Media Independent Attachment (SGMII): Connects an Ethernet MAC to a 1 Gb/s PHY.

Transceivers

A transceiver connects the PHY to an external cable (optical fiber or twisted-pair copper) and through a physical connector (LC jack for fiber or RJ-45 jack for copper).

Optical transceivers convert the PHY signal into light pulses that are sent through optical fiber.
Copper transceivers connect the PHY to twisted-pair copper cabling.

Arista Small Form-Factor Pluggable (SFP+) and Quad Small Form Factor Pluggable (QSFP+) modules and cables provide high-density, low-power Ethernet connectivity over fiber and copper media. Arista offers transceivers that span data rates, media types, and transmission distances.

Arista 10 Gigabit Ethernet SFP+ Modules

10GBASE-SR (Short Reach)
- Link length: maximum 300 meters over multi-mode fiber.
Optical interoperability with 10GBASE-SRL.
10GBASE-SRL (Short Reach Lite)
- Link length: maximum 100 meters over multi-mode fiber.
- Optical interoperability with 10GBASE-SR.
10GBASE-LRL (Long Reach Lite)
- Link length: maximum 1 km over single-mode fiber.
- Optical interoperability with 10GBASE-LR (1 km maximum).
10GBASE-LR (Long Reach)
- Link length: maximum 10 km over single-mode fiber.
- Optical interoperability with 10GBASE-LRL (1 km maximum).
10GBASE-LRM (Long Reach Multi-mode)
- Link length: maximum 220 meters over multi-mode fiber (50 um and 62.5 um).
10GBASE-ER (Extended Reach)
- Link length: maximum 40 km over single-mode fiber.
10GBASE-ZR (Ultra-Extended Reach)
- Link length: maximum 80 km over single-mode fiber.
10GBASE-DWDM (Dense Wavelength Division Multiplexing)
- Link length: maximum 80 km over single-mode fiber (40 color options).
- Tunable SFP+ Optics Module, Full C-Band 50 GHz ITU Grid, up to 80km over duplex SMF.

Arista 10 Gigabit Ethernet CR Cable Modules

10GBASE-CR SFP+ to SFP+ Cables
- Link lengths of 0.5, 1, 1.5, 2, 2.5, 3, 5, and 7 meters over twinax copper cable.
- Includes SFP+ connectors on both ends.
4 x 10GbE QSFP+ to 4 x SFP+ twinax copper cables.
- Link lengths of 0.5, 1, 2, 3, and 5 meters over twinax copper cable.

Arista 25 Gigabit Ethernet Modules

25GBASE-CR SFP28 Cable
- Capable of 10G/25Gb/s speeds with link lengths of 1 to 5 meters.
AOC-S-S-25G SFP28 to SFP28 25GbE Active Optical Cable.
- Link lengths of 3 to 30 meters.
SFP-25G-SR SFP28 Optics Module
- Link length of up to 70 m over OM3 MMF or 100 m over OM4 MMF.
SFP-25G-LR SFP28 Optics Module
- Link length of up to 10 kilometers over duplex SMF.

Arista 40 Gigabit Ethernet QSFP+ Cables and Optics

40GBASE-SR4 QSFP+ Transceiver.
- Link length: maximum 100 meters over parallel OM3 or 150 meters over OM4 MMF.
- Optical interoperability with 40GBASE-XSR4 (maximum distance of 100/150 meters).
40GBASE-XSR4 QSFP+ Transceiver.
- Link length maximum 300 meters over parallel OM3 or 450 meters over OM4 MMF.
- Optical interoperability with 40GBASE-SR4 (maximum distance of 100/150 meters).
40GBASE-LR4 QSFP+.
- Link length: maximum 10 km over duplex single-mode fiber.
40GBASE-CR4 QSFP+ to QSFP+ twinax copper cables.
- Link lengths of 1, 2, 3, 5, and 7 meters over twinax copper cable.
40GBASE-BIDI Bidirectional QSFP+ Optic.
- Link length: up to 100 meters over parallel OM3 or 150 meters over OM4 MMF.
40GBASE-UNIV QSFP+ Optic.
- Link length: up to 150 meters over duplex OM3/OM4 MMF and 500 meters over duplex SMF.
40GBASE-LRL QSFP+ Optic.
- Link length: up to 1 kilometer over duplex SMF.
40GBASE-PLRL4 QSFP+ Optic.
- Link length: up to 1 kilometer over parallel SMF (i.e., 4x10G LR up to 1 km).
40GBASE-PLR4 QSFP+ Optic
- Link length: up to 10 kilometers over parallel SMF (i.e., 4x10G LR up to 1 km).
40GBASE-ER QSFP+ Optic.
- Link length: up to 40 kilometers over duplex SMF.

Arista Gigabit Ethernet SFP Options

1000BASE-SX (Short Haul).
- Multi-mode fiber.
- Link length: up to 550 meters.
1000BASE-LX (Long Haul).
- Single-mode fiber.
- Link length: up to 10 km (single mode).
1000BASE-T (RJ-45 Copper).
- Category 5 cabling.
- Full duplex 1000 Mbps connectivity.

Arista 100 Gigabit Ethernet QSFP Modules

100GBASE-SR4 QSFP transceiver.
- Link length: up to 70 meters over parallel OM3 or 100 meters over OM4 multi-mode fiber.
100GBASE-SWDM4 QSFP transceiver.
- Link length: up to 70 meters over OM3 or 100 meters over OM4 duplex multi-mode fiber.
100GBASE-BIDI QSFP transceiver.
- Link length: up to 70 meters over OM3 or 100 meters over OM4 duplex multi-mode fiber.
100GBASE-PSM4 40G/100G dual speed QSFP Optics Module.
- Link length: up to 500 meters over parallel single-mode fiber.
100GBASE-CWDM4 40G/100G dual speed QSFP Optics Module.
- Link length: up to 2 km over duplex single-mode fiber.
100GBASE-LRL4 QSFP Optics Module.
- Link length: up to 2 km over duplex single-mode fiber.
100GBASE-LR4 QSFP Optics Module.
- Link length: up to 10 km over duplex single-mode fiber.
100GBASE-ERL4 QSFP Optics Module.
- Link length: up to 40 km over duplex single-mode fiber.
100GBASE-ZR4 QSFP Optics Module.
- Link length: up to 80 km over single-mode fiber.
100GBASE-CR4 QSFP to QSFP Twinax copper cable.
- Link lengths of 1 to 5 meters.
100GBASE-CR4 QSFP to 4 x 25GbE SFP Twinax copper cable.
- Link lengths of 1 to 5 meters.

Internal Ports

Several Arista switches include internal ports that connect directly to an external cable through an RJ-45 jack. Internal ports available on Arista switches include:

100/1000BASE-T (7048T-A).
100/1000/10GBASE-T (7050-T).

AOC Cables

AOC-Q-Q-100G QSFP 100GbE Active Optical Cable.
- Link lengths of 3 to 30 meters.
AOC-Q-Q-40G QSFP+ to QSFP+ 40GbE Active Optical Cable.
- Link lengths of 3 to 100 meters.
AOC-S-S-25G SFP28 to SFP28 25GbE Active Optical Cable.
- Link lengths of 3 to 30 meters.

400GBASE-ZR Transceivers

400GBASE-ZR transceiver is the industry’s first multi-vendor DWDM standard, a Digital Coherent Optical module with tunable laser, using DWDM multiplexing and 16QAM modulation and capable of delivering 400G per port over distances up to 120 km.

Key software features supported:

Compliant with CMIS4.0/CMIS4.1 (CMIS5.0) and Coherent CMIS.
Frequency tuning (100 GHz and 75 GHz grids).
DOM monitoring, including VDM (Versatile Diagnostics Monitoring) pages, defined in CMIS4.0.
Coherent alarms and faults, including pages, defined by Coherent CMIS.
Configurable Tx output power.
A separate command for shutting down the Tx output path for unidirectional mode.
1-second update of pre-FEC BER, OSNR, ESNR.
Support of the 4x100 Gb/s mode for the 400GBASE-ZR transceivers (EOS release 4.25.2F).
Support of 400GBASE-ZR with Open Forward Error Correction (O-FEC) (EOS release 4.25.2F.)
Override a transceiver slot’s maximum power limit (EOS release 4.25.2F.)

Platform Compatibility

The 400GBASE-ZR transceiver is a power class 8 module with a power consumption of up to 20W, the highest power consumption among 400G transceivers.

In theory, every 400GBASE OSFP or QSFP-DD switch is qualified to host 400GBASE-ZR transceivers. However, the actual number of 400GBASE-ZR modules that can be used by a switch simultaneously may vary, depending on platform (modular vs. fixed) and ASIC type. It is always recommended to discuss the installation of 400GBASE-ZR modules with Arista support.

Using 400GBASE-ZR in Combination with OSFP-LS

Arista EOS allows the use of OSFP-LS (pluggable line system in the OSFP form factor), instead of traditional DCI line systems.

Configuring 400GBASE-ZR Transceivers

Laser Frequency Configuration

All coherent modules, including 400GBASE-ZR, require their laser frequency to be explicitly configured. To configure the laser frequency for 400GBASE-ZR, use the transceiver frequency command under the defined interface, providing a frequency expressed in Gigahertz in the range of 191.3-196.1 THz. If a laser frequency is not configured or is configured outside the valid range, all interfaces associated with the port are put into error-disabled state.

switch# conf
switch(config)#
switch(config)# interface Ethernet12/1
switch(config-if-Et12/1)# transceiver frequency 193100
switch(config-if-Et12/1)#

Configured and operational frequency settings can be verified using the show interface transceiver hardware command.

Note:

It can take up to 90 seconds for the 400GBASE-ZR module to fully complete frequency tuning.
The frequency plan for 400GBASE-ZR modules support channel spacings of 100 GHz or 75 GHz. It is recommended to use operating frequency channel definitions in chapter 15 of [4].

Transmit Output Power Configuration

CMIS4.0 defines support of configurable transmit output power as an optional feature. Check the output of show interface transceiver eeprom command for page 04h, registers 196-201, to see if it is supported.

Programmable output power advertisement (04h:196-201):
    Lane programmable output power supported (04h:196): true
    Min programmable output power (04h:198-199): -14 dB
    Max programmable output power (04h:200-201): -10 dB

Transmit output power can be configured using the transceiver transmitter signal power command.

switch# conf
switch(config)# interface Ethernet14/1
switch(config-if-Et14/1)# transceiver transmitter signal-power ?
switch(config-if-Et14/1)# transceiver transmitter signal-power -10

You can check the configured TX power using the show interface transceiver hardware command and the actual operational TX power using the show interface transceiver command.

Note:

400GBASE-ZR does not have a recommended level of transmit laser power. In most cases, it is okay to keep the default power.
Some vendors may not populate the range of supported output powers correctly. The range -10 to -14 dBm should be supported. Contact Arista Support if you are planning to configure the output power outside of this range.

Transmit Output Disable and Unidirectional Mode

In coherent optics, the shutdown command impacts both transmit and receive paths and can’t be used to set up a unidirectional mode. To shut down the TX output path, use the transceiver transmitter disabled command:

switch# conf
switch(config)# interface Ethernet14/1
switch(config-if-Et14/1)# transceiver transmitter DISABLED

To re-enable the transmit path, use the no or default version of the above configuration command.

Configuring 4x100 Gb/s mode for 400GBASE-ZR transceivers

4x100 Gb/s mode connects four host Ethernet interfaces over 100GAUI-2 electrical interfaces to a single optical lane acting as a 4x1 muxponder. To enable this mode on a 400GBASE-ZR transceiver, configure the speed on each of the four interfaces.

switch(config-if-Et4/1)# speed 100g-2
switch(config-if-Et4/3,4/5,4/7)# speed 100g-2

switch# show interfaces ethernet 4/1-5/8 status
Port   	Name   Status   	  Vlan 	Duplex Speed  Type     	Flags Encapsulation
Et4/1       	  connected 	  1    	full   100G   400GBASE-ZR               	 
Et4/3       	  connected 	  1    	full   100G   400GBASE-ZR               	 
Et4/5       	  connected 	  1    	full   100G   400GBASE-ZR               	 
Et4/7       	  connected 	  1    	full   100G   400GBASE-ZR               	 
Et5/1       	  connected          1    	full   100G   400GBASE-ZR               	 
Et5/3       	  connected          1    	full   100G   400GBASE-ZR               	 
Et5/5       	  connected          1    	full   100G   400GBASE-ZR               	 
Et5/7       	  connected   	1    	full   100G   400GBASE-ZR

Each of the Ethernet interfaces can be independently shut down without affecting the transmission over the other interfaces.

switch(config-if-Et4/1,4/3,4/5)# shutdown
switch# show interfaces ethernet 4/1-5/8 status
Port   	Name   Status   	  Vlan 	Duplex Speed  Type     	Flags Encapsulation
Et4/1       	  disabled 	  1    	full   100G   400GBASE-ZR               	 
Et4/3       	  disabled 	  1    	full   100G   400GBASE-ZR               	 
Et4/5       	  disabled 	  1    	full   100G   400GBASE-ZR               	 
Et4/7       	  connected	  1    	full   100G   400GBASE-ZR               	 
Et5/1       	  notconnect        1    	full   100G   400GBASE-ZR               	 
Et5/3       	  notconnect        1    	full   100G   400GBASE-ZR               	 
Et5/5       	  notconnect        1    	full   100G   400GBASE-ZR               	 
Et5/7       	  connected	   1    	full   100G   400GBASE-ZR

switch# show interfaces ethernet 4/1 transceiver
If device is externally calibrated, only calibrated values are printed.
N/A: not applicable, Tx: transmit, Rx: receive.
mA: milliamperes, dBm: decibels (milliwatts).
                            	Bias  	Optical   Optical           	 
      	Temp   	Voltage    Current    Tx Power  Rx Power          	 
Port  	(Celsius)  (Volts)    (mA)  	(dBm)     (dBm)  	Last Update  
----- 	---------  --------   --------  --------  --------    -------------------
Et4/1	     59.00      3.25     279.70     -9.46     -8.29    0:00:01 ago

However, shutting down all four interfaces disables the laser:

switch(config-if-Et4/7)# shutdown
switch# show interfaces ethernet 4/1-5/8 status
Port   	Name   Status   	  Vlan 	Duplex Speed  Type     	Flags Encapsulation
Et4/1       	  disabled 	  1    	full   100G   400GBASE-ZR               	 
Et4/3       	  disabled 	  1    	full   100G   400GBASE-ZR               	 
Et4/5       	  disabled 	  1    	full   100G   400GBASE-ZR               	 
Et4/7       	  disabled	   1    	full   100G   400GBASE-ZR               	 
Et5/1       	  notconnect        1    	full   100G   400GBASE-ZR               	 
Et5/3       	  notconnect        1    	full   100G   400GBASE-ZR               	 
Et5/5       	  notconnect        1    	full   100G   400GBASE-ZR               	 
Et5/7       	  notconnect	  1    	full   100G   400GBASE-ZR

switch# show interfaces ethernet 4/1 transceiver
If device is externally calibrated, only calibrated values are printed.
N/A: not applicable, Tx: transmit, Rx: receive.
mA: milliamperes, dBm: decibels (milliwatts).
                            	Bias  	Optical   Optical           	 
      	Temp   	Voltage    Current    Tx Power  Rx Power          	 
Port  	(Celsius)  (Volts)    (mA)  	(dBm)     (dBm)  	Last Update  
----- 	---------  --------   --------  --------  --------    -------------------
Et4/1	     44.00      3.33       0.00    -30.00    -30.00    0:00:01 ago

Configuring Open Forward Error Correction on 400GBASE-ZR

Open FEC (O-FEC) is a Forward Error Correction encoder and decoder, specified in the Open ZR+ MSA [2], with an overhead of 15.3% and a net coding gain of 11.6 dB for 16QAM modulation. Compared to Concatenated FEC (C-FEC), which is a default FEC specified for 400GBASE-ZR coherent transceivers by CMIS4.0, O-FEC provides higher coding gain (11.6dB for O-FEC vs 10.8 dB for C-FEC /16QAM), and it can correct a pre-FEC BER of up to 2E-2.

The error-correction encoding <FEC> command configures the transceiver’s optical transmission to use O-FEC:

switch(config-if-Et4/1)# error-correction encoding open

Transceiver Slot’s Maximum Power Limit

The transceiver power ignore command allows EOS to bypass the power check for the transceivers to be operational.

switch(config-if-Et4/1)# transceiver power ignore
! You can risk damaging hardware by using transceiver modules with high power consumption. We recommend that you do this only under direction from Arista Networks.

Show Commands

show interface transceiver eeprom

The show interface transceiver eeprom command displays the parsed capabilities.

Example

For 400GBASE-ZR, the display of frequency tuning, power tuning (page 04h), and VDM configuration pages (20h-23h) is added.

switch# show interface Ethernet15/1 transceiver eeprom
Ethernet15 EEPROM:
...
  Frequency tuning support (04h:128-129):
    Grid spacing capabilities (04h:128):
      100 GHz grid supported (04h:128): true
      12.5 GHz grid supported (04h:128): false
      25 GHz grid supported (04h:128): false
      3.125 GHz grid supported (04h:128): false
      33 GHz grid supported (04h:128): false
      50 GHz grid supported (04h:128): false
      6.25 GHz grid supported (04h:128): false
      75 GHz grid supported (04h:128): true
    Tunable wavelength (04h:128): true
    Fine tuning support (04h:129): false
  Supported channel boundaries (04h:130-161):
    100 GHz grid (04h:150-153):
      Lowest channel (04h:150-151): -18
      Lowest frequency (04h:150-151): 191300000 MHz
      Highest channel (04h:152-153): 30
      Highest frequency (04h:152-153): 196100000 MHz
    75 GHz grid (04h:158-161):
      Lowest channel (04h:158-159): -72
      Lowest frequency (04h:158-159): 191300000 MHz
      Highest channel (04h:160-161): 120
      Highest frequency (04h:160-161): 196100000 MHz
  Programmable output power advertisement (04h:196-201):
    Lane programmable output power supported (04h:196): false
  VDM configuration (20h:128-255;21h:128-255):
    VDM group 1 (20h:128-255):
      Parameter 1 (20h:128-129):
        Lane (20h:128): 0
        Threshold ID (20h:128): 0
        Parameter type (20h:129): Laser temperature
      Parameter 3 (20h:132-133):
        Lane (20h:132): 0
        Threshold ID (20h:132): 2
        Parameter type (20h:133): eSNR host input
      Parameter 4 (20h:134-135):
        Lane (20h:134): 1
        Threshold ID (20h:134): 2
        Parameter type (20h:135): eSNR host input
      Parameter 5 (20h:136-137):
        Lane (20h:136): 2
        Threshold ID (20h:136): 2
        Parameter type (20h:137): eSNR host input
...
       Parameter 84 (21h:166-167):
        Lane (21h:166): 0
        Threshold ID (21h:166): 14
        Parameter type (21h:167): MER
  Number of VDM groups supported (2Fh:128): 2

show interface transceiver dom

The show interface transceiver dom command displays the most important current performance data on the media (line) side.

Example

switch# show interface Ethernet11/1 transceiver dom
Ch: Channel, N/A: not applicable, TX: transmit, RX: receive
mA: milliamperes, dBm: decibels (milliwatts), C: Celsius, V: Volts

Port 11
Last update: 0:00:05 ago
                                             Value
                                        ----------------
   Case temperature                         66.59 C
   Voltage                                   3.26 V
   TX power                                -10.23 dBm
   RX total power                          -11.61 dBm
   RX channel power                        -11.94 dBm
   Pre-FEC BER                           1.82e-03 
   Post-FEC errored frames ratio         0.00e+00 
   Chromatic dispersion (short link)         0.00 ps/nm
   Chromatic dispersion (long link)          0.00 ps/nm
   Differential group delay                  9.31 ps
   SOPMD                                     0.00 ps^2
   Polarization dependent loss               0.40 dB
   Received OSNR estimate                   35.10 dB
   Received ESNR estimate                   17.50 dB
   Carrier frequency offset                  0.00 MHz
   Error vector magnitude                  100.00 %
   SOP rate of change                        0.00 krad/s
   Laser temperature                        59.54 C
   Laser frequency                         193100.00 GHz

BER: Bit Error Rate
FEC: Forward Error Correction
OSNR: Optical Signal to Noise Ratio
ESNR: Electrical Signal to Noise Ratio
SOP: State of Polarization
SOPMD: State of Polarization Mode Dispersion

show interfaces hardware

The show interfaces hardware command displays the speed capabilities of a module. A 400GBASE-ZR supports 4x100 Gb/s mode if the 100G-2/full speed is supported.

Example

switch# show interfaces ethernet 4/1 hardware 
*  = Requires speed group setting change
Ethernet4/1
  Model: DCS-7280PR3K-24
  Type: 400GBASE-ZR
  Speed/duplex: 100G-2/full,400G-8/full(default)
  Flowcontrol: rx-(off,on),tx-(off)
  Modulation: 16QAM
  Error correction: C-FEC(16QAM(default)), O-FEC(16QAM)

The show interface status command displays the status and characteristics of the Ethernet interfaces:

switch#show interfaces ethernet 4/1,4/3,4/5,4/7 status
Port      Name  Status   	Vlan 	Duplex Speed  Type     	Flags Encapsulation
Et4/1           connected	1    	full   100G   400GBASE-ZR
Et4/3           connected	1    	full   100G   400GBASE-ZR
Et4/5           connected	1    	full   100G   400GBASE-ZR
Et4/7           connected	1    	full   100G   400GBASE-ZR

show transceiver status interface

The show transceiver status interface command displays the most important alarms, faults,interface statuses, and the existence of four host interfaces in the example below.

Example

For 400GBASE-ZR modules, media and host-side coherent alarms, host-side pre-FEC BER (defined in the Coherent CMIS), and post-FEC BER have been added to the command’s output:

switch# show transceiver status interface Ethernet 4/1,4/3,4/5,4/7
                                Current State        Changes       Last Change
                                -------------        -------       -----------
Port 4
  Transceiver               	400GBASE-ZR             3   	2:32:34 ago
  Transceiver SN            	204653947                  	 
  Presence                  	present                       	 
  Adapters                  	none                          	 
  Bad EEPROM checksums                                     0   	never
  Resets                                                   0   	2:32:41 ago
  Interrupts                                               0   	never
  Data path firmware fault  	ok                       0   	never
  Module firmware fault     	ok                       0   	never
  Temperature high alarm    	ok                       0   	never
  Temperature high warn     	ok                       0   	never
  Temperature low alarm     	ok                       0   	never
  Temperature low warn      	ok                       0   	never
  Voltage high alarm        	ok                       0   	never
  Voltage high warn         	ok                       0   	never
  Voltage low alarm         	ok                       2   	2:32:19 ago
  Voltage low warn          	ok                       2   	2:32:19 ago
  Module state              	ready                    6   	0:02:21 ago
  Data path 1 state         	activated                12         0:01:33 ago
  Data path 2 state         	activated                12   	0:01:33 ago
  Data path 3 state         	activated                12   	0:01:33 ago
  Data path 4 state         	activated                12   	0:01:33 ago
  Data path 5 state         	activated                12   	0:01:33 ago
  Data path 6 state         	activated                12   	0:01:33 ago
  Data path 7 state         	activated                12   	0:01:33 ago
  Data path 8 state         	activated                12   	0:01:33 ago
  RX LOS                    	ok                        4   	0:01:33 ago
  TX fault                  	ok                        0   	never
  RX CDR LOL                	ok                        4   	0:01:31 ago
  TX power high alarm       	ok                        0   	never
  TX power high warn        	ok                        4   	0:02:12 ago
  TX power low alarm        	ok                        4   	0:02:21 ago
  TX power low warn         	ok                        6   	0:02:12 ago
  TX bias high alarm        	ok                        0   	never
  TX bias high warn         	ok                        0   	never
  TX bias low alarm         	ok                        0   	never
  TX bias low warn          	ok                        0   	never
  RX power high alarm       	ok                        0   	never
  RX power high warn        	ok                        0   	never
  RX power low alarm        	ok                        0   	never
  RX power low warn         	ok                        0   	never
  TX loss of alignment      	ok                        0   	never
  TX out of alignment       	ok                        0   	never
  TX clock monitor unit LOL 	ok                        0   	never
  TX reference clock LOL    	ok                        0   	never
  TX deskew LOL             	ok                        0   	never
  TX FIFO error             	ok                        0   	never
  RX demodulator LOL        	ok                        4   	0:01:30 ago
  RX CD compensation LOL    	ok                        4   	0:01:30 ago
  RX loss of alignment      	ok                        0   	never
  RX out of alignment       	ok                        0   	never
  RX deskew LOL             	ok                        0   	never
  RX FIFO error             	ok                        0   	never
  RX FEC excessive degrade  	ok                        0   	never
  RX FEC detected degrade   	ok                        0   	never
  Freq tuning in progress   	idle                      8   	0:01:32 ago
  Freq tuning busy          	ok                        0   	never
  Freq tuning invalid channel      ok                        0   	never
  Freq tuning completed     	no                        8   	0:01:30 ago
Ethernet4/1
  Operational speed         	100Gbps                       	 
  Pre-FEC bit error rate    	0.00e+00                      	 
  Post-FEC errored frames ratio 0.00e+00                      	 
  TX LOS
	Host lane 1             	ok                      2   	0:02:21 ago
	Host lane 2             	ok                      2   	0:02:21 ago
  TX CDR LOL
	Host lane 1             	ok                      2   	0:02:21 ago
	Host lane 2             	ok                      0   	never
  TX adaptive input EQ fault
	Host lane 1             	ok                      2   	0:02:21 ago
	Host lane 2             	ok                      2   	0:02:21 ago
Ethernet4/3
  Operational speed         	100Gbps                       	 
  Pre-FEC bit error rate    	0.00e+00                      	 
  Post-FEC errored frames ratio 0.00e+00                      	 
  TX LOS
	Host lane 3             	ok                      2   	0:02:21 ago
	Host lane 4             	ok                      2   	0:02:21 ago
  TX CDR LOL
	Host lane 3             	ok                      2   	0:02:21 ago
	Host lane 4             	ok                      2   	0:02:21 ago
  TX adaptive input EQ fault
	Host lane 3             	ok                      2   	0:02:21 ago
	Host lane 4             	ok                      2   	0:02:21 ago
Ethernet4/5
  Operational speed         	100Gbps                       	 
  Pre-FEC bit error rate    	0.00e+00                      	 
  Post-FEC errored frames ratio 0.00e+00                      	 
  TX LOS
	Host lane 5             	ok                      2   	0:02:21 ago
	Host lane 6             	ok                      2   	0:02:21 ago
  TX CDR LOL
	Host lane 5             	ok                      0   	never
	Host lane 6             	ok                      2   	0:02:21 ago
  TX adaptive input EQ fault
	Host lane 5             	ok                      0   	never
	Host lane 6             	ok                      2   	0:02:21 ago
Ethernet4/7
  Operational speed         	100Gbps                       	 
  Pre-FEC bit error rate    	0.00e+00                      	 
  Post-FEC errored frames ratio 0.00e+00                      	 
  TX LOS
	Host lane 7             	ok                      2   	0:02:21 ago
	Host lane 8             	ok                      2   	0:02:21 ago
  TX CDR LOL
	Host lane 7             	ok                      2   	0:02:21 ago
	Host lane 8             	ok                      2   	0:02:21 ago
  TX adaptive input EQ fault
	Host lane 7             	ok                      2   	0:02:21 ago
	Host lane 8             	ok                      0   	never

Wavelength/Frequency and Output Power Status
The show interface transceiver hardware command displays the configured and programmed wavelength and output power. It takes a short time for the configured wavelength or output power to be programmed into the transceiver. The configured wavelength/output power and programmed wavelength/output power should not differ for an extended period of time.
```
switch# show interface Ethernet23/1 trans hardware
Name: Et23/1
Media type: 400GBASE-ZR
Maximum module power (W): 20.0
Maximum slot power (W): 20.0
Configured frequency (GHz): 193100.0
Computed wavelength (nm): 1552.52
Operational frequency (GHz): 193,100.0
Operational wavelength (nm): 1552.52
Configured TX power (dBm): -10.0
Operational TX power (dBm): -10.0
```
Note: Configured transmit output power and operational transmit output power are only displayed if configurable output power is supported by the module.

Troubleshooting

Check the transceiver type: make sure it is 400GBASE-ZR.
Check the peer transceiver: make sure it is also 400GBASE-ZR.
Check that the channel/frequency is configured and the interfaces are not in error-disabled state.
Check that the selected frequency is matching on both sides of the optical link.
Check that transmit output is not disabled.
If the TX power is not configured, check that it is in the range of -6 dB to -12 dB.
If the TX power is configured, check that it matches its configured values on both sides of the optical link.
Check the RX power. The best performance of an optical link is achieved when the received power is -10dB.
Collect the output of the CLI commands listed in the “Show commands” section before requesting support from the development team.
Check that the pre-FEC BER (show transceiver dom command) is in the correct range (less than 1E-2).
In the show transceiver status interface output, check that the module state is Ready and that data path state is Activated. Check for possible alarms and faults.

Link Issues

If a link has issues, the following commands and files are useful for debugging and for Arista TAC.

show interfaces <interfaceName> phy detail.
show interfaces <interfaceName> transceiver detail.
show idprom transceiver <interfaceName> ext.
Files in /var/log/agents/*.
Files in /var/log/qt/*.
/var/log/messages*.

Limitations

400GBASE-ZR transceivers are relatively new. The modules could be Arista-branded or 3rd party, from multiple vendors. For 3rd party optics, some optional properties (TX output power, support of 75 GHz grid) or DOM properties in the VDM pages may not be implemented.

MXP Ports

MXP ports provide embedded optics that operate in one of three modes: 10GbE (12 ports), 40GbE (3 ports), and 100GbE (1 port). Each mode requires a specified cable and is implemented through configuration commands. MXP ports utilize multi-mode fiber to provide support over 150 meters.

The 100GbE mode requires an MTP-24 to MTP-24 cable, which uses 20 of 24 fibers to carry 100GbE across 10 send and 10 receive channels. When connecting two 100GbE MXP ports, the TX lanes must be crossed with the RX lanes.
The 40GbE mode requires an MTP cable that provides a split into three MTP-12 ends. The cable splits the MXP port into three MTP-12 ends, each compatible with standard-based 40GBASE-SR4 ports over OM3 or OM4 fiber up to a 100 m or 150 m distance.
The 10GbE mode requires an MTP cable that provides a split into 12x10GbE links with LC connectors to adapt the MXP port into 12x10GbE ports. The cable splits the MXP port into twelve LC ends to connect to SR or SRL optics over multi-mode OM3/OM4 cables.

Interfaces

Arista switches provide two physical interface types that receive, process, and transmit Ethernet frames: Ethernet interfaces and Management interfaces.

Each Ethernet interface is assigned a 48-bit MAC address and communicates with other interfaces by exchanging data packets. Each packet contains the MAC address of its source and destination interface. Ethernet interfaces establish link level connections by exchanging packets. Interfaces do not typically accept packets with a destination address of a different interface.

Ethernet data packets are frames. A frame begins with preamble and start fields, followed by an Ethernet header that includes source and destination MAC addresses. The middle section contains payload data, including headers for other protocols carried in the frame. The frame ends with a 32-bit Cyclic Redundancy Check (CRC) field that interfaces use to detect data corrupted during transmission.

Ethernet Interfaces

Ethernet speed and duplex configuration options depend on the media type of the interface:

40GbE, OSFP, QSFP+, QSFP-DD, and QSFP200: Default operation is as four 10GbE ports. The speed command options support the configuration as a single 40GbE port.
1000BASE-T / 2.5GBASE-T / 5GBASE-T / 10GBASE-T (copper): The default configuration enables the Clause 28 auto-negotiation feature for the port to negotiate the speed based on the peer’s capabilities. Depending on the individual SKU’s capabilities, these ports support 10 Mbps, 100 Mbps, 1 Gbps, 2.5 Gbps, 5 Gbps, and 10 Gbps rates and half/full-duplex mode of operation. The speed auto speed_value command limits the port advertisements to a specific speed. The speed speed_value command disables the Clause 28 auto-negotiation and uses the specified speed as the forced speed setting.
10GBASE-T (SFP+): The port operates as a single 10GbE port. The speed command does not affect the configuration.
100GbE CFP2: It operates at 100 Gb/s speed. You cannot split the interface or change its speed.
100GbE MXP: Operates as three 40GbE ports on the 7050 platform. The available speed/duplex settings are: three 40GbE ports or twelve 10GbE ports. You can make adjustments with the speed command.
100GbE QSFP100: Available speeds are transceiver-dependent. The QSFP100 transceiver supports a single 100GbE port, four 25GbE ports, or two 50GbE ports; the QSFP+ transceiver supports one 40GbE port or four 10GbE ports; the CWDM transceiver supports all five configurations. You can make adjustments with the speed command.
The 1000BASE-T SFP transceivers advertise one speed at a time only. Hence, the desired speed must be configured explicitly using one of the following commands:
- speed auto: auto-negotiates the 1 Gbps speed (this is because no speed is specified, defaulting to advertise 1 Gbps).
- speed auto 1Gfull / speed auto: auto-negotiate the 1 Gbps speed (note that per the 1000BASE-T standard, 1 Gbps must be negotiated).
- speed auto 100full: auto-negotiates the 100 Mbps speed.
- speed 100full: forces the non-negotiated 100 Mbps speed.
The 10GBASE-T SFP transceivers advertise one speed at a time only, similarly to how 1000BASE-T SFPs operate, unlike native BASE-T ports. The no speed and default speed commands configure the PHY to advertise only 10 Gbps.

For information relating to transceivers, see Transceivers.

Subinterfaces

Subinterfaces divide a single Ethernet port or a port channel interface into multiple logical Layer 3 interfaces based on the 802.1Q tag (VLAN ID) of incoming traffic. Subinterfaces are commonly used in a device at the boundary between L2 and L3 domains, but they can also be used to isolate 802.1Q-tagged traffic between L3 peers by assigning each subinterface to a different VRF.

While subinterfaces can be configured on a port channel interface (the virtual interface associated with a port channel), the following restrictions apply:

An L3 interface with subinterfaces configured on it should not be made a member of a port channel
An interface that is a member of a port channel should not have subinterfaces configured
A subinterface cannot be made a member of a port channel

Subinterfaces on multiple ports can be assigned the same VLAN ID, but there is no bridging between subinterfaces (or between subinterfaces and SVIs) as each subinterface is associated with a separate bridge domain.

Subinterfaces support the following features:

Unicast and multicast routing
BGP, OSPF, ISIS, PIM
ACL
VRF
VRRP
SNMP
Subinterface counters (on some platforms)
VXLAN (on some platforms)
MPLS (on some platforms)
GRE (on some platforms)
PBR (on some platforms)
QoS (on some platforms)
Inheriting QoS settings (trust mode and default DSCP) from the parent interface
Inheriting MTU setting from parent interface

The following capabilities instead are not supported:

Per-subinterface MTU setting
Per-subinterface SFLOW settings
Per-subinterface mirroring settings

Shared Shaper across Multiple Subinterfaces

Sub-interfaces can be grouped into logical units called scheduling groups, which are shaped as a single unit. Each scheduling group may be assigned a scheduling policy which defines a shape rate in kbps and optionally a guaranteed bandwidth, also in kbps.

The guaranteed bandwidth is used if the sum of the shape rates of all scheduling groups and sub-interfaces that are not part of groups for a parent interface exceeds the available bandwidth. Each sub-interface within that scheduling group may have its own independent shape rate which are applied in a hierarchical manner.

Adding a sub-interface to a scheduling group results in allocation of dedicated Virtual Output Queues (VOQ) for the sub-interface.

Configuring Shared Shaper

Scheduling groups and scheduling policies are configured in the qos scheduling CLI mode.

First, configure one or more sub-interfaces.

Then, create a scheduling policy with the desired shape rate and optional guaranteed bandwidth:

switch(config)# qos scheduling
switch(config-qos-scheduling)# scheduling policy P1
switch(config-qos-scheduling-policy-P1)# shape rate 75000000
switch(config-qos-scheduling-policy-P1)# bandwidth guaranteed 10000000

The shape rate and guaranteed bandwidth may also be defined as percents of the next highest level of the hierarchy (in this case line rate):
```
switch(config-qos-scheduling-policy-P1)# shape rate 75 percent
switch(config-qos-scheduling-policy-P1)# bandwidth guaranteed percent 10
```

Create the scheduling group on the parent interface:

switch(config)# qos scheduling
switch(config-qos-scheduling)# interface et1
switch(config-qos-scheduling-intf-Ethernet1)# scheduling group G1

Assign a policy to the scheduling group:

switch(config-qos-scheduling-intf-Ethernet1-group-G1)# policy P1

Assign members to the scheduling group (members may be put all on one line or on separate lines):
```
switch(config-qos-scheduling-intf-Ethernet1-group-G1)# members et1.1 et1.2
```

Show Commands

QoS configuration on one or more scheduling groups. Both group name and parent interface name are optional, in which case all groups are displayed as shown in the example below:

Example

switch# show qos scheduling group G1 Ethernet1
Interface: Et1
Scheduling Group Name: G1
Bandwidth: 10.1 / 10.0 (Gbps)
Shape Rate: 75.2 / 75.0 (Gbps)

Member         Bandwidth        Shape Rate
                (units)           (units)
------       -------------  ------------------
Et1.1           - /  - (-)  50.1 / 50.0 (Gbps)
Et1.2           - /  - (-)  30.1 / 30.0 (Gbps)

QOS configuration on a parent interface will show scheduling groups configured on the parent interface.

Example

switch# show qos interface Ethernet1
Ethernet1:

   Trust Mode: DSCP
   Default COS: 0
   Default DSCP: 0

   Port shaping rate: disabled

Scheduling Group        Bandwidth           Shape Rate
                         (units)             (units)
----------------    ------------------  ------------------
G1                  10.1 / 10.0 (Gbps)  75.1 / 75.0 (Gbps)

The entire scheduling hierarchy for a subinterface can be displayed. This displays the shape rate for each transmit queue and then the shape rate and guaranteed bandwidth at every other level of the hierarchy.

Example

switch# show qos scheduling hierarchy Ethernet1.1
Interface     Hierarchy Level            Bandwidth             Shape Rate
                                         (units)               (units)
---------    -------------------------  ------------------     ----------------
Et1/1.100     tx queue (0)                  - /    -            100 / 100 (Mbps)
              tx queue (2)                  - /    -            200 / 200 (Mbps)
              subinterface (Et1/1.1)      100 /  100 (Mbps)     500 / 500 (Mbps)
              group (G1)                  10 /   10 (Gbps)       75 /  75 (Gbps)
              parent (Et1/1) (100 Gbps)    - /    -               - /   -  ( - )

Agile Ports

Agile ports are a feature of the 7150S series that allows the user to configure blocks of 4 adjacent SFP+ interfaces as a single 40GbE link. The hardware configuration restricts the set of interfaces that can be combined to form a higher speed port: only interfaces that pass through a common PHY component can be combined.

One interface within a combinable set is designated as the primary port. When the primary interface is configured as a higher speed port, all configuration tasks are performed on that interface. All other interfaces in the set are subordinated to the primary interface and are notindividually configurable when the primary interface is configured as the higher speed port. This feature allows the 7150S-24 to behave as a 4x40GbE switch (using 16 SFP+ modules) while the remaining SFP+ modules provide eight 10GbE ports. On the 7150S-52 this capability supports up to 13 40GbE ports (all 52 ports configured in groups of four, each running at 40 Gb/s speed) and on the 7150S-64 agile ports enable the switch to be deployed with up to 16 40GbE interfaces: four are native QSFP+ ports while the remaining 12 are configured as 4xSFP+ groups.

Management Interfaces

A management interface is a Layer 3 host port that is typically connected to a management station for performing out-of-band switch management tasks. Each switch has one or two management interfaces. Only one port needs to manage the switch; the second port, when available, provides redundancy.

Management interfaces are 10/100/1000 BASE-T interfaces. By default, auto-negotiation is enabled on management interfaces. All combinations of 10/100/1000 speeds and full or half duplex are enforceable on these interfaces through the speed command.

Management ports are enabled by default. The switch cannot route packets between management ports and network ports because they are in separate routing domains. When the management station is multiple hops from the management port, packet exchanges through Layer 3 devices between the management port and management station may require the enabling of routing protocols.

The Ethernet management ports can be accessed remotely over a common network or locally through a directly connected computer. An IP address and a static route to the default gateway must be configured to be able to access the switch through a remote connection.

Tunable SFP Modules

Tuning of DWDM 10GbE SFP+ transceivers (10GBASE-DWDM) includes:

Tuning the transceiver wavelength/frequency by channel number.
Showing the wavelengths/frequencies for specified channels supported by the transceiver.
Showing the current wavelength/frequency settings of the transceiver interface.

For information about tuning the transceiver wavelength/frequency by channel number, refer to the command transceiver channel. To show the current wavelength/frequency settings for specified channels, refer to the command show interfaces transceiver channels. To show the current wavelength/frequency settings of an interface, refer to the command show interfaces transceiver hardware.

MRU Enforcement

Maximum Receive Unit (MRU) enforcement provides the ability to drop frames that exceed a configured threshold on the ingress interface.

Configuring MRU Enforcement

MRU is configurable per-interface, and can be configured on Ethernet and Port-Channel interfaces. Frames with size greater than the configured MRU value drop on the ingress, and do not forward to the destined egress interface. MRU enforcement happens at the Ethernet interface and applies to both L2 and L3 traffic. Note that FCS (frame check sequence) is included in the frame size.

Ethernet Interface

switch(config)# interface ethernet 1
switch(config)# l2 mru 9000

Frames with size greater than 9000 bytes ingressing into Ethernet1 are dropped.

Port-Channel Interface

Members of a Port-Channel interface inherit the Port-Channel interface’s MRU value. Members’ MRU configured in the Ethernet interface configuration mode has no effects.

switch(config)# interface ethernet 1 - 4
switch(config-if-Et1-4)# channel-group 10 mode active
switch(config)# interface port-Channel 10
switch(config-if-Po10)#

Frames with size greater than 9000 bytes ingressing into Ethernet1, 2, 3, and 4 are dropped.

Sub-interfaces

MRU configured on an Ethernet interface or Port-Channel are applied to all of its sub-interfaces.

Default Behaviours

By default, MRU is set to the maximum value.

For DCS-7280R3 and DCS-7500R3 series.
- The maximum MRU is 10240 bytes.
For other supported platforms
- In TapAgg mode, the maximum MRU is 10240 bytes.
- In non TapAgg mode, the maximum MRU is 10200 bytes.

MRU Enforcement Show commands

The show interface output displays the MRU on an interface.

switch(config)# show interface ethernet 1
Ethernet1 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 444c.a8b7.1ed8 (bia 444c.a8b7.1ed8)
  Member of Port-Channel10
  Ethernet MTU 10178 bytes, Ethernet MRU 1500 bytes, BW 10000000 kbit
  Full-duplex, 10Gb/s, auto negotiation: off, uni-link: disabled.

Counters

MRU-dropped packets are counted per-chip.

The show platform fap mapping output displays the mapping between the chips and their corresponding Ethernet interfaces.

switch(config)# show platform fap mapping interface Ethernet 1
Jericho0 (FapId: 0  BaseSystemCoreId: 0)
Port             SysPhyPort   Voq   Core  FapPort  OtmPort BaseQPair QPairs Xlge NifPort
----------------------------------------------------------------------------------------
Ethernet1        100          2608  0      2       0        0         8     8     33

The show hardware counter drop output displays the per-chip Reassembly Errors counters.

switch(config)# show hardware counter drop
Type  Chip       CounterName       : Count    : First Occurrence    : Last Occurrence
-----------------------------------------------------------------------------------------
A     Jericho0   ReassemblyErrors  : 12132989 : 2020-09-22 17:05:45 : 2020-09-22 17:22:40

Displaying Interface Interactions

The show interfaces interactions command provides a resource that explains various relationships between Ethernet interfaces. It describes interactions in which a configuration on an interface causes another set of interfaces to become inactive or have reduced capabilities. Examples include a primary interface consuming subordinate interfaces to service four-lane speed or platform restrictions that require four interfaces to operate at the same speed.

No Interactions

If no interaction information exists for the given interfaces, the output displays No interfaces interactions. Depending on what configurations have interactions, the line could appear at a number of different indentation levels. The display rules are as follows:

If all specified interfaces have no interactions, print at the first indentation level.
If only some specified interfaces have no interactions and those interfaces have no interactions at any speeds, print at the second indentation level for those interfaces.
If only some specified interfaces have no interactions and those interfaces only have interactions at some speeds, print at the third indentation level for those speeds.

switch# show int et1,2 interactions
No interfaces interactions
                            
switch# show int et1,2,5/1 interactions
* = includes less than 10G speeds that the interface is capable of
                            
Ethernet1
  No interactions with other interfaces
Ethernet2
  No interactions with other interfaces
Ethernet5/1
  For speed 40G
    Ethernet5/2-4 become inactive
  For speed 10G*
    No interactions with other interfaces

Inactive Interfaces

If a configuration on an interface causes other interfaces to become inactive, a message similar to the ones bolded below is displayed. A common example of this is configuring a QSFP28 port for 100GbE speed, which results in the /2,/3, and /4 interfaces becoming inactive. Note that display information for inactive interfaces is included in the specified range, ignoring whether or not inactive interfaces are exposed.

switch#show interfaces et11/1,11/3 interactions
* = includes less than 10G speeds that the interface is capable of
                    
Ethernet11/1:
  For speed 100G-4
  Ethernet11/2-4 become inactive
  For speed 50G-2
   Ethernet11/2,11/4 become inactive
    Ethernet11/3 is limited to 50G-2
   For speed 40G
     Ethernet11/2-4 become inactive
   For speed 25G
      Ethernet11/2-4 are limited to 25G
   For speed 10G*
      Ethernet11/2-4 are limited to 10G*
Ethernet11/3:
  For speed 50G-2
      Ethernet11/4 becomes inactive
       Primary interface Ethernet11/1 must be operating at 50G-2
  For speed 25G
       Primary interface Ethernet11/1 must be operating at 25G
  For speed 10G*
       Primary interface Ethernet11/1 must be operating at 10G*

Required Primary Interface Configuration

Some interface configurations require a particular primary interface configuration to function. These interactions are captured with messages similar to the ones bolded below.

switch#show interfaces et11/1,11/3 interactions
* = includes less than 10G speeds that the interface is capable of
                    
Ethernet11/1:
  For speed 100G-4
    Ethernet11/2-4 become inactive
  For speed 50G-2
    Ethernet11/2,11/4 become inactive
    Ethernet11/3 is limited to 50G-2
  For speed 40G
    Ethernet11/2-4 become inactive
  For speed 25G
    Ethernet11/2-4 are limited to 25G
  For speed 10G*
    Ethernet11/2-4 are limited to 10G*
    Ethernet11/3:
  For speed 50G-2
    Ethernet11/4 becomes inactive
   Primary interface Ethernet11/1 must be operating at 50G-2
  For speed 25G
    Primary interface Ethernet11/1 must be operating at 25G
  For speed 10G*
    Primary interface Ethernet11/1 must be operating at 10G*

Hardware Speed-Group Requirements

Some interface configurations require an additional speed-group configuration to operate correctly. If speed-group configurations are required, a message is displayed similar to the ones bolded below.

Note: A single speed-group may include more than one compatibility setting. Using the example below as reference, Ethernet1/1 at 100G-4 speed and Ethernet2/1 at 40G speed are compatible configurations as long as hardware speed-group 1 can include 50g and 10g rates simultaneously.

switch# show interfaces et1/1,2/1 interactions* = includes less than 10G speeds that the interface is capable of
                
Ethernet1/1:
  For speed 100G-4
    Ethernet1/2-4 become inactive
   Hardware speed-group 1 must include 50g
  For speed 40G
    Ethernet1/2-4 become inactive
   Hardware speed-group 1 must include 10g
  For speed 25G
    Ethernet2/1,2/3 become inactive
    Ethernet1/3 is limited to 25G/10G
    Hardware speed-group 1 must include 25g
  For speed 10G
    Ethernet2/1,2/3 become inactive
    Ethernet1/3 is limited to 25G/10G
   Hardware speed-group 1 must include 10g
    Ethernet2/1:
  For speed 100G-4
    Ethernet2/3 becomes inactive
    Ethernet1/1 must be operating at 100G-4/50G-2/40G
   Hardware speed-group 1 must include 50g
  For speed 40G
    Ethernet2/3 becomes inactive
    Ethernet1/1 must be operating at 100G-4/50G-2/40G
   Hardware speed-group 1 must include 10g

Compatible Parent Interface Configuration

The parent interface may be configured to any one of the compatible rates on the list. Additionally, more than one interface may be required to be configured at a compatible rate. These interactions are captured with messages similar to the ones bolded below

Note: Using the example below as a reference, suppose that Ethernet1/1 is configured to 100G-4 and that the goal is to configure Ethernet1/8 to 50G-1. According to the display, Ethernet1/1 is configured to a compatible rate. In order for Ethernet1/1 to operate at the 100G-4 speed, hardware speed-group 1 must be configured to include the 25g compatibility setting. Additionally, hardware speed-group 1 must also include the 50g compatibility setting to enable Ethernet1/8 to operate at 50G-1. Interactions on Ethernet1/5 and Ethernet1/7 must be considered as well.

switch# show interfaces et1/1,1/8 interactions
* = includes less than 10G speeds that the interface is capable of
                    
Ethernet1/1:
  Ethernet1/1-4/8 share 18 interface hardware resources
  For speed 400G-8
    Ethernet1/2-8 become inactive
    Hardware speed-group 1 must include 50g
  For speed 200G-4
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 50g
  For speed 100G-2
    Ethernet1/2 becomes inactive
    Hardware speed-group 1 must include 50g
  For speed 100G-4
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 25g
  For speed 50G-1
    Hardware speed-group 1 must include 50g
  For speed 50G-2
    Ethernet1/2 becomes inactive
    Hardware speed-group 1 must include 25g
  For speed 40G
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 10g
  For speed 25G
    Hardware speed-group 1 must include 25g
  For speed 10G
    Hardware speed-group 1 must include 10g
Ethernet1/8:
  For speed 50G-1
   Ethernet1/1 must be operating at 200G-4/100G-2/100G-4/50G-1/50G-2/40G/25G/10G
   Ethernet1/5 must be operating at 100G-2/50G-1/50G-2/25G/10G
   Ethernet1/7 must be operating at 50G-1/25G/10G
    Hardware speed-group 1 must include 50g

Speed-limited Interfaces

Some interface configurations limit the speed at which other interfaces can operate. If such limitations occur, a message is displayed similar to the ones bolded below.

switch# show interfaces et11/1,11/3 interactions
* = includes less than 10G speeds that the interface is capable of
                    
Ethernet11/1:
   For speed 100G-4
     Ethernet11/2-4 become inactive
   For speed 50G-2
     Ethernet11/2,11/4 become inactive
    Ethernet11/3 is limited to 50G-2
   For speed 40G
     Ethernet11/2-4 become inactive
   For speed 25G
    Ethernet11/2-4 are limited to 25G
   For speed 10G*
    Ethernet11/2-4 are limited to 10G*
Ethernet11/3:
  For speed 50G-2
    Ethernet11/4 becomes inactive
    Primary interface Ethernet11/1 must be operating at 50G-2
  For speed 25G
    Primary interface Ethernet11/1 must be operating at 25G
  For speed 10G*
    Primary interface Ethernet11/1 must be operating at 10G*

Interfaces Sharing Logical Ports

Some interface ranges share logical port resources. If an interface shares logical ports with other interfaces, a message displays similar to the ones bolded below.

Note: There must be logical ports available for an interface to become operational. Not all interfaces sharing logical ports can be operational simultaneously. Inactive interfaces do not consume a resource.

switch# show interfaces et1/1,4/1 interactions
* = includes less than 10G speeds that the interface is capable of
                    
Ethernet1/1:
  Ethernet1/1-4/8 share 18 interface hardware resources
     For speed 400G-8
        ...
Ethernet4/1:
  Ethernet1/1-4/8 share 18 interface hardware resources
     For speed 400G-8
           ...

Dynamic Link Flap Damping

Overview

Dynamic Link Flap Damping detects interfaces with excessive numbers of update messages (flapping) on the network and triggers a damping mechanism temporarily holding the interface’s link in a down state. This mechanism smooths out link flapping occurrences and reduces network churn.

The EOS Link Flap Damping algorithm uses the BGP Route Flap Damping algorithm described in IETF RFC 2439 as the basis for this feature. The algorithm maintains a demerit metric to represent the quality of the link. A higher metric indicates a poor quality of the link. When the link status transitions from an up to a down status, the demerit value of the link increases proportionally by a configured parameter. After the link demerit metric reaches the configured threshold, the link status changes to damped, and the status changes to down. Over time, the demerit metric exponentially decreases, and after the value reaches the configured reuse threshold, the link status changes to up, and the link becomes available on the network.

Link Flap Damping Algorithm Parameters

Remote Fault Penalty - The value added to the link demerit metric when the interface reports a remote fault.
Local Fault Penalty - The value added to the link demerit metric when the interface reports a local fault.
Suppress Threshold - The link demerit value for link damping.
Reuse Threshold - The link demerit value for a damped interface to recover and become available on the network.
Tracking Threshold - The link demerit value to stop the tracking of the interface for link damping. The value uses half of the reuse threshold value.
Maximum Threshold - The maximum possible value configured for the demerit metric.
Demerit Half Life Time - The time required for the demerit metric to degrade to half of the current value with no interface flaps. A lower half-life time translates to a faster recovery from the damped state.

Ethernet Configuration Procedures

These sections describe Ethernet and Management interface configuration procedures:

Physical Interface Configuration Modes
Assigning a MAC Address to an Interface
Port Groups (QSFP+ and SFP+ Interface Selection)
Referencing Modular Ports
Referencing Multi-lane Ports
Hitless Speed Change with Dynamic Logical Ports
QSFP+ Ethernet Port Configuration
QSFP100 Ethernet Port Configuration
CFP2 Ethernet Port Configuration
Default QSFP Mode Support
MXP Ethernet Port Configuration
Port Speed Capabilities
Agile Ports
Subinterface Configuration
Maximum Latency Tail-drop Thresholds
Autonegotiated Settings
Displaying Ethernet Port Properties
Ingress Counters
Configuring Ingress Traffic-Class Counters
Ingress and Egress Per Port for IPv4 and IPv6 Counters Overview
Hardware Counter Support
Configuring Power over Ethernet (PoE)
Configuring Link Fault Signaling
Ethernet OAM Connectivity Fault Management (CFM)
Configuring Hardware TCAM
CPU Traffic Policy
URL-based Field Sets in Traffic Policy
TCAM Profile for Configurable Port Qualifier Sizing
Configuring Dynamic Link Flap Damping
Internet Control Message Protocol (ICMP) Probing

Physical Interface Configuration Modes

The switch provides two configuration modes for modifying Ethernet parameters:

Interface-Ethernet mode configures parameters for specified Ethernet interfaces.
Interface-Management mode configures parameters for specified management Ethernet interfaces.

Physical interfaces cannot be created or removed.

Multiple interfaces can be configured simultaneously. Commands are available for configuring Ethernet-specific, Layer 2, Layer 3, and application layer parameters. Commands that modify protocol-specific settings in Ethernet configuration mode are listed in the protocol chapters.

The interface ethernet command places the switch in Ethernet-interface configuration mode.
The interface management command places the switch in management configuration mode.

Examples

This command places the switch in Ethernet-interface mode for interface ethernet 5-7 and 10.
```
switch(config)# interface ethernet 5-7,10
switch(config-if-Et5-7,10)#
```
This command places the switch in management-interface mode for management interface 1.
```
switch(config)# interface management 1
switch(config-if-Ma1)#
```

Assigning a MAC Address to an Interface

Ethernet and management interfaces are assigned a MAC address when manufactured. This address is the burn-in address.

The mac-address command assigns a MAC address to an interface in place of the burn-in address. The no mac-address command reverts an interface's current MAC address to its burn-in address.

Examples

This command assigns the MAC address of 001c.2804.17e1 to Ethernet interface 7.
```
switch(config-if-Et7)# mac-address 001c.2804.17e1
```

This command displays the MAC address of interface ethernet 7. The active MAC address is 001c.2804.17e1. The burn-in address is 001c.7312.02e2.

switch(config-if-Et7)# show interface ethernet 7
Ethernet7 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 001c.2804.17e1 (bia 001c.7312.02e2)
  Description: b.e45
switch(config-if-Et7)#

Port Groups (QSFP+ and SFP+ Interface Selection)

Several of Arista’s fixed switches limit the number of 10 Gb/s data lanes in operation through the use of port groups. A port group is a set of interfaces that can be configured as four SFP+ interfaces or a single QSFP+ interface. When configured in SFP+ mode, the port group enables four standalone 10GbE interfaces using SFP+ optics. When configured in QSFP+ mode, the port group enables a single QSFP+ interface (in addition to the dedicated QSFP+ ports), which can operate as a single 40GbE port or as four 10GbE ports with the appropriate breakout cabling.

Hardware port groups are used on the following systems:

DCS-7050Q-16
DCS-7050QX-32S

Use the hardware port-group command to select the interface mode for the specified port group.

Note: The hardware port-group command restarts the forwarding agent, which disrupts traffic on all switch ports.

Example

These commands configure the DCS-7050-Q16 switch to enable four SFP+ interfaces and one extra QSFP+ interface by enabling the SFP+ interfaces in port-group 1 and the QSFP+ interface in port-group 2.

switch(config)# hardware port-group 1 select Et17-20
switch(config)# hardware port-group 2 select Et16/1-4

The show hardware port-group command displays the status of ports in the port groups.

Example

This command displays the status of the flexible ports within the two port groups on a DCS-7050Q-16 switch.

switch# show hardware port-group

Portgroup: 1    Active Ports: Et17-20
Port            State
------------------------------------------
Ethernet17      Active
Ethernet18      Active
Ethernet19      Active
Ethernet20      Active
Ethernet15/1    ErrDisabled
Ethernet15/2    ErrDisabled
Ethernet15/3    ErrDisabled
Ethernet15/4    ErrDisabled

Portgroup: 2    Active Ports: Et16/1-4
Port            State
------------------------------------------
Ethernet16/1Active
Ethernet16/2Active
Ethernet16/3Active
Ethernet16/4Active
Ethernet21ErrDisabled
Ethernet22ErrDisabled
Ethernet23ErrDisabled
Ethernet24ErrDisabled

DCS-7280CR3-36S

The DCS-7280CR3-36S has 28 dedicated 100Gb/s QSFP ports, plus two port groups. The port groups support either two additional QSFP-DD (400Gb/s) ports or four QSFP56 (200Gb/s) ports as shown in Table 3.

Table 3. DCS-7280CR3-36S Port Groups
Port Group 1 Active Interface(s)		Port Group 2 Active Interface(s)
In QSFP-DD Mode	In QSFP56 Mode (Default)	In QSFP-DD Mode	In QSFP56 Mode (Default)
Et33/1-8 (one QSFP-DD port)	Et33/1-4,Et34/1-4 (two QSFP56 ports)	Et35/1-8 (one QSFP-DD port)	Et35/1-4,Et36/1-4 (two QSFP56 ports)

DCS-7050Q-16

The DCS-7050Q-16 has 14 dedicated QSFP+ ports plus two port groups. The port groups support either two additional QSFP+ ports or eight SFP+ ports, as shown in DCS-7050Q-16 Port Groups.

Table 4. DCS-7050Q-16 Port Groups
Port Group 1 Active Interface(s)		Port Group 2 Active Interface(s)
In SFP+ Mode	In QSFP+ Mode (Default)	In SFP+ Mode	In QSFP+ Mode (Default)
Et17-20 (four SFP+ ports)	Et15/1-4 (one QSFP+ port)	Et21-24 (four SFP+ ports)	Et16/1-4 (one QSFP+ port)

DCS-7050QX-32S

The DCS-7050QX-32S has 31 dedicated QSFP+ ports plus one port group. The port group supports either one additional QSFP+ port or four SFP+ ports, as shown in DCS-7050QX-32S Port Groups.

Table 5. DCS-7050QX-32S Port Groups
Port Group 1 Active Interface(s)
In SFP+ Mode	In QSFP+ Mode (Default)
Et1-4 (four SFP+ ports)	Et5/1-4 (one QSFP+ port)

Referencing Modular Ports

Arista modular switches provide port access through installed line cards. A modular switch's maximum number of line cards varies with the switch series and model.

Several CLI commands modify modular parameters for all ports on a specified line card or controlled by a specified chip. This manual uses these conventions to reference modular components:

card_x refers to a line card.
module_y refers to a QSFP+ module.
port_z refers to a line card or module port.

Commands that display Ethernet port status use the following conventions:

SFP ports: card_x/port_z to label the line card/port location of modular ports.
QSFP ports: card_x/module_y/port_z to label the line card/port location of modular ports.

The QSFP+ Ethernet Port Configuration section describes QSFP+ module usage.

Example

This command displays the status of interfaces 1 to 9 on line card 4:

switch# show interface ethernet 4/1-9 status
Port      Name              Status       Vlan        Duplex  Speed Type
Et4/1                       connected    1             full    10G Not Present
Et4/2                       connected    1             full    10G Not Present
Et4/3                       connected    1             full    10G Not Present
Et4/4                       connected    1             full    10G Not Present
Et4/5                       connected    1             full    10G Not Present
Et4/6                       connected    1             full    10G Not Present
Et4/7                       connected    1             full    10G Not Present
Et4/8                       connected    1             full    10G Not Present
Et4/9                       connected    1             full    10G Not Present
switch>

Referencing Multi-lane Ports

EOS supports two types of Ethernet ports:

single-lane (also called fixed-lane).
multi-lane (also called flexible-lane).

Single-lane (or fixed-lane) ports are always modeled as a single interface within EOS. While the speed of the interface may be configurable, the physical port can never be broken out into multiple lower-speed interfaces. Single-lane ports use the following naming scheme:

Ethernet <port #> (for fixed switches).
Ethernet <module #>/<port #> (for modular switches).

Multi-lane (or flexible lane) ports comprise multiple parallel lanes, each served by its own laser. Multi-lane ports can be configured to combine the lanes and operate as a single native high-speed interface (a 40GbE or 100GbE interface) or to operate each lower-speed interface independently (four 10GbE or 25GbE interfaces). Multi-lane ports use the following naming scheme:

Ethernet port #/lane # (for fixed switches).
Ethernet module #/port #/lane # (for modular switches).

The operational state displayed for each lane of a multi-lane port is determined by the configuration applied to the primary lane(s), as shown in the Lane States table. When broken out into multiple lower-speed interfaces, all lanes are active in parallel, and each will display its operational state as connected or not connected. In high-speed mode, only the primary lane(s) are displayed as active, with the remaining lanes showing as errdisabled. The exception is the CFP2 module: when it is configured as a single 100GbE port, the primary lane is displayed as active in the CLI while the other lanes are hidden.

Table 6. Lane States
Parent Port Configured Mode	Primary Lane(s)	Secondary Lanes
single high-speed interface	active (connected/not connected)	inactive (errdisabled)
multi-interface breakout	active (connected/not connected)	active (connected/not connected)

A multi-lane port is configured as a single high-speed interface or multiple breakout interfaces by using the speed command on the port's primary lane(s). For specific configuration instructions and details regarding the primary lane(s) of a specific interface, refer to the configuration section of the appropriate interface type:

QSFP+ Ethernet Port Configuration
QSFP100 Ethernet Port Configuration
CFP2 Ethernet Port Configuration
MXP Ethernet Port Configuration

Note: Use of the speed command to configure a multi-lane port is hitless on the 7050X, 7060X, 7250X, 7260X, 7280CR3, 7280SE, 7300X, 7320X, and 7500E series platforms. On all other platforms, this command restarts the forwarding agent, which results in traffic disruption. On the 7160 series platform, use of the speed command is hitless but, if the command changes the number of port lanes, packets may be dropped on unrelated ports.

Hitless Speed Change with Dynamic Logical Ports

Higher speed ports on several switches can be broken out into multiple interfaces that can be configured at lower speeds. Each of these interfaces is called a Logical Port (LP). Switches such as the DCS-7260CX3-64 allocate and deallocate the logical ports dynamically to optimize hardware resources. Care must be taken for hitless speed changes, as a speed change on a Dynamic Logical Port (DLP) may impact the status of one or more related DLP(s).

Checking the Status of DLPs

The following example applies to a switch that supports a breakout of a 100GbE physical port into 4 25GbE DLPs.

The following command displays the status of Et45/1-4 when a 100GbE physical port is broken out into 4 25GbE DLPs.

switch(config)# show interfaces ethernet 45/1-4 status
Port   	Name   Status       Vlan 	Duplex Speed  Type        Flags 
Et45/1        	notconnect   1    	full   25G    Not Present
Et45/2        	notconnect   1    	full   25G    Not Present
Et45/3        	notconnect   1    	full   25G    Not Present
Et45/4        	notconnect   1    	full   25G    Not Present

The following example displays the inactive interfaces (DLPs) when the 100GbE physical port is configured to the 100G speed.

switch(config)# show interfaces ethernet 45/1-4 status
Port   	Name   Status       Vlan 	Duplex Speed  Type        Flags
Et45/1        	notconnect   1    	full   100G   Not Present
Et45/2        	inactive     1    	unconf unconf Not Present
Et45/3        	inactive     1    	unconf unconf Not Present
Et45/4        	inactive     1    	unconf unconf Not Present

By default, inactive interfaces are not displayed by this command. To enable showing them, use the following command.

switch(config)# [no] service interface inactive expose

Only systems without DLP allocation have enough logical ports for every interface to be active simultaneously.

The following example displays the logical port pool information and current logical port allocation status for a fully loaded switch.

switch> show hardware logical-port pool status
Pool Max Free Configured Interfaces
---- --- ---- ---------- ------------------------------------------------------
   1  18    2         16 Et2/5/1-2/8/4,3/5/1-3/8/4,4/5/1-4/8/4,5/9/1-5/12/4
   2  18    2         16 Et2/1/1-2/4/4,3/9/1-3/12/4,4/1/1-4/4/4,5/5/1-5/8/4
   3  18    2         16 Et2/9/1-2/12/4,3/1/1-3/4/4,4/9/1-4/12/4,5/1/1-5/4/4
   4  18    2         16 Et2/13/1-2/16/4,3/13/1-3/16/4,4/13/1-4/16/4,5/13/1-5/16/4
   5  18    2         16 Et6/13/1-6/16/4,7/13/1-7/16/4,8/13/1-8/16/4,9/13/1-9/16/4
   6  18    2         16 Et6/1/1-6/4/4,7/9/1-7/12/4,8/1/1-8/4/4,9/9/1-9/12/4
   7  18    2         16 Et6/5/1-6/8/4,7/1/1-7/4/4,8/9/1-8/12/4,9/1/1-9/4/4
   8  18    2         16 Et6/9/1-6/12/4,7/5/1-7/8/4,8/5/1-8/8/4,9/5/1-9/8/4

The following example displays the logical port pool information and current logical port allocation status for a switch with only line cards 3, 4, 5, and 7 inserted.

switch> show hardware logical-port pool status
Pool Max Free Configured Interfaces
---- --- ---- ---------- ------------------------------------------------------
   1  18    8         10 Et3/5/1-3/8/4,4/2/1-8,5/3/1-8
   2  18   12          6 Et3/9/1-3/12/4,4/1/1-8,5/2/1-8
   3  18    8         10 Et3/1/1-3/4/4,4/3/1-8,5/1/1-8
   4  18    7         11 Et3/13/1-3/16/4,4/4/1-8,5/4/1-8
   5  18   16          2 Et7/13/1-7/16/4
   6  18   14          4 Et7/9/1-7/12/4
   7  18   14          4 Et7/1/1-7/4/4
   8  18   12          6 Et7/5/1-7/8/4

QSFP+ Ethernet Port Configuration

Each QSFP+ module contains four data lanes which can be used individually or combined to form a single, higher-speed interface. This arrangement allows a QSFP+ Ethernet port to be configured as a single 40GbE interface or four 10GbE interfaces.

When the four lanes are combined to form a 40GbE interface, show commands display lane /1 as connected or not connected and display lanes /2 through /4 as errdisabled.

The following sections describe the configuration of QSFP+ ports.

Configuring a QSFP+ Module as a Single 40GbE Interface

To configure a port as a single 40GbE interface, combine the module’s four data lanes using the speed command (speed forced 40g full) on the port’s /1 lane (the primary lane).

Note: Use of the speed command to configure a multi-lane port is hitless on the 7050X, 7060X, 7250X, 7260X, 7280SE, 7300X, 7320X, and 7500E series platforms. On all other platforms, this command restarts the forwarding agent, which results in traffic disruption. On the 7160 series platform, use of the speed command is hitless but, if the command changes the number of port lanes, packets may be dropped on unrelated ports.

Enter interface Ethernet configuration mode for lane /1 of the QSFP+ Ethernet interface.
```
switch(config)# interface ethernet 5/1/1
```
Enter the speed 40gfull command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 40gfull
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status
Port Name Status       Vlan  Duplex  Speed   Type         Flags
Et1       connected    2     full    1G      10GBASE-T
    <-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1   connected    1     full    40G     40GBASE-SR4
Et5/1/2   errdisabled  1     unconf  unconf  40GBASE-SR4
Et5/1/3   errdisabled  1     unconf  unconf  40GBASE-SR4
Et5/1/4   errdisabled  1     unconf  unconf  40GBASE-SR4
     <-------OUTPUT OMITTED FROM EXAMPLE-------->

Configuring a QSFP+ Module as Four 10GbE Interfaces

To configure a port as four 10GbE interfaces, use the speed command (speed 10000full) on the port’s /1 lane (the primary lane).

Enter interface Ethernet configuration mode for lane /1 of the QSFP+ Ethernet interface.
```
switch(config)# interface ethernet 5/1/1
```
Enter the speed 10000full command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 10000full
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status  
PortNameStatusVlanDuplexSpeedTypeFlags 
Et1connected2full1G10GBASE-T 
Et5/1/1connected1full10G40GBASE-SR4 
Et5/1/2connected1full10G40GBASE-SR4 
Et5/1/3connected1full10G40GBASE-SR4 
Et5/1/4connected1full10G40GBASE-SR4

QSFP100 Ethernet Port Configuration

Each QSFP100 module contains four data lanes which can be used individually or combined to form a single, higher-speed interface. This arrangement allows a QSFP100 Ethernet port to be configured as a single 100GbE interface, a single 40GbE interface, or four 10GbE interfaces. The default mode is a single 100GbE interface.

The 7060X, 7260X, and 7320X platforms also allow a QSFP100 port to be configured as two 50GbE interfaces or four 25GbE interfaces.

When the lanes are combined to form a higher-speed interface, show commands display the primary lane(s) as connected or not connected and the other lanes as errdisabled.

The following sections describe the configuration of QSFP+ ports.

Configuring a QSFP100 Module as a Single 100GbE Interface

By default, a QSFP100 module operates as a single 100GbE interface. Applying the default speed or no speed command on the primary lane restores the default behavior.

To explicitly configure the port as a single 100GbE interface, combine the module’s four data lanes using the speed command (speed 100gfull) on the port’s /1 lane (the primary lane).

Enter the interface Ethernet configuration mode for lane /1 of the QSFP100 Ethernet interface.
```
switch(config)# interface ethernet 5/1/1
```
Enter the speed 100gfull command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 100gfull
```

Use the show interfaces status command to confirm the change in the configuration.


switch(config-if-Et5/1/1)# show interfaces status
Port    Name     Status       Vlan  Duplex  Speed  Type         Flags 
Et1              connected    2     full    1G     10GBASE-T 
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1          connected    1     full    100G   100GBASE-SR4 
Et5/1/2          errdisabled  1     unconf  unconf 100GBASE-SR4 
Et5/1/3          errdisabled  1     unconf  unconf 100GBASE-SR4 
Et5/1/4          errdisabled  1     unconf  unconf 100GBASE-SR4
<-------OUTPUT OMITTED FROM EXAMPLE-------->

Configuring a QSFP100 Module as Two 50GbE Interfaces

To configure a port as two 50GbE interfaces, configure the module’s four data lanes using the speed command (speed 50gfull) on the port’s /1 and /3 lanes. This configuration is available on the 7060X, 7260X, and 7320X platforms.

Note:

Use of the speed command to configure a multi-lane port is hitless on the 7050X, 7060X, 7250X, 7260X, 7280CR3, s7280SE, 7300X, 7320X, and 7500E series platforms. On all other platforms, this command restarts the forwarding agent, whichresults in traffic disruption. On the 7160 series platform, use of the speed command is hitless but, if the command changes the number of port lanes, packets may be dropped on unrelated ports.

Enter the interface Ethernet configuration mode for lane /1 of the QSFP100 Ethernet interface.
```
switch(config)# interface ethernet 5/1/1
```
Enter the speed 50gfullcommand. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 50gfull
```

Repeat the above steps for lane /3.

switch(config-if-Et5/1/1)# interface ethernet 5/1/3
switch(config-if-Et5/1/3)# speed 50gfull

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status 
Port       Name    Status       Vlan  Duplex  Speed  Type         Flags
Et1                connected    2     full    1G     10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1            connected    1     full    50G    100GBASE-SR4
Et5/1/2            errdisabled  1     unconf  unconf 100GBASE-SR4
Et5/1/3            connected    1     full    50G    100GBASE-SR4
Et5/1/4            errdisabled  1     unconf  unconf 100GBASE-SR4
<-------OUTPUT OMITTED FROM EXAMPLE-------->

Configuring a QSFP100 Module as a Single 40GbE Interface

To configure a port as a single 40GbE interface, combine the module’s four data lanes by using the speed command (speed 40gfull) on the ports /1 lane (the primary lane).

Note:

Use of the speed command to configure a multi-lane port is hitless on the 7050X, 7060X, 7250X, 7260X, 7280CR3, 7280SE, 7300X, 7320X, and 7500E series platforms. On all other platforms, this command restarts the forwarding agent, which results in traffic disruption. On the 7160 series platform, use of the speed command is hitless but, if the command changes the number of port lanes, packets may be dropped on unrelated ports.

Enter interface Ethernet configuration mode for lane /1 of the QSFP100 Ethernet interface.
```
switch(config)# interface ethernet 5/1/1
```
Enter the speed 40gfull command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 40gfull 
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status
Port     Name     Status       Vlan  Duplex  Speed   Type         Flags
Et1               connected    2     full    1G      10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1           connected    1     full    40G     100GBASE-SR4
Et5/1/2           errdisabled  1     unconf  unconf  100GBASE-SR4
Et5/1/3           errdisabled  1     unconf  unconf  100GBASE-SR4
Et5/1/4           errdisabled  1     unconf  unconf  100GBASE-SR4
<-------OUTPUT OMITTED FROM EXAMPLE-------->

Configuring a QSFP100 Module as Four 10GbE Interfaces

To configure a port as four 10GbE interfaces, use the speed command (speed 10000full) on the port’s /1 lane (the primary lane).

Enter the interface Ethernet configuration mode for lane /1 of the QSFP100 Ethernet interface.
```
switch(config)# interface ethernet 5/1/1 
```
Enter the speed 10000full command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 10000full 
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status 
Port       Name       Status      Vlan  Duplex  Speed  Type         Flags
Et1                   connected   2     full    1G     10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1               connected   1     full    10G    100GBASE-SR4
Et5/1/2               connected   1     full    10G    100GBASE-SR4
Et5/1/3               connected   1     full    10G    100GBASE-SR4
Et5/1/4               connected   1     full    10G    100GBASE-SR4
<-------OUTPUT OMITTED FROM EXAMPLE-------->

CFP2 Ethernet Port Configuration

Each CFP2 module contains ten data lanes. The configuration options available on the port depend on the optic inserted:

CFP2-100G-LR4 optics operate only in 100GbE mode.
CF2-100G-ER4 optics operate only 100GbE mode.
CFP2-100G-XSR10 optics can be configured as a single 100GbE interface or as ten 10GbE interfaces.

When the port is configured as ten 10GbE interfaces, each lane is active and visible in the CLI show commands. When the lanes are combined to form a single 100GbE interface, show commands display the primary lane as connected or not connected and all other lanes are hidden.

The following sections describe the configuration of CFP2 ports.

Configuring a CFP2 Module as a Single 100GbE Interface

To configure a port as a single 100GbE interface (the default configuration), combine the module’s ten data lanes by using the speed command (speed 100gfull) on the port’s /1 lane (the primary lane).

This configuration is available for all pluggable optics.

Enter the interface Ethernet configuration mode for lane /1 of the CFP2 Ethernet interface.
```
switch(config)# interface ethernet 5/1/1 
```
Enter the speed 100gfull command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 100gfull
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status 
Port      Name      Status     Vlan  Duplex  Speed  Type         Flags
Et1                 connected  2     full    1G     10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1             connected  1     full    100G   100GBASE-SR1
Et5/2/1             connected  1     full    100G   100GBASE-SR1
<-------OUTPUT OMITTED FROM EXAMPLE-------->

Configuring a CFP2 Module as Ten 10GbE Interfaces

To configure a port as four 10GbE interfaces, use the speed command (speed 10000full) on the port’s /1 lane (the primary lane).

This configuration is available only for CFP2-100G-XSR10 optics.

Enter the interface Ethernet configuration mode for lane /1 of the CFP2 Ethernet interface.
```
switch(config)# interface ethernet 5/1/1
```
Enter the speed 10000full command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/1/1)# speed 10000full 
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/1/1)# show interfaces status
Port     Name   Status     Vlan  Duplex  Speed  Type         Flags
Et1             connected  2     full    1G     10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1         connected  1     full    10G    100GBASE-SR1
Et5/1/2         connected  1     full    10G    100GBASE-SR1
Et5/1/3         connected  1     full    10G    100GBASE-SR1
Et5/1/4         connected  1     full    10G    100GBASE-SR1
Et5/1/5         connected  1     full    10G    100GBASE-SR1
Et5/1/6         connected  1     full    10G    100GBASE-SR1
Et5/1/7         connected  1     full    10G    100GBASE-SR1
Et5/1/8         connected  1     full    10G    100GBASE-SR1
Et5/1/9         connected  1     full    10G    100GBASE-SR1
Et5/1/10        connected  1     full    10G    100GBASE-SR1
<-------OUTPUT OMITTED FROM EXAMPLE-------->

Default QSFP Mode Support

A QSFP+ transceiver supports 40GbE and 4x10GbE. This feature supports changing the default QSFP mode between 40GbE and 4x10GbE on all ports with QSFP+ transceivers.

Configuration

On all front panel ports that support this feature, the following global configuration command changes their default QSFP mode from 40GbE to 4x10GbE.

transceiver qsfp default-mode 4x10G

The no or default version of the command reverts the default QSFP mode to 40GbE.

Note: This configuration command is not honored on ports that do not support this feature (such as QSFP100 ports with external PHY, always choose 40GbE as the default QSFP mode).

Show Commands

There is no explicit show command to display the default QSFP mode. Use the show running-config command to determine whether the default QSFP mode is 4x10GbE or 40GbE. Use the show interfaces hardware command to check the default QSFP mode on the given ports.

When the default QSFP mode is configured as 4x10GbE, the output of show running-config contains transceiver qsfp default-mode 4x10G. In the output of the show interfaces hardware command, 10G is shown as the default speed.

switch(config)# transceiver qsfp default-mode 4x10G
switch(config)# show running-config | grep 4x10G
transceiver qsfp default-mode 4x10G
switch(config)# show interfaces ethernet 35/1 hardware
*  = Requires speed group setting change
Ethernet35/1
  Model:          DCS-7280CR3-32P4
  Type:           40GBASE-CR4
  Speed/Duplex:   10G/full(default),40G/full,auto
  Flowcontrol:    rx-(off,on,desired),tx-(off)

When the QSFP mode configuration is reverted to the default, the output of the show running-config command does not contain transceiver qsfp default-mode 4x10G. In the output of the show interfaces hardware command, 40G is shown as the default speed.

switch(config)# no transceiver qsfp default-mode
switch(config)# show running-config | grep 4x10G
switch(config)# show interfaces ethernet 35/1 hardware
*  = Requires speed group setting change
Ethernet35/1
  Model:          DCS-7280CR3-32P4
  Type:           40GBASE-CR4
  Speed/Duplex:   10G/full,40G/full(default),auto
  Flowcontrol:    rx-(off,on,desired),tx-(off)

Limitations

There is support for the no transceiver qsfp default-mode 4x10G command on the DCS-7300X series, but the default QSFP mode remains 4x10GbE.

MXP Ethernet Port Configuration

Each MXP module contains twelve data lanes which can be used individually or combined to form one or more higher-speed interfaces. This arrangement allows an MXP Ethernet port to be configured as a single 100GbE interface, as up to twelve 10GbE interfaces, or as a mixture of 40GbE and 10GbE ports.

MXP ports do not use pluggable optics. Instead, an MTP-24 cable is inserted directly into the port. The remote end of the MTP-24 cable must then be broken out using a splitter cable or a cartridge based on the operational mode and speed of the MXP port.

When four lanes of an MXP interface are combined to form a 40GbE port, CLI commands show the primary lane of that group as connected or not connected and the other three lanes as errdisabled.

The following sections describe the configuration of MXP interfaces.

Configuring an MXP Module as a Single 100GbE Interface

To configure a port as a single 100GbE interface (the default configuration), enter the speed command (speed 100gfull) on the port’s /1 lane (the primary lane). This configuration combines lanes 1-10 and disables lanes 11 and 12.

With this configuration, show commands display lane /1 as connected or not connected, and lanes /2-/12 as errdisabled.

Enter interface Ethernet configuration mode for lane /1 of the MXP Ethernet interface.
```
switch(config)# interface ethernet 5/49/1
```
Enter the speed 100gfull command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/49/1)# speed 100gfull
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/49/1)# show interfaces status 
Port          Name        Status        Vlan        Duplex     Speed    Type          Flags
Et1                       connected     2           full       1G       10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/49/1                  connected     1           full       100G     100GBASE-SR1
Et5/49/2                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/3                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/4                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/5                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/6                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/7                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/8                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/9                  errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/10                 errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/11                 errdisabled   1           unconf     unconf   100GBASE-SR1
Et5/49/12                 errdisabled   1           unconf     unconf   100GBASE-SR1

Configuring an MXP Module With 40GbE Interfaces

Each set of four lanes on an MXP module is independently configurable as a single 40GbE interface or four 10GbE interfaces. To configure four lanes as a single 40GbE interface, enter the speed command (speed forced 40gfull) on the group’s primary lane (/1, /5, or /9). To revert a group of four lanes to functioning as four independent 10GbE interfaces, enter the speed 10000full command on the primary lane of the group.

When four lanes of an MXP interface are combined to form a 40GbE port, CLI commands will show the primary lane of that group as connected or not connected and the other three lanes as errdisabled. In groups of four lanes configured as four independent 10GbE interfaces, each lane will be displayed in the CLI as connected or not connected.

Note that entering a speed forced 100gfull command on the /1 lane takes precedence over speed 40gfull commands on the /5 and /9 lanes.

The following example shows the steps for configuring an MXP module as three 40GbE interfaces.

Enter interface Ethernet configuration mode for lane /1 of the MXP Ethernet interface.
```
switch(config)# interface ethernet 5/49/1
```
Enter the speed 40gfull command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/49/1)# speed 40gfull
```

Repeat the above steps for lanes /5 and /9.

switch(config-if-Et5/49/1)# interface ethernet 5/49/5 
switch(config-if-Et5/49/5)# speed 40gfull
switch(config-if-Et5/49/5)# interface ethernet 5/49/9
switch(config-if-Et5/49/9)# speed 40gfull

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/49/9)# show interfaces status 
Port Name    Status          Vlan  Duplex   Speed    Type         Flags
Et1          connected       2     full     1G       10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/49/1     connected       1     full     40G      100GBASE-SR1
Et5/49/2     errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/3     errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/4     errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/5     connected       1     full     40G      100GBASE-SR1
Et5/49/6     errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/7     errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/8     errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/9     connected       1     full     40G      100GBASE-SR1
Et5/49/10    errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/11    errdisabled     1     unconf   unconf   100GBASE-SR1
Et5/49/12    errdisabled     1     unconf   unconf   100GBASE-SR1

Configuring an MXP Module as Twelve 10GbE Interfaces

Each lane of an MXP port functions as a 10GbE interface when it is not included in a higher-speed interface configuration (either actively or as an errdisabled port).

To explicitly configure a port as twelve 10GbE interfaces, use the speed command (speed 10000full) on all twelve lanes of the port.

When each lane is configured as an independent 10GbE interface, show commands display each lane as connected or not connected.

Note: Use of the speed command to configure a multi-lane port is hitless on the 7050X, 7060X, 7250X, 7260X, 7280CR3, 7280SE, 7300X, 7320X, and 7500E series platforms. On all other platforms, this command restarts the forwarding agent, which results in traffic disruption. On the 7160 series platform, use of the speed command is hitless, but if the command changes the number of port lanes, packets may be dropped on unrelated ports.

Enter interface Ethernet configuration mode for all twelve lanes of the MXP Ethernet interface.
```
switch(config)# interface ethernet 5/49/1-12
```
Enter the speed 10000full command. Depending on the platform, this command may restart the forwarding agent, disrupting traffic on all ports for 60 seconds or more.
```
switch(config-if-Et5/49/1-12)# speed 10000full
```

Use the show interfaces status command to confirm the change in the configuration.

switch(config-if-Et5/49/1-12)# show interfaces status 
Port       Name     Status      Vlan  Duplex  Speed  Type          Flags
Et1                 connected   2     full    1G     10GBASE-T
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et5/1/1             connected   1     full    10G    100GBASE-SR1
Et5/1/2             connected   1     full    10G    100GBASE-SR1
Et5/1/3             connected   1     full    10G    100GBASE-SR1
Et5/1/4             connected   1     full    10G    100GBASE-SR1
Et5/1/5             connected   1     full    10G    100GBASE-SR1
Et5/1/6             connected   1     full    10G    100GBASE-SR1
Et5/1/7             connected   1     full    10G    100GBASE-SR1
Et5/1/8             connected   1     full    10G    100GBASE-SR1
Et5/1/9             connected   1     full    10G    100GBASE-SR1
Et5/1/10            connected   1     full    10G    100GBASE-SR1
<-------OUTPUT OMITTED FROM EXAMPLE-------->

Port Speed Capabilities

The Supported Speeds (Gb/s) table shows the various speeds supported on each Arista platform per interface type.

Table 7. Supported Speeds (Gb/s)
Platform	SFP+	SFP28	QSFP+	QSFP100	MXP	CFP2
7050	100M, 1, 10	N/A	1, 10, 40	N/A	N/A	N/A
7050X	100M, 1, 10	N/A	1, 10, 40	N/A	10, 40	N/A
7050X2	100M, 1, 10	N/A	1, 10, 40	N/A	N/A	N/A
7050X3	100M, 1, 10	1, 10, 25	N/A	10, 25, 40, 50, 100	N/A	N/A
7250X	N/A	N/A	1, 10, 40	N/A	N/A	N/A
7060X	100M, 1, 10	N/A	N/A	10, 25, 40, 50, 100	N/A	N/A
7060X2	100M, 1, 10	1, 10, 25	N/A	10, 25, 40, 50, 100	N/A	N/A
7260X3	100M, 1, 10	N/A	N/A	10, 25, 40, 50, 100	N/A	N/A
7300X	100M, 1, 10	N/A	1, 10, 40	N/A	N/A	N/A
7300X3	N/A	1, 10, 25	N/A	10, 25, 40, 50, 100	N/A	N/A
7320X	N/A	N/A	N/A	10, 25, 40, 50, 100	N/A	N/A
7150S	1, 10	N/A	1, 10, 40	N/A	N/A	N/A
7048T	1, 10	N/A	N/A	N/A	N/A	N/A
7500	1, 10	N/A	1, 10, 40	N/A	N/A	N/A
7500E	1, 10	N/A	1, 10, 40	10, 40, 100	10, 40, 100	100
7500R	1, 10	1, 10, 25	1, 10, 40	10, 25, 40, 50, 100	N/A	N/A
7280SE	1, 10	N/A	1, 10, 40	10, 40, 100	10, 40, 100	N/A
7280QR	N/A	N/A	1, 10, 40	10, 25, 40, 50, 100	N/A	N/A
7280SR (R2)	1, 10	1, 10, 25	N/A	10, 25, 40, 50, 100	N/A	100, 200
7280CR	N/A	N/A	N/A	10, 25, 40, 50, 100	N/A	N/A
7010T	100M, 1, 10	N/A	N/A	N/A	N/A	N/A

Agile Ports

An agile port is an interface that can function as a 10GbE port or can subsume a predefined set of 10GbE interfaces to form an interface with higher speed capabilities.

The set of interfaces that can be combined to form a higher speed port is restricted by the hardware configuration. Only interfaces that pass through a common PHY component can be combined. One interface within a combinable set is designated as the primary port.

To view the set of available agile ports and the subsumable interfaces that comprise them, enter the show platform fm6000 agileport map command.
To configure the primary port as a higher speed port, enter speed 40gfull or speed auto 40gfull.
To revert the primary port and its subsumed ports to 10GbE interfaces, enter no speed.

Subinterface Configuration

For a subinterface to be operational on an Ethernet or port channel interface, the parent interface must be configured as a routed port, must be administratively up, and a VLAN must be configured on the subinterface. If the parent interface goes down, all subinterfaces automatically go down as well. After the parent interface comes back up, the subinterfaces come back up too with the same configuration.

Note that a port channel should not contain Ethernet interfaces with subinterfaces configured on them. Subinterfaces cannot be members of a port channel.

Subinterfaces are named by adding a period followed by a unique subinterface number to the name of the parent interface. Note that the subinterface number has no relation to the ID of the VLAN corresponding to the subinterface.

Subinterfaces are available on the following platforms:

DCS-7050X
DCS-7060X
DCS-7250X
DCS-7260X
DCS-7280E
DCS-7300X
DCS-7320X
DCS-7500E

Creating a Subinterface

To create a subinterface on an Ethernet or port channel interface, follow these steps:

Bring up the parent interface and ensure that it is configured as a routed port.

switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# no switchport 
switch(config-if-Et1/1)# no shutdown

Configure a VLAN on the subinterface. The encapsulation dot1q vlan command associates a VLAN with the subinterface (and, in other scenarios, it is also used for VLAN translation).
```
switch(config-if-Et1/1)# interface Ethernet1/1.1
switch(config-if-Et1/1.1)# encapsulation dot1q vlan 100
```

Configure an IP address on the subinterface (optional) and ensure that it is not shut down.

switch(config-if-Et1/1)# ip address 10.0.0.1/24
switch(config-if-Et1/1)# no shutdown 
switch(config-if-Et1/1)#

Creating a Range of Subinterfaces

A range of subinterfaces can also be configured simultaneously. The following example configures subinterfaces 1 to 100 on Ethernet interface 1/1 and assigns VLANs 501 through 600 to them. Note that the range of interfaces must be the same size as the range of VLAN IDs.

Example

switch(config)# interface eth1/1.1-100
switch(config-if-Et1/1.1-100)# no shutdown
switch(config-if-Et1/1.1-100)# encapsulation dot1q vlan {501,600}
switch(config-if-Et1/1.1-100)# exit
switch(config)#

Parent Interface Configuration

For subinterfaces to function, the parent interface must be administratively up and configured as a routed port.

Subinterfaces inherit some settings from the parent interface. These include QoS (trust mode and default DSCP) and MTU.

Additionally, on the DCS-7050X, DCS-7250X, and DCS-7300X platforms, the parent interface may be configured with an IP address. In this case, untagged packets are treated as incoming traffic on the parent interface.

Configuring Routing Features on a Subinterface

After you create a subinterface, you can configure the following features on it:

Unicast and multicast routing.
BGP, OSPF, ISIS, PIM.
VRF.
VRRP.
SNMP.
Inheritance of QoS (trust mode and default DSCP) and MTU settings from the parent interface.

Additionally, these features can be configured on subinterfaces on Arad (DCS-7500E and DCS-7280E) platforms:

Subinterface counters on ingress.
VXLAN.
MPLS.
GRE.
PBR.
QoS.

Displaying Subinterface Information

Subinterface information is displayed using the same show commands as for other interfaces.

Examples

The following command displays the summary information for all IP interfaces on the switch, including subinterfaces.

switch# show ip interfaces brief
 Interface           IP Address     Status    Protocol     MTU
 Ethernet1/1         10.1.1.1/24    up        up           1500  
 Ethernet1/1.1       10.0.0.1/24    up        up           1500
 Ethernet1/2         unassigned     up        up           1500

The following command shows the specific information about subinterface Ethernet 1/1.1.

switch# show interface ethernet 1/1.1
Ethernet1/1.1 is down, line protocol is lowerlayerdown (notconnect)
  Hardware is Subinterface, address is 001c.735d.65dc
  Internet address is 10.0.0.1/24
  Broadcast address is 255.255.255.255
  Address determined by manual configuration
  IP MTU 1500 bytes , BW 10000000 kbit
  Down 59 seconds
switch>

The following command displays the status information for all subinterfaces configured on the switch.

switch# show interfaces status sub-interfaces
Port       Name    Status       Vlan     Duplex       Speed       Type                Flags
Et1.1              connect      101        full       10G         dot1q-encapsulation
Et1.2              connect      102        full       10G         dot1q-encapsulation
Et1.3              connect      103        full       10G         dot1q-encapsulation
Et1.4              connect      103        full       10G         dot1q-encapsulation

Maximum Latency Tail-drop Thresholds

The maximum latency for tail-drop thresholds can be configured in interface configuration mode or in the QoS profile. QoS profile configuration mode is a group change mode.

Example

The following commands configure the maximum latency value for the VOQ tail-drop threshold on transmit queue 3 on interface Ethernet1. The maximum latency value that can be specified is 50 ms. Either milliseconds or microseconds can be used in the configuration.

switch(config)# interface Ethernet1
switch(config-if-Et1)# tx-queue 3
switch(config-if-Et1-txq-3)# latency maximum <1-50000> microseconds
switch(config-if-Et1-txq-3)# latency maximum <1-50> milliseconds
switch(config)#

Autonegotiated Settings

In autonegotiation, the transmission speed, duplex setting, and flow control parameters used for Ethernet-based communication can be automatically negotiated between connected devices to establish optimized common settings.

Speed and Duplex

The speed command affects the transmission speed and duplex setting for the configuration mode interface. When a speed command is in effect on an interface, autonegotiation of speed and duplex settings is disabled for the interface; to enable autonegotiation, use the speed auto command.

The scope and effect of the speed command depends on the interface type; see Ethernet Interfaces and Ethernet Configuration Procedures for detailed information on the speed settings for different interfaces.

Flow Control

Flow control is a data transmission option that temporarily stops a device from sending data because of a peer data overflow condition. If a device sends data faster than the receiver can accept it, the receiver's buffer can overflow. The receiving device then sends a PAUSE frame, instructing the sending device to halt transmission for a specified period.

Flow control commands configure administrative settings for flow control packets.

The flowcontrol receive command configures the port's ability to receive flow control pause frames.
- off: port does not process pause frames that it receives.
- on: port processes pause frames that it receives.
- desired: port autonegotiates; processes pause frames if peer is set to send or desired.
The flowcontrol send command configures the port's ability to transmit flow control pause frames.
- off: port does not send pause frames.
- on: port sends pause frames.
- desired: port autonegotiates; sends pause frames if peer is set to receive or desired.

Desired is not an available parameter option. Ethernet data ports cannot be set to desired. Management ports are set to desired by default and with the no flowcontrol receive command.

The port linking process includes flow control negotiation. Ports must have compatible flow control settings to create a link. Compatible Settings for Flow Control Negotiation lists the compatible flow control settings.

Table 8. Compatible Settings for Flow Control Negotiation
local port	peer port
receive on	send on or send desired
receive off	send off or send desired
receive desired	send on , send off, or send desired
send on	receive on or receive desired
send off	receive off or receive desired
send desired	receive on , receive off, or receive desired

Example

These commands set the flow control receive and send to on on interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# flowcontrol receive on
switch(config-if-Et5)# flowcontrol send on
switch(config-if-Et5)#

Displaying Ethernet Port Properties

Show commands are available to display various Ethernet configuration and operational status on each interface. Ethernet settings that are viewable include:

Port Type
PHY Status
Negotiated Settings
Flow Control
Capabilities

Port Type

The port type is viewable from the output of show interfaces status, show interfaces hardware, and show interfaces transceiver properties commands.

Examples

This show interfaces status command displays the status of Ethernet interfaces 1-5.

switch# show interfaces status
Port      Name              Status       Vlan        Duplex  Speed Type
Et1                         connected    1             full    10G 10GBASE-SRL
Et2                         connected    1             full    10G 10GBASE-SRL
Et3                         connected    1             full    10G 10GBASE-SRL
Et4                         connected    1             full    10G 10GBASE-SRL
Et5                         notconnect   1             full    10G Not Present
switch>

This show interfaces hardware command displays the speed, duplex, and flow control capabilities of Ethernet interfaces 2 and 18.

switch# show interfaces ethernet 2,18 hardware
Ethernet2
  Model:        DCS-7150S-64-CL
  Type:         10GBASE-CR
  Speed/Duplex: 10G/full,40G/full,auto
  Flowcontrol:  rx-(off,on,desired),tx-(off,on,desired)
Ethernet18
  Model:        DCS-7150S-64-CL
  Type:         10GBASE-SR
  Speed/Duplex: 10G/full
  Flowcontrol:  rx-(off,on),tx-(off,on)
switch>

This command displays the media type, speed, and duplex properties for Ethernet interfaces 1.

switch# show interfaces ethernet 1 transceiver properties
Name : Et1
Administrative Speed: 10G
Administrative Duplex: full
Operational Speed: 10G (forced)
Operational Duplex: full (forced)
Media Type: 10GBASE-SRL

PHY

PHY information for each Ethernet interface is viewed by entering the show interfaces phy command.

Example

This command summarizes PHY information for Ethernet interfaces 1-3.

switch# show interfaces ethernet 1-3 phy
Key:
   U    = Link up
   D    = Link down
   R    = RX Fault
   T    = TX Fault
   B    = High BER
   L    = No Block Lock
   A    = No XAUI Lane Alignment
   0123 = No XAUI lane sync in lane N

                                  State    Reset
Port           PHY state        Changes    Count PMA/PMD PCS   XAUI
-------------- --------------- -------- -------- ------- ----- --------
Ethernet1      linkUp             14518     1750 U..     U.... U.......
Ethernet2      linkUp             13944     1704 U..     U.... U.......
Ethernet3detectingXcvr          3        1               D..A0123
switch>

Negotiated Settings

Speed, duplex, and flow control settings are displayed through the show interfaces hardware, PHY information for each Ethernet interface is viewed by entering the show interfaces hardware, show interfaces flow-control, and show interfaces status commands.

Examples

This command displays speed/duplex and flow control settings for Ethernet interface 1.

switch# show interfaces ethernet 1 hardware
Ethernet1
  Model:        DCS-7150S-64-CL
  Type:         10GBASE-SR
  Speed/Duplex: 10G/full
  Flowcontrol:  rx-(off,on),tx-(off,on)
switch>

This command shows the flow control settings for Ethernet interfaces 1-2.

switch# show flow-control interface ethernet 1-2
Port       Send FlowControl  Receive FlowControl  RxPause       TxPause
           admin    oper     admin    oper
---------  -------- -------- -------- --------    ------------- -------------
Et1        off      off      off      off         0             0
Et2        off      off      off      off         0             0
switch>

This command displays the speed type and duplex settings for management interfaces 1-2.

switch# show interfaces management 1-2 status
Port      Name              Status       Vlan        Duplex  Speed Type
Ma1                         connected    routed      a-full a-100M 10/100/1000
Ma2                         connected    routed      a-full   a-1G 10/100/1000
switch>

Ingress Counters

The Ingress counters enables the switch to count the ingress traffic on the Layer 3 ports of the switch.

Any ingress traffic on Layer 3 sub-interfaces and VLAN interface with IPv4 and IPv6 addresses are accounted irrespective of the routing decision. The VLAN counters are supported on DCS- 7050x, DCS-7250x, and DCS-7300x series switches and not supported on any routed ports.

Configuring Ingress Counters

The hardware counter feature in command enables the switch to count the ingress traffic on the Layer 3 port of the switch. Any traffic on Layer 3 sub-interfaces and VLAN interface with IPv4 and IPv6 addresses are accounted irrespective of the routing decision.

Examples

This command configures the ingress traffic count on the sub-interfaces. The no form of the command disables the counter configuration from the switch ports.
```
switch# hardware counter feature subinterface in
```
This command configures the ingress traffic count on the VLAN interface. The no form of the command disables the counter configuration from the VLAN configured switch ports.
```
switch# hardware counter feature vlan-interface in
```

Displaying the Ingress Counter Information

The show interface counters command displays the Layer 3 ingress traffic count information. Run this command to view the traffic counts on a sub-interface or VLAN interface of the switch. The clear counters command resets the counters to 0.

Example

This command displays the ingress traffic count on a VLAN interface vl12.

switch# show interface vl12 counters incoming
L3 Interface InOctets InUcastPkts InMcastPkts
Vl12           3136          47           2

Configuring Ingress Traffic-Class Counters

Ingress traffic class counter support is enabled in order to display per traffic-class counters on ingress interfaces, and supported on routed-ports and subinterfaces. Both packet and octet counts are displayed.

Examples

This command enables traffic-class counter support.

switch(config)# hardware counter feature traffic-class in

This command enables TCAM profile tc-counters if this profile is configured.
```
switch(config)# hardware tcam profile tc-counters
```

Hardware Counter Support

Hardware counter support allows enabling counters for features using programmable hardware counter resources.

Hardware counter support can be used to count the following feature specific counters:

Ingress VLAN-interface counters count the packets/octets ingressing through a VLAN interface.
Egress VLAN-interface counters count the packets/octets egressing a VLAN interface.
Ingress subinterface counters count the packets/octets ingressing through a subinterface.
Egress subinterface counters count the packets/octets egressing a subinterface.
VXLAN VNI counters count the packets/octets encapsulated/decapsulated per VNI.
VXLAN VTEP counters count the packets/octets encapsulated/decapsulated per VTEP.
Route counter for IPv4/IPv6 routes count the packets/octets routed using the route entry.
Ingress GRE Tunnel Interface counters count the packets/octets ingressing through the GRE Tunnel Interface.
Egress GRE Tunnel Interface counters count the packets/octets egressing through the GRE Tunnel Interface.

Hardware Counter Support Configuration

You can enable the Hardware Counter feature on a per-feature basis using the hardware counter feature command. The no hardware counter feature disables the feature. Multiple ingress and egress hardware counter features can work concurrently.

Note: Enabling the hardware counter features may impact the transit traffic.

Ingress VLAN Interface Counters

The hardware counter feature vlan-interface in command enables the counting of ingress VLAN interface counters. When configured, the switch counts the number of unicast packets, multicast packets, and total octets ingressing through the VLAN interface for every VLAN interface configured in the system.

Example

switch# [no]hardware counter feature vlan-interface in

Egress VLAN Interface Counters

Thehardware counter feature vlan-interface out command enables the counting of egress VLAN interface counters. When configured, the switch counts the number of unicast packets, multicast packets, and total octets egressing the VLAN interface for every VLAN interface configured in the system.

Example

switch# [no]hardware counter feature vlan-interface out

Ingress SubInterface Counters

The hardware counter feature subinterface in command enables the counting of ingress subinterface counters. When configured, the switch counts the number of unicast packets, multicast packets, and total octets ingressing through the subinterface for every L3 subinterface configured in the system.

Example

switch# [no]hardware counter feature subinterface in

Egress SubInterface Counters

The hardware counter feature subinterface out command enables the counting of egress subinterface counters. When configured, the switch counts the number of unicast packets, multicast packets, and total octets egressing the subinterface for every L3 subinterface configured in the system.

Example

switch# [no]hardware counter feature subinterface out

VXLAN VNI Encapsulation Counters

The hardware counter feature vni encap command enables the counting of per VNI encap counters. When enabled, the switch counts the number of packets and bytes egressing a VNI through VTI, encap BUM packets, and the number of encap packets dropped due to any reason.

Example

switch(config)# [no]hardware counter feature vni encap

VXLAN VNI Decapsulation Counters

The hardware counter feature vni decap command enables the per VNI decap counters. When enabled, the switch counts the number of packets/octets received from VTEP and decapsulated for each VNI.

Example

switch(config)# [no]hardware counter feature vni decap

Route Counters

The hardware counter feature route command configures the route counters for the specified IP version and ip-address/ip-prefix. When enabled, the switch counts the number of packets/bytes hitting a route. The VRF name is optional and default VRF is assumed if no VRF is specified.

Example

switch(config)# [no] hardware counter feature route[ipv4|ipv6]vrf <name>][ip-address|ip-address-prefix]

GRE Tunnel Interface Encapsulation Counters

The hardware counter feature gre tunnel interface out command enables GRE Tunnel Interface encap counters. When enabled, the switch counts the number of unicast GRE packets and total octets getting encapsulated on the Tunnel Interface.

Example

switch(config)# [no]hardware counter feature gre tunnel interface out

GRE Tunnel Interface Decapsulation Counters

The hardware counter feature gre tunnel interface in command enables GRE Tunnel Interface decap counters. When enabled, the switch counts the number of unicast GRE packets and total octets getting decapsulated on the Tunnel Interface.

Example

switch(config)# [no]hardware counter feature gre tunnel interface in

MRU Enforcement Show commands

The show interface output displays the MRU on an interface.

switch(config)# show interface ethernet 1
Ethernet1 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 444c.a8b7.1ed8 (bia 444c.a8b7.1ed8)
  Member of Port-Channel10
  Ethernet MTU 10178 bytes, Ethernet MRU 1500 bytes, BW 10000000 kbit
  Full-duplex, 10Gb/s, auto negotiation: off, uni-link: disabled.

Counters

MRU-dropped packets are counted per-chip.

The show platform fap mapping output displays the mapping between the chips and their corresponding Ethernet interfaces.

switch(config)# show platform fap mapping interface Ethernet 1
Jericho0 (FapId: 0  BaseSystemCoreId: 0)
Port             SysPhyPort   Voq   Core  FapPort  OtmPort BaseQPair QPairs Xlge NifPort
----------------------------------------------------------------------------------------
Ethernet1        100          2608  0      2       0        0         8     8     33

The show hardware counter drop output displays the per-chip Reassembly Errors counters.

switch(config)# show hardware counter drop
Type  Chip       CounterName       : Count    : First Occurrence    : Last Occurrence
-----------------------------------------------------------------------------------------
A     Jericho0   ReassemblyErrors  : 12132989 : 2020-09-22 17:05:45 : 2020-09-22 17:22:40

Configuring Power over Ethernet (PoE)

Power over Ethernet (PoE) is enabled by default on all Ethernet ports of PoE-capable switches, and the switch will detect IEEE-compliant Powered Devices (PDs) when they are plugged into a port and supply power appropriately.

Limitations

Ethernet ports will not detect non IEEE-compliant devices by default, and may not be able to detect or power them even if configured to do so.
If attached PDs overload the switch, it will power off. This can occur when an attached PD increases its power demand via LLDP, when too many PDs are connected to the switch, or when a power supply fails on a heavily loaded dual-supply switch.
Power-cycling the switch will cause temporary loss of power to attached PDs.
PoE is not available on management interfaces.

Disabling PoE on an Interface

On switches which support PoE, it is enabled by default on all Ethernet ports but can be disabled per-port with the poe disabled command.

Example

These commands disable PoE on Ethernet interface 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# poe disabled
switch(config-if-Et5)#

PoE Power Settings

When an IEEE-compliant powered device (PD) is connected to a PoE-enabled Ethernet port, it is recognized by a specific resistor signature, and its initial power needs are determined by hardware negotiation, after which further negotiation is managed through the Link Layer Discovery Protocol (LLDP). For details, see Configuring LLDP for Power over Ethernet.

PoE power output can be limited on a port using the poe limit command. The power limit represents the power output at the Ethernet port; actual power delivered to the PD will be lower due to power loss along the Ethernet cable.

Note: LLDP uses Power Via MDI type-length-value elements (TLVs) to allow the switch to dynamically negotiate power needs with PDs. LLDP will not include Power Via MDI TLVs for the interface if a power limit has been configured on it.

Examples

These commands limit nominal PoE power output on Ethernet interface 5 to 10 W.

switch(config)# interface ethernet 5
switch(config-if-Et5)# poe limit 10 watts
switch(config-if-Et5)#

These commands limit nominal PoE power output on Ethernet interface 7 to 4 W.

switch(config)# interface ethernet 7
switch(config-if-Et7)# poe limit class 1
switch(config-if-Et7)#

Detecting Legacy PDs

To configure an interface to use hardware detection for these non-compliant PoE devices and attempt to power them, use the poe legacy detect command.

Note: Non IEEE-compliant PDs are not officially supported. Arista cannot guarantee compatibility with such devices, and they may not be detected even when legacy detection is enabled on the port they are connected to.

Example

These commands configure interface ethernet 5 to attempt to detect and power non-compliant PDs.

switch(config)# interface ethernet 5
switch(config-if-Et5)# poe legacy detect
switch(config-if-Et5)#

Displaying PoE Information

To display PoE information for a specific interface range or for all Ethernet interfaces, use the show poe command.

Example

This command displays PoE information for Ethernet interface 46.

switch(config)# show poe interface ethernet 46
show poe interface ethernet 46
PSELLDPPowerGrantedPort
Port Enabled Enabled Limit  Power   State   Class  Power Current Voltage Temperature
---- ------- ------- ------ ------- ------- ------ ----- ------- ------- -----------
46      True    True 15.40W 15.40W  powered class0  1.40W 27.00mA 55.04V  41.25C
switch(config-if-Et7)#

Configuring Link Fault Signaling

As part of the Link Fault Signaling (LFS) configuration, a new configuration mode called theEthernet Operations Administration and Management (EOAM) mode is introduced. The EOAM profile has a link-error sub-mode wherein the threshold, action, and the period is configured for both FCS and Symbol errors. The period can be in seconds or in number of frames. The default values are threshold 0, action syslog, and period 0 seconds. If the errors exceed the threshold within the given period, the configured action is executed. The recovery time configures the recovery timeout value for link fault signaling. Only one EOAM profile is associated with a port.

The following steps enable configuring the LFS parameters:

Enable the EOAM mode.
```
switch(config)# monitor ethernet oam
```
Create an EOAM profile named as profile1.
```
switch(config-eoam)# profile profile1
```

Enter the EOAM link-error sub-mode.

switch(config-eoam-profile-profile1)# link-error

Enter the commands in the profile link-error submode to configure a specific LFS parameter.

switch(config-eoam-profile-profile1-link-error)# symbol action errdisable
switch(config-eoam-profile-profile1-link-error)# symbol period 300 frames
switch(config-eoam-profile-profile1-link-error)# symbol threshold 20
switch(config-eoam-profile-profile1-link-error)# recovery-time 40

Apply the EOAM profile profile1 to the Ethernet interface 1/1.

switch(config)# interface ethernet 1/1
switch(config-if-Et1/1)# monitor ethernet oam profile profile1

Ethernet OAM Connectivity Fault Management (CFM)

This section contains the following topics:

Connectivity Fault Management Overview
Configuring Ethernet OAM Connectivity Fault Management (CFM)
Displaying CFM Status Information
Ethernet OAM CFM Commands

Connectivity Fault Management Overview

As Ethernet technologies merge into Metropolitan Area Networks (MAN) and Wide Area Networks (WAN), these services, used by service providers,provide end-to-end connectivity to customers. Typically, the service provider locations span large geographical areas and may rely on certain internet backbone providers, called operators, to provide connectivity when the geographical area becomes too large for coverage. In response, the responsibilities of managing the networks by tasks including Operations, Administration, and Maintenance (OAM) become challenging, and the ability of the service providers to respond to network interruptions directly impacts competitiveness in the market.

To facilitate fault detection, isolation, and recovery process at the Ethernet layer, the Ethernet OAM Connectivity Fault Management (CFM) protocol became available with the release of the IEEE 802.1ag standard. Under this standard, the nodes on a network periodically transmit an Ethernet Continuity Check (ETH-CC) message indicating the status of reachability to remote notes, and also track the reachability of remote nodes in the network. The Ethernet OAM CFM functionality uses special Ethernet frames with the Ethernet type value as 0x8902 to achieve this functionality.

Terminology

Review the list of terms used in the documentation.

CCM - Continuity Check Message
CFM - Connectivity Fault Management
ETH-CC - Ethernet Continuity Check
eOAM - Ethernet Operation, Administration, and Management
LOC - Loss of Continuity
MA - Maintenance Association
MD - Maintenance Domain
MEP - Maintenance Association End Point
RMEP - Remote Maintenance Association End Point
MP - Maintenance Point
OAM - Operations, Administration, and Maintenance
RDI - Remote Defect Indication

Configuring Ethernet OAM Connectivity Fault Management (CFM)

Adding CFM to the Hardware TCAM Profile

If the network has Maintenance Association End Points (MEPs) in the Up state, then you must add the CFM feature to the operational TCAM profile.

Example

Use the following commands to add the profile new-cfm to the TCAM:

switch(config)# hardware tcam
switch(config-tcam)# profile new-cfm copy default
switch(config-tcam-profile-new-cfm)# feature cfm
switch(config-tcam)# system profile new-cfm

Configuring CFM

EOS supports MEPs on the following ports:

Up and down MEPs on Pseudowire front panel ports.
Up MEP continuity check on L2 front panel trunk ports.
Down MEP continuity check support for L2 front panel ports in the following scenarios:
- MEP interface on an access port
- MEP interface on a trunk port with a native VLAN equal to an association VLAN.
- MEP interface on a trunk port with a native VLAN not equal to an association VLAN.

Use the commands available in cfm mode to add CFM configurations. Multiple MEPs can share CFM properties when configuring CFM profiles, and CFM profiles can be associated with one or more MAs.

Use the following command to enter cfm mode:

switch(config)#cfm

Enable the LOC action for Layer 3 interfaces:

switch(config)#continuity-check loc-state action disable interface routing

Create a new CFM profile cfm-profile1:

switch(config)#profile cfm-profile1

Add continuity checking to the configuration:

switch(config-cfm-profile-cfm-profile1)#continuity-check

Set the time interval to every 10 minutes for periodic transmission of CCM packets:

switch(config-cfm-profile-cfm-profile1)#continuity-check tx-interval 10 minutes

To set the transmission level to the default value of one (1) second, use the default. EOS supports the following types of transmission levels:

3.33 milliseconds
10 ??milliseconds
100 ??milliseconds
1 second
10 seconds
1 minute
10 minutes

Add Class of Service (CoS) to the configuration:

switch(config-cfm-profile-cfm-profile1)# continuity-check qos cos 7

The cos cos_value has a default value of 7.

Configure alarms for defects on the network using the following parameters:

switch(config-cfm-profile-cfm-profile1)#continuity-check alarm defect defects

Select from the following list of defects:

cross-connection - Enables the CFM_MEP_CROSS_CONNECTION_DETECTED alarm and logged when a local MEP receives a CCM PDU from a differenct maintenance association.
error-ccm - Enables the CFM_MEP_ERROR_CCM_DETECTED alarm and logged when a local MEP receives a CCM PDU with the wrong CCM tx-interval or has an RMEP id identical to a local MEP id.
loc-state - Enabled by default, and enables the CFM_MEP_LOC_DETECTED alarm ane logged when a local MEP loses connectivity with a remote MEP.
rdi-ccm - Enabled by default and enables the CFM_MEP_RDI_RECEIVED alarm, and logged when a local MEP receives a CCM with the RDI flag set to true from the remote MEP.

Configuring Maintenance Domains

To configure a Maintenance Domain and related parameters, use the following command:

switch(config-cfm)# domain domain_name level domain_level

The domain_level can be an integer between 0 -7.

Example

Use the following command to configure a Maintenance Domain with the name mdom_1 and a level of 5:

switch(config-cfm)# domain mdom_1 level 5

Use the following command to configure a Maintenance Association under a Maintenance Domain, :

switch(config-cfm-mdom_1)# association association_ID

The command supports an integer value between 1 to 655335.

Use the following command to apply a CFM profile to a Maintenance Association:

switch(config-cfm-md-mdom_1-ma-255)# profile profile1

The CFM profile applies to all MEPs in the Maintenance Association.

To configure the CFM direction for a Maintenance Association, use the following command:

switch(config-cfm-md-mdom_1-ma-255)# direction [up | down]

This configures all MEPs under a Maintenance Association with the same direction.

Configure a MAC address for a remote MEP by first entering the remote end-point mode, and adding the MAC address:

switch(config-cfm-md-mdom_1-ma-255)# remote end-point end_point_id

switch(config-cfm-md-mdom_1-ma-255-rmep-rep_25)# mac address 06:00:00:00:00:00

Use the following command to configure a local endpoint (MEP) for a Maintenance Association:

switch(config-cfm-md-mdom_1-ma-255)# end-point end_point_id

The end_point_id can only be an integer between 1 and 8191.

To configure a remote MEP under a local MEP, use the following command:

switch(config-cfm-md-mdom_1-ma-255-mep-mep_25)# remote end-point [ add | remove ] end_point_ID

Use any of the following options with the configuration:

no or default removes all of the remote MEPs under the local MEP.
end_point_id can only be an integer between 1 and 8191.
add adds the remote MEP to the existing list of MEPs.
delete removes the remote MEP from the list of existing MEPs.
remote end-point end_point_ID parameter without the add keyword overwrites the existing remote MEPs under the local MEP.

To configure an interface for a local MEP, use the following command:

switch(config-cfm-md-mdom_1-ma-255-mep-mep_25)# interface interface-name

Displaying CFM Status Information

The following examples allow you to display status information about your CFM configuration.

Current Status

To display the current status of the CFM endpoints, use the following command:

switch# show cfm continuity-check end-point
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Interface: Ethernet1.1
TX RDI state: false, Last TX RDI cleared: never
 Remote MEP ID        Connectivity          Last LOC Detected    Last LOC Cleared
 ------------------- ------------------ ----------------------- ----------------
                  2    reachable                         never              never

In this example, the endpoint displays reachability and no loss of continuity (LOC). Because no LOC occurred, the TX RDI state returns false, meaning the local MEP transmits the CCMs with the RDI flag set to false.

Loss of Continuity

To display the current status of the CFM endpoints, use the following command:

switch# show cfm continuity-check end-point
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Interface: Ethernet1.1
TX RDI state: true, Last TX RDI set: 0:00:04 ago
 Remote MEP ID       Connectivity          Last LOC Detected    Last LOC Cleared
 ------------------- ------------------ ----------------------- ----------------
                2    unreachable                 0:00:04 ago               never

The remote MEP became unreachable and LOC occurred on the network. Since LOC exists for the connection, the TX RDI state returns true, meaning the local MEP transmits the CCMs with the RDI flag set to true.

Layer 3 Interface with LOC Enabled

Display information with the LOC action enabled and a Layer 3 interface detects it.

switch# show interfaces Ethernet1.1
Ethernet1.1 is up, line protocol is up (connected)
Hardware is Subinterface, address is 2cdd.e9c0.ed7b
Internet address is 1.0.1.1/24               
Broadcast address is 255.255.255.255
IPv6 link-local address is unassigned
IPv6 global unicast address(es):
     2002::100:101, subnet is 2002::100:100/120 [INACTIVE]
CFM connectivity status for IPv4, IPv6 is DOWN
IP MTU 1500 bytes (default), BW 100000000 kbit

LOC Recovery

Displays the status for the MEP as reachable, but LOC occurred at some point on the network.

switch# show cfm continuity-check end-point
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Interface: Ethernet1.1                
TX RDI state: false, Last TX RDI cleared: 0:00:01 ago
   Remote MEP ID    Connectivity          Last LOC Detected    Last LOC Cleared
 ------------------- ------------------ ----------------------- ----------------
                2    reachable                   0:05:09 ago         0:00:01 ago

Remote Defects for CFM

Shows the remote MEP as reachable, but other defects occurred for the local MEP. The detail option provides more information regarding the defects.

Arista# show cfm continuity-check end-point detail
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Interface: Ethernet1.1
TX RDI state: false, Last TX RDI cleared: 0:00:01 ago
   Remote MEP ID    Connectivity          Last LOC Detected    Last LOC Cleared
  ------------------- ------------------ ----------------------- ----------------
                2    reachable                   0:05:09 ago         0:00:01 ago
                
Unknown RMEPs
MD Level  MAID   RMEP ID  Received   Error Status        First CCM received  Last CCM received 
—-------  —---   —------  —--------  —------------------ —-----------------  —----------------
1            4       5         100   MAID mismatch              0:05:09 ago         0:0:10 ago
1            1       5         100   Unconfigured RMEP          0:05:09 ago         0:0:10 ago
1            1       1         100   Duplicate RMEP             0:05:09 ago         0:0:10 ago

RDI Detected

RDI displays the status, undetected, and CCMs received from this remote MEP have the RDI flag set to true.

switch# show  cfm continuity-check end-point remote-defect
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up
Maintenance end point ID: 1, Interface: Ethernet1.1
RDI condition: undetected
TX RDI state: false, Last TX RDI cleared: never
      Remote MEP ID    RDI State           RDI Detected   RDI Cleared
  ------------------- ---------------- ------------------ -----------
                2      undetected                 never        never

RDI Undetected

RDI displays the status, undetected, and CCMs received from this remote MEP have the RDI flag set to false.

switch# show  cfm continuity-check end-point remote-defect
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up
Maintenance end point ID: 1, Interface: Ethernet1.1
RDI condition: detected, last detected 0:00:09 ago
TX RDI state: false, Last TX RDI cleared: never
   Remote MEP ID    RDI State           RDI Detected    RDI Cleared
  ------------------- ---------------- ------------------ -----------
                  2    detected            0:00:09 ago         never

RDI Recovered

RDI displays the status, undetected but recovered the connection.

switch# show  cfm continuity-check end-point remote-defect
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up
Maintenance end point ID: 1, Interface: Ethernet1.1
RDI condition: cleared, last detected 0:02:10 ago, last cleared 0:00:03 ago
TX RDI state: false, Last TX RDI cleared: never
      Remote MEP ID    RDI State          RDI Detected    RDI Cleared
  ------------------- ---------------- ------------------ -----------
                2      cleared             0:02:10 ago    0:00:03 ago

Continuity Check Counters (Software CFM)

The counters parameter displays relevant counters for software CFM configurations. This parameter displays the counters per MEP. Using the details option displays the counters for each interface VLAN in addition to the MEP configured on an interface VLAN.

switch# cfm continuity-check counters
Maintenance domain: aCWWbXp5Z7, Level: 4
Maintenance association: 9783
Maintenance end point ID: 1, Interface: Ethernet14/1, VLAN: 1756
Total TX packets: 296
Total TX packet failures: 0
Total RX packets: 296
Total RX packet discards: 0
RX - CCM packet parse errors: 0
RX - Domain name invalid: 0
RX - Association name invalid: 0
RX - Traffic direction mismatch: 0
RX - CCM interval invalid: 0
RX - Remote MEP ID invalid: 0
RX - Duplicate remote MEP: 0
RX - Unconfigured remote MEP: 0

Continuity Check Counters Details

This example adds the details parameter.

switch# show cfm continuity-check counters
Interface: Ethernet11/1, VLAN: 1176
Total TX packets: 373
Total TX packet failures: 0
Total RX packets: 372
Total RX packet discards: 0
RX - No MEP configured: 0
RX - Ethernet header parse errors: 0
RX - CFM header parse errors: 0
RX - Domain level mismatch: 0
RX - TLV offset invalid: 0
Maintenance domain: aCWWbXp5Z7, Level: 4
Maintenance association: 9783
Maintenance end point ID: 2, Interface: Ethernet11/1, VLAN: 1176
Total TX packets: 373
Total TX packet failures: 0
Total RX packets: 372
Total RX packet discards: 0
RX - CCM packet parse errors: 0
RX - Domain name invalid: 0
RX - Association name invalid: 0
RX - Traffic direction mismatch: 0
RX - CCM interval invalid: 0
RX - Remote MEP ID invalid: 0
RX - Duplicate remote MEP: 0
RX - Unconfigured remote MEP: 0

Ethernet OAM CFM Commands

Global Configuration Commands

Configuration Commands

cfm continuity-check
cfm domain
cfm measurement
cfm profile

Show Commands

show cfm continuity-check end-point
show cfm endpoint

Configuring Hardware TCAM

Ternary Content-Addressable Memory (TCAM) is a specialized type of high-speed memory that increase the speed of route look-up, packet classification, packet forwarding and access control list-based commands. The hardware tcam command is used to configure and place the switch in the TCAM mode. In this mode the user can configure few TCAM related commands such as feature, profile and system.

In the TCAM mode, use the feature command to configure the reservation of TCAM banks for the features like ACL, IPsec, flow-spec, l2-protocol, PBR, QoS, TCP-MSS-ceiling, traffic-policy. The profile command configures a new TCAM profile, or just copy the TCAM profile which is already created using the hardware tcam profile command such as default, mirroring-acl, pbr-match-nexthop-group, qos, tap-aggregation-default, tap-aggregation-extended, tc-counters, test, VXLAN-routing. Similarly, the system command configures the system-wide TCAM profiles.

Example

This command places the switch in Hardware TCAM configuration mode.

switch(config)# hardware tcam
switch(config-hw-tcam)#

These are the commands allowed to configure in Hardware TCAM mode.

Examples

This command allow the switch to configure the TCAM feature.

switch(config)# hardware tcam
switch(config-hw-tcam)# feature

This command allow the switch to configure TCAM profile.

switch(config)# hardware tcam
switch(config-hw-tcam)# profile

This command allow the switch to configure TCAM system profile.

switch(config)# hardware tcam
switch(config-hw-tcam)# system

CPU Traffic Policy

Create a TCAM profile to enable actions such as permit, deny, and police in hardware before the traffic gets to the kernel for processing. The action is taken based on IP packet header information such as DSCP, L4 port values, fragmentation bits, etc.

TCAM Profile Example

The following file extract displays an example of a TCAM profile, cpu-traffic-policy, with features configured to enable CPU traffic policy.

hardware tcam
   profile cpu-traffic-policy
      feature acl port ip
         sequence 45
         key size limit 160
         key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control ttl
         action count drop
         packet ipv4 forwarding bridged
         packet ipv4 forwarding routed
         packet ipv4 forwarding routed multicast
         packet ipv4 mpls ipv4 forwarding mpls decap
         packet ipv4 mpls ipv6 forwarding mpls decap
         packet ipv4 non-VXLAN forwarding routed decap
         packet ipv4 VXLAN eth ipv4 forwarding routed decap
         packet ipv4 VXLAN forwarding bridged decap
      feature acl port ipv6
         sequence 25
         key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-ops-3b l4-src-port src-ipv6-high src-ipv6-low tcp-control
         action count drop mirror
         packet ipv6 forwarding bridged
         packet ipv6 forwarding routed
         packet ipv6 forwarding routed multicast
         packet ipv6 ipv6 forwarding routed decap
      feature acl subintf ip
         sequence 40
         key size limit 160
         key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control ttl
         action count drop mirror
         packet ipv4 forwarding routed
      feature acl subintf ipv6
         sequence 15
         key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
         action count drop mirror redirect
         packet ipv6 forwarding routed
      feature counter lfib
         sequence 85
      feature mpls
         sequence 5
         key size limit 160
         action drop redirect set-ecn
         packet ipv4 mpls ipv4 forwarding mpls decap
         packet ipv4 mpls ipv6 forwarding mpls decap
         packet mpls ipv4 forwarding mpls
         packet mpls ipv6 forwarding mpls
         packet mpls non-ip forwarding mpls
      feature mpls pop ingress
         sequence 90
      feature pbr mpls
         sequence 65
         key size limit 160
         key field mpls-inner-ip-tos
         action count drop redirect
         packet mpls ipv4 forwarding mpls
         packet mpls ipv6 forwarding mpls
         packet mpls non-ip forwarding mpls
      feature qos ip
         sequence 75
         key size limit 160
         key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip
         action set-dscp set-policer set-tc
         packet ipv4 forwarding routed
         packet ipv4 forwarding routed multicast
         packet ipv4 mpls ipv4 forwarding mpls decap
         packet ipv4 mpls ipv6 forwarding mpls decap
         packet ipv4 non-VXLAN forwarding routed decap
      feature qos ipv6
         sequence 70
         key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
         action set-dscp set-policer set-tct
         packet ipv6 forwarding routed
      feature traffic-policy cpu ipv4
         sequence 1
         key size limit 160
         key field dst-ip ip-frag ip-protocol l4-dst-port l4-src-port src-ip
         action count set-drop-precedence set-policer
      feature traffic-policy cpu ipv6
         sequence 2
         key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
         action count set-drop-precedence set-policer
   system profile cpu-traffic-policy

Configuring the Policy

The following configures cpu-traffic-policy under the traffic-policies global configuration mode.

traffic-policies
  cpu traffic-policy <name> vrf <vrf-list>
  traffic-policy <name>
    match <rule-name> <ipv4 | ipv6> [ <after | before> <rule-name> ]         
      source prefix       A.B.C.D/E [ A.B.C.D/E ]
      destination prefix  A.B.C.D/E [ A.B.C.D/E ]
      protocol <protocol-list> | {tcp,udp}
                          [ source port <port-list> | 
                                        field-set <port-set-name> ] |
                          [ destination port <port-list> |
                                        field-set <port-set-name> ]
      actions
         drop
         police rate <rate> <unit>
         count

The following applies the policies to the VRFs. The policy is applied to all interfaces belonging to the VRF.

traffic-policies
  cpu traffic-policy <name> vrf all

Default Rules

The ipv4-all-default and ipv6-all-default are programmed by default and cannot be reordered, or removed. Only the associated action can be changed. The permit rule is never installed and is the default action for packet processing.

Examples

L3 Protocol Match Criteria (protocol neighbors bgp)

The following displays the configuration of a profile to match on a set of configured protocol peers which allows only TCP traffic from those BGP peers.

traffic-policies
  cpu traffic-policy <name> vrf <vrf-list>
  traffic-policy <name>
    match <rule-name> <ipv4 | ipv6> [ <after | before> <rule-name> ]         
      source prefix       A.B.C.D/E [ A.B.C.D/E ]
      destination prefix  A.B.C.D/E [ A.B.C.D/E ]
      protocol <protocol-list> | {tcp,udp}
                          [ source port <port-list> | 
                                        field-set <port-set-name> ] |
                          [ destination port <port-list> |
                                        field-set <port-set-name> ]
      actions
         drop
         police rate <rate> <unit>
         count

traffic-policies
  cpu traffic-policy <traffic-policy-name> vrf all
    match <rule-name> <ipv4 | ipv6> [ <after | before> <rule-name> ]        
      protocol neighbors bgp
      actions
         drop

traffic-policies
   cpu traffic-policy foo vrf all
      traffic-policy foo
         match BGP ipv4
            protocol neighbors bgp

The following policy permits dynamic peers from the listen-range 2.0.0.0/24 and all IPv6 BGP LL peers.

traffic-policies
   traffic-policy cpuPolicy
      match BGP ipv4
         protocol neighbors bgp
      match BGP-DYN ipv4
         source prefix 2.0.0.0/24
      match BGP-LL ipv6
         source prefix fe80::/64

Note: Configuring any match criteria will result in a CLI error when combined with the protocol neighbor bgp match criteria as these conflict with the expanded BGP rules.

The following displays error messages with conflicting configurations.

traffic-policies
   traffic-policy cpuPolicy
      match BGP ipv4
         protocol neighbors bgp
         source prefix 1.0.0.1/32
! The ‘source prefix’ subcommand is not supported when the ‘protocol neighbors’ subcommand is configured.

traffic-policies
   traffic-policy cpuPolicy
      match BGP ipv4
         source prefix 1.0.0.1/32
         protocol neighbors bgp
! The ‘protocol neighbors’ subcommand is not supported when any other match subcommands are configured.

Deny other BGP Traffic

The following displays a policy to whitelist some BGP sessions and other management IPs or IP protocol. The policy is inadequate as attempts to create BGP sessions from 1.0.0.0/24 (for example) will pass through this policy unfiltered.

traffic-policies
   cpu traffic-policy CPU vrf all   
   traffic-policy CPU
      match BGP ipv4
         protocol neighbors bgp
      match BFD ipv4
         source address 1.0.0.0/24 1.0.1.0/24 1.0.4.0/24
      match ipv4-all-default ipv4
         actions
            drop
      match ipv6-all-default ipv6
         actions
            drop

The following displays a policy to whitelist some BGP sessions and other management IPs or IP protocol. The policy is effective and easier to implement for administrators.

traffic-policies
   cpu traffic-policy CPU
   traffic-policy CPU
      match BGP ipv4
         protocol neighbors bgp
      match BGP-REST ipv4
         protocol tcp udp destination port 179
         actions
            drop
      match BFD ipv4
         source address 1.0.0.0/24 1.0.1.0/24 1.0.4.0/24
      match ipv4-all-default ipv4
         actions
            drop
      match ipv6-all-default ipv6
         actions
            drop

The following displays a policy to whitelist some BGP sessions and other management IPs or IP protocol. The policy is effective and easier to implement for administrators. The clause matches on any inbound traffic destined for the configured BGP port(s).

traffic-policies
   cpu traffic-policy CPU
   traffic-policy CPU
      match BGP ipv4
         protocol neighbors bgp
      match BGP-REST ipv4
         protocol bgp
         actions
            drop
      match BFD ipv4
         source address 1.0.0.0/24 1.0.1.0/24 1.0.4.0/24
      match ipv4-all-default ipv4
         actions
            drop
      match ipv6-all-default ipv6
         actions
            drop

Actions

Drop: packet is discarded on a match

Police: tracks the usage for each BGP neighbor, and holds it to a maximum rate.

The police rate <rate-value> [rate-unit] command sets the policing rate. The optional rate-unit are bps, kbps (default), mbps, and gbps. The following configures a policing rate of 15 kbps for each BGP neighbor.

traffic-policies
   cpu traffic-policy CPU vrf all
   traffic-policy CPU
      match BGP ipv4
         protocol neighbors bgp
         actions
            police rate 15 kbps

Count

The following enables counters for the CPU traffic policy to count all packets matching the rule in which the count action is configured.

no hardware counter feature acl out <address-family>

hardware counter feature traffic-policy cpu

traffic-policies
   cpu traffic-policy CPU vrf all
   traffic-policy CPU
      match BGP ipv4
         protocol neighbors bgp
         actions
            count

Use-case Scenarios

Securing BGP Neighbors

The following implements a policy to secure BGP neighbors.

traffic-policies
   cpu traffic-policy CPU-DEFAULT vrf all
   traffic-policy CPU-DEFAULT
      match ICMPV6 ipv6
         protocol icmpv6
      match BGP ipv4
         protocol neighbors bgp
      match BGP-OTHER ipv4
         protocol bgp
         actions
            drop
      match BGP6 ipv6
         protocol neighbors bgp
      match BGP-OTHER6 ipv6
         protocol bgp
         actions
            drop
      match OSPF ipv4
         protocol ospf
      match ipv4-all-default ipv4
         actions
            drop
      match ipv6-all-default ipv6
         actions
            drop

Whitelist BFD Neighbors (not neighbor-specific)

Add the following rule to Whitelist BFD Neighbors.

traffic-policies
   traffic-policy CPU-DEFAULT
      match BFD-DPORT ipv4
         protocol udp destination port 3784-3785
      match BFD-SPORT ipv4
         protocol udp source port 49152
      match BFD-DPORT6 ipv6
         protocol udp destination port 3784-3785
      match BFD-SPORT6 ipv6
         protocol udp source port 49152
      match ipv4-all-default ipv4
         actions
            drop
      match ipv6-all-default ipv6
         actions
            drop

Whitelist a few Common Control-plane Protocols and Deny others

Add the following rule to Whitelist protocols such as ICMPv6 while denying others.

traffic-policies
   cpu traffic-policy CPU-DEFAULT vrf all
   traffic-policy CPU-DEFAULT
      match ICMPV6 ipv6
         protocol icmpv6
      match BGP ipv4
         protocol neighbors bgp
      match BGP-OTHER ipv4
         protocol bgp
         actions
            drop
      match BGP6 ipv6
         protocol neighbors bgp
      match BGP-OTHER6 ipv6
         protocol bgp
         actions
            drop
      match OSPF ipv4
         protocol ospf
      match PIM4 ipv4
         protocol pim
      match PIM6 ipv6
         protocol pim
      match ipv4-all-default ipv4
         actions
            drop
      match ipv6-all-default ipv6
         actions
            drop

URL-based Field Sets in Traffic Policy

Overview

Using field sets in Traffic Policies allows you to easily reuse groups of prefixes, ports, and VLAN IDs in multiple rules without copying and pasting the configuration to each rule. The number of entries in a field set could be a very large number up to hundreds of thousands entries. Loading a large configuration can be costly in terms of time and length of output. Using a URL-based approach allows you to use multiple field sets in a URL and update the entries in a single location.

The field sets update when exiting from the traffic-policies configuration mode or manually using the refresh traffic-policy field-set command.

Configuring URL-based Field Sets for Traffic Policies

Use the following commands to configure a URL-based field set for an IPv4 field set:

switch(configure)# traffic-policies
switch(config-traffic-policies)# field-set ipv4 prefix mybigfieldset 10.0.0.0/8
switch(config-traffic-policies-field-set-ipv4-mybigfieldset)# source http://10.0.0.1/mybigfieldset.txt

IPv4 addresses can use the format A.B.C.D or A.B.C.C/E. IPv6 addresses can use the format A:B:C:D:E:F:G:H or A:B:C:D:E:F:G:H/I.

Use the parameter except to create exceptions for specific IPv4 addresses:

switch(config-traffic-policies-field-set-ipv4-mybigfieldset)# 10.0.0.0/8 except 10.0.0.21

Use the parameter remove to remove IP prefixes from the IP prefix set:

switch(config-traffic-policies-field-set-ipv4-mybigfieldset)# remove 10.0.0.0/8

Add your URL location to the configuration in one of the following formats:

and-results - AND option to join two field sets together.
bgp - Provide a list of BGP prefixes.
file: - Use local URL to load the field set entries.
flash: - Use the local URL from a flash drive and add the field set entries.
http: - Use a remote URL to load the field set entries.
https: - Use a remote URL to load the field set entries
scp: - Use a remote URL to load the field set entries.
static - Configure a static entry for field sets.

Configuring Dynamic Link Flap Damping

To configure Dynamic Link Flap Damping, create profiles and then apply the profiles to interfaces. A profile contains the following set of configurable parameters required by the damping algorithm:

Remote Fault Penalty
Local Fault Penalty
Maximum Threshold
Suppress Threshold
Reuse Threshold
Demerit Half Life Time

Configuring Link Flap Damping Profiles

To create a new damping profile or modify an existing profile, use the monitor link-flap policy to enter the damping profile configuration mode.

Example

Use the following commands to configure a damping profile, MyDampingProfile:

switch(config)#monitor link-flap policy
switch(config-link-flap)#profile MyDampingProfile damping
switch(config-link-flap-damping-profile-MyDampingProfile)#penalty mac fault local 1500
switch(config-link-flap-damping-profile-MyDampingProfile)#penalty mac fault remote 1800
switch(config-link-flap-damping-profile-MyDampingProfile)#penalty threshold reuse 800 suppression 2200 maximum 15000
switch(config-link-flap-damping-profile-MyDampingProfile)#penalty decay half-life 90 seconds

Applying Damping Profiles to Interfaces

Apply the configured damping profiles to interfaces or to groups of interfaces on the switch using one of two methods:

Create a damping profile and assign it to an interface or a group of interfaces.
Create a damping profile and designate it as the default profile. This profile automatically applies to all interfaces without Link Flap damping explicitly disabled and do not have damping profiles assigned to them.

Example

To apply the damping profile, MyDampingProfile, to the interface, Ethernet3/9/1, use the following commands:

switch(config)#interface Ethernet3/9/1
switch(config-if-Et3/9/1)#monitor link-flap profiles MyDampingProfile

Assign multiple profiles to an interface using the following command:

switch(config)#interface Ethernet3/9/1
switch(config-if-Et3/9/1)#monitor link-flap profiles dp1 dp2 dp3

Any of the profiles can assign the damped state to the interface. The interface stays in the damped state if one of the profiles assigned to it assigns the damped state to it.

To remove all profiles from the interface, use the following commands:

switch(config)#interface Ethernet3/9/1
switch(config-if-Et3/9/1)#no monitor link-flap profiles

Adding Default Damping Profiles

Configure one or more damping profiles as the default profile on the switch. Profiles automatically apply to all interfaces on the switch without damping profiles or explicitly disable Link Flap Damping. Default profiles also apply to interfaces subsequently added to the switch.

Examples

Use the following commands to set a damping profile or group of profiles as the default damping profile on the switch:

switch(config)#monitor link-flap policy
switch(config-link-flap)#default-profiles dp1 dp2 dp5

To remove the default profiles, use the following commands:

switch(config)#monitor link-flap policy
switch(config-link-flap)#no default-profiles

Enabling and Disabling Link Flap Damping

Link Flap Damping can be enabled or disabled on a per-interface basis.

Examples

To enable Link Flap Damping on interface, Ethernet3/9/1, use the following commands:

switch(config)#interface Ethernet3/9/1
switch(config-if-Et3/9/1)#default monitor link-flap

To disable Link Flap Damping on interface, Ethernet3/9/1, use the following commands:

switch(config)#interface Ethernet3/9/1
switch(config-if-Et3/9/1)#no monitor link-flap

Displaying Dynamic Link Flap Damping

To display the current status of all interfaces enabled with Link Flap Damping, use the show interface link-flap damping command:

Example

switch(config)#show interface link-flap damping
Interface  Profile       Penalty  Suppressed           Re-use
---------- ------------- -------- -------------------  -------------------
Ethernet1  TestProfile1  2000     2023-10-24 18:47:00  2023-10-24 18:48:25
Ethernet1  TestProfile2  0
Ethernet3  TestProfile1  2500     2023-10-24 18:46:59  2023-10-24 18:48:43
Ethernet3  TestProfile2  300

The output displays the following information about Link Flap Damping:

Interface - The name of interfaces with one or more Damping profiles assigned to them. An interface may be displayed more than once if assigned multiple profiles.
Profile - The name of the assigned profile on the interface
Penalty - The current Damping Demerit value assigned to the profile.
Suppressed - The timestamp when the profile placed the interface into damped state. If not in damped, no information displays for the interface.
Re-use - The timestamp when the profile releases the interface from the damped state if no further link flapping detected on the interface.

Displaying the Interface Status

Use the show interfaces status command to display the status of interfaces on the switch. If configured on an interface, Link Flap Damping information displays in the output.

Example

switch(config)#show interfaces Ethernet3/9/1 status
Port       Name   Status       Vlan     Duplex Speed  Type         Flags Encapsulation
Et3/9/1           notconnect   1        full   100G   100GBASE-CR4 d                 
                        
  Flags : m - Under Maintenance
  v - Violating traffic threshold
  d - Interface state is damped

TCAM Profile for Configurable Port Qualifier Sizing

A TCAM profile can be created from scratch, or the feature can be added to a copy of the default TCAM profile. When creating a profile from scratch, care must be taken to ensure that all needed TCAM features are included in the profile.

Modifying a Default TCAM Profile to allow Dynamic Sizing for ACL Labels

The following commands create a copy of the default TCAM profile, name it port-qualifier-size, and configure it to support a 6-bit dynamic sizing for ACL labels for IPKGV. Once the profile has been created, it can be applied to the system.

switch(config)# hardware tcam
switch(config-hw-tcam)# profile port-qualifier-size copy default
switch(config-hw-tcam-profile-port-qualifier-size)# feature port-qualifier-size ip copy 
system-feature-source-profile
switch(config-hw-tcam-profile-port-qualifier-size-feature-port-qualifier-size)# port-qualifier-size 6
switch(config-hw-tcam-profile-port-qualifier-size-feature-port-qualifier-size)# exit
switch(config-hw-tcam-profile-port-qualifier-size)# feature acl port ip
switch(config-hw-tcam-profile-port-qualifier-size)# exit
switch(config-hw-tcam)# exit
switch(config)#

Verifying the Configuration of Dynamic Qualifier Size

The following command verifies the configuration.

switch# show running-config
hardware tcam
   profile port-qualifier-size
      feature acl port ip
         port qualifier size 6 bits

Verifying the Configuration of System Profile

The following command verifies the system profile was configured and applied successfully. The profile name appears in both the Configuration and Status columns.

switch# show harware tcam profile
              Configuration               Status
Linecard1     port-qualifier-size         port-qualifier-size
Linecard2     port-qualifier-size         port-qualifier-size
Linecard3     port-qualifier-size         port-qualifier-size

When the profile does not get applied correctly, the Status column shows Error.

switch# show harware tcam profile
                Configuration              Status
Linecard1       port-qualifier-size        ERROR
Linecard2       port-qualifier-size        ERROR
Linecard3       port-qualifier-size        ERROR

Note: The packet type, the key field must be set. The dynamic qualifier size can be set for ACL. Not all hardware platforms support this feature. Modular systems require all linecards to support this feature for the profile to be applicable.

Internet Control Message Protocol (ICMP) Probing

ICMP probing provides a method of querying interface status from an ARP or Neighbor Discovery table remotely. It uses a request and a response protocol, similar to ping, but instead of simply responding to the request, the response returns information about a local interface or a remote neighbor. ICMP probing sends the request to the proxy node which can be identified by an interface index, interface name, or an IP address. A neighbor adjacent to the proxy node can be identified by the IP address.

Configuring ICMP Probing

Configure ICMP probing using the Router General Configuration Mode to add the functionality to the switch.

switch(config)# router general
switch(config-router-general)# icmp probe
switch(config-router-general-icmp-probe)# probe vrf default
switch(config-router-general-icmp-probe)# query-types all

The ICMP probing responds all probing requests on the default VRF. Permit each query type using the following parameters:

addr - Allow query by interface address.
all - Allow all query types.
ifindex - Allow query by interface address.
ifname - Allow query by interface name.
remote - Allow query by remote node address.

EOS permits probe requests using the default control plane ACL. To add limitations to the control plane ACL that permits or denies probe requests, use the parameter icmp-extended-echo.

Example

To allow probe requests from only the subnet 10.255.0.0/24, use the following commands:

switch(config-acl-control-plane)# permit icmp 10.255.0.0/24 any extended-echo-request
switch(config-acl-control-plane)# deny icmp any any extended-echo-request

Sending ICMP Probe Requests

To send a probe request to a remote system, use the probe execute command. Specify the destination and the identification of the interface or remote neighbor to probe. Additional parameters identify the probe target such as an interface local to the proxy node or a neighbor adjacent to the proxy node. Use IPv4 or IPv6 addresses, the interface index, or the interface name to specify the local host. Specify a remote neighbor using an IPv4 or IPv6 address. to specify a local inter

switch# probe 10.255.1.1

Additional parameters can be specified including the following:

interval - Specify the interval between probe messages..
repeat - Specify the number of times to send the probe message.
source - Specify the source address or choose an address from the specified interface.

Example

To send a probe to 10.255.1.1 with an interface index of 1, use the following command:

switch> probe 10.255.1.1 ifindex 1
PROBE 10.255.1.1 ifIndex 1 
Interface active with IPv4 configured from 10.255.1.1: icmp_seq=0 time=0.680 ms
Interface active with IPv4 configured from 10.255.1.1: icmp_seq=1 time=0.477 ms
Interface active with IPv4 configured from 10.255.1.1: icmp_seq=2 time=0.362 ms
--- 10.255.1.1 PROBE statistics ---
3 packets transmitted, 3 received, 0% packet loss
3 (100%) successful probes
3 (100%) Interface active with IPv4 configured

Displaying ICMP Probing Information

The show icmp probe command displays the following information:

switch# show icmp probe
VRF default:
Probe responses are enabled
Query types allowed: ifname, ifindex, addr, remote

PROBE requests received: 0
PROBE requests dropped due to size of queue: 0
PROBE responses sent: 0
PROBE requests received but too short: 0
PROBE requests received with an incorrect ICMP checksum: 0
PROBE requests received with a malformed ICMP extension header: 0
PROBE requests received with an incorrect ICMP extension checksum: 0
PROBE requests received with a bad ICMP extension object: 0
PROBE requests received with a request type that is not allowed: 0
PROBE requests for which we could not determine the interface: 0
PROBE requests which requested an interface in a different VRF: 0
PROBE requests for a remote node but specify an interface name or index: 0
PROBE responses that could not be sent due to a socket error: 0
The most recent socket error when sending a response: none

The first section displays the status as the location of the VRF with probe responses enable and the types of permitted queries.

The second section displays the counters for probe requests received from a client and the failure reason when not generating a successful response.

Ethernet Configuration Commands

Global Configuration Commands

clear counters
clear VXLAN counters
hardware port-group
hardware counter feature
hardware counter feature in (DCS-7050x, 7350x, 7300x)
hardware tcam
interface ethernet
interface ethernet create
interface management
monitor ethernet oam
monitor link-flap policy default-profiles
monitor link-flap policy profile damping
traffic-policies field-set
transceiver channel
transceiver qsfp default-mode

EOAM Configuration Commands

link-error
monitor ethernet oam profile
profile

Connectivity Fault Management (CFM) Commands

cfm
cfm continuity-check
cfm domain
cfm measurement
cfm profile
show cfm continuity-check end-point
show cfm endpoint

Hardware TCAM Commands

feature
system

Interface Configuration CommandsEthernet and Management Interfaces

flowcontrol receive
flowcontrol send
link-debounce
mac-address
poe disabled
poe legacy detect
poe limit
power budget
power budget exceed action (warning | hold-down)
speed

Link-error Configuration Commands

action
period
phy link detection aggressive
recovery-time
threshold

Link-Flap Damping Profile Configuration Commands

penalty mac fault
penalty threshold

Traffic Policies Commands

refresh traffic-policy field-set
traffic-policies field-set

Interface Display Commands

show hardware counter
show hardware port-group
show hardware system forwarding-chips
show interface counters
show interfaces counters
show interfaces counters bins
show interfaces counters errors
show interfaces counters ip
show interfaces counters queue
show interfaces counters rates
show interfaces flow-control
show interfaces hardware
show interfaces hardware default
show interfaces interactions
show interface link-flap damping
show interfaces negotiation
show interfaces phy
show interfaces status
show interfaces status errdisabled
show interfaces transceiver
show interfaces transceiver channels
show interfaces transceiver hardware
show interfaces transceiver properties
show monitor ethernet oam profile
show platform fm6000 agileport map
show platform trident flexcounters
show platform trident flexcounters l3intf
show poe
show route counters
show VXLAN counters vni

400GBASE-ZR Transceivers Display Commands

show interface transceiver dom
show interface transceiver eeprom
show transceiver status interface

Shared Support across Multiple Subinterfaces Commands

qos scheduling
show qos scheduling

action

The action command configures the link monitoring action that is specified for the link fault signaling event.

The no actioncommand removes the action type specified for the chosen link fault signaling. The default action command configures the link monitoring action as system log type.

Command Mode

Link-error Configuration

Command Syntax

{fcs | symbol} action [linkfault | errdisable | log]

no {fcs | symbol} action [linkfault | errdisable | log]

default {fcs | symbol} action [linkfault | errdisable | log]

Parameters

fcs Inbound packets with frame check sequence (FCS) error.
symbol Inbound packets with symbol error.
linkfault The link fault action type.
errdisable The errdisable action type.
log The system log action type.

Related Commands

period
threshold

Example

These commands set the errdisable action type for the profile profile1 in the Link-error configuration mode for symbol error.

switch(config)# monitor ethernet oam
switch(config-eoam)# profile profile1
switch(config-eoam-profile-profile1)# link-error
switch(config-eoam-profile-profile1-link-error)# symbol action errdisable

clear counters

The clear counters command in privileged EXEC mode resets the counters to zero for the specified interfaces including VLAN interfaces, Sub-Interfaces, and GRE Tunnel Interfaces.

Command Mode

Privileged EXEC

Command Syntax

clear counters [vlan vlanId | Tunnel tunnelID][[route][ipv4 | ipv6][vrf]]

Parameters

vlan vlanId Clears the VLAN Interface and subinterface Ingress and Egress counters.
Tunnel tunnelID Allows the command to be used for clearing counters only for the specified VLAN interface.
routeClears the route counters.
- ipv4 Allows targeting the clearing of IPv4 route counters.
- ipv6 Allows targeting the clearing of IPv6 route counters.
vrf Allows specifying the VRF to only clear the route counters for the VRF.

Examples

Clears the VLAN Interface and subinterface ingress and egress counters.
```
switch# clear counters[vlan vlanId]
```
Clears the GRE Tunnel Interface Ingress and Egress counters.
```
switch# clear counters[tunnel TunnelId]
```

clear VXLAN counters

Use the clear VXLAN counters command to clear the VXLAN encap and decap counters.

Command Mode

EXEC

Command Syntax

clear VXLAN counters [[vni | [vtep [vtep-ip-address | unlearnt]]]

Parameters

vni Clears the VXLAN counters.
vtep Clears the VTEP counters.
- vtep-ip-address Clears the counters for the specified VTEP.
- unlearnt Clears the counters for unlearned VTEPs. Unlearned VTEPs track the counts of packets received by the switch before the VTEP is learned.

cfm

The cfm command places the switch in CFM configuration mode to configure connectivity fault management on a Layer 3 interface.

The default or no commands remove the profile from the configuration.

Command Mode

Global Configuration

Command Syntax

switch(config-cfm)# continuity-check {loc-state | action | disable | interface |routing}

switch(config-cfm)# domain domain_name level 0-7 intermediate-point

Parameters

continuity-check - Configure continuity check global settings.
- loc-state - Configure settings when LOC detected.
- action- Configure the action to take based on LOC state.
- disable -Toggle the interface based on LOC state.
- interface -Apply the action to the interfaces.
- routing - Disable routing for the interfaces.
domain - Configure a maintenance domain.
- domain-name - Configure a name for the maintenance domain.
level - Configure a maintenance domain level from 0 to 7.
intermediate-point - Configure the switch as a Maintenance intermediate point in this domain.

Example

To display details about an active CFM configuration on a switch, use the following command:

switch (config-cfm)# show active
cfm
            continuity-check loc-state action disable interface routing

cfm continuity-check

The cfm command places the switch in CFM configuration mode to configure connectivity fault management on a Layer 3 interface.

The default command sets the default alarms for defects to loc-state. The no command disables the alarms for the defect.

Command Mode

Global Configuration

Command Syntax

continuity-check loc-state action disable interface routing

Parameters

continuity-check - Configure continuity check global settings.
- loc-state - Configure settings when LOC detected.
- action- Configure the action to take based on LOC state.
- disable -Toggle the interface based on LOC state.
- interface -Apply the action to the interfaces.
- routing - Disable routing for the interfaces.

Example

The following command configures the switch in cfm configuration mode and disables routing for the interfaces.

switch(config-cfm)# continuity-check loc-state action disable interface routing

cfm domain

The cfm domaindomain-name command places the switch in CFM configuration mode to configure a maintenance domain on a device.

The no or default commands unconfigures the maintenance domain.

Command Mode

Global Configuration

Command Syntax

switch(config-cfm)# domain domain-name level 0-7 intermediate-point

Parameters

domain - Configure a maintenance domain.
- domain-name - Configure a name for the maintenance domain.
level - Configure a maintenance domain level from 0 to 7.
maintenance-association - Configure a maintenance association name.
- 1-65535 - Maintenance association name
- direction [up | down] - Set local maintenance end point direction as down or up.
- end-point 1-8191 - Configure local maintenance end point and set the local maintenance end point ID.
- profile profile_name - Apply a connectivity fault management profile.
- remote end-point 1-8191 - Configure remote parameters for an end-point.
- vlan 1-4094 - Set the VLAN in the maintenance association.

Example

To configure a maintenance domain with the name main-domain and a level of 5, use the following command:

switch(config-cfm)# domain main-domain level 5

cfm measurement

The cfm measurement command places the switch in CFM configuration mode to configure Ethernet OAM loss on a device.

Command Mode

Global Configuration

Command Syntax

measurement loss [inband | synthetic]

Parameters

loss - Ethernet OAM loss measurement functions.
- inband - Enable hardware support for OAM loss measurement.
- synthetic - Enable hardware support for OAM synthetic loss measurement.

Example

To configure measurement for CFM as inband, use the following command:

switch(config-cfm)# measurement loss inband

cfm profile

The cfm profile command places the switch in CFM configuration mode to configure a CFM profile.

The no or default commands unconfigures the CFM profile.

Command Mode

Global Configuration

Command Syntax

profile profile-name alarm indication client level 0-7 tx-interval1-1 [minutes |seconds]

Parameters

alarm - Configure alarm indication signal protocol parameters.
- indication - Configure alarm indication signal protocol parameters.
- client - Configure client maintenance domain level for AIS transmission.
- level 0-7- Configure client maintenance domain level for AIS transmission. Choose a level between 0 and 7.
- tx-interval [minutes | seconds] - Sets the time for periodic transmission of CCMs. Configure interval in minutes or seconds. For example, set the interval and unit to one of the following supported transmission intervals:
  - 3.33 milliseconds
  - 10 milliseconds
  - 100 milliseconds
  - 1 second
  - 10 seconds
  - 1 minute
  - 10 minutes
  The no or default command sets the transmission interval to the default value of 1 second.
continuity-check alarm defect - Configure defects that raise alarms.
- cross-connection - Raise alarms when cross connection defects occur on the network. The defect logs when a local MEP receives a CCM PDU from another maintenance association.
- error-ccm - Raise alarms when invalid CCMs occur on the network. The defect logs when a local MEP receives a CCM PDU with the wrong CCM transmission interval or has an uncofnigured RMEP ID or the RMEP ID is the same as the local MEP ID.
- loc-state - Raise alarms when a loss of connectivity occurs on the network. The defect logs when a local MEP loses connectivity with a remote MEP. Enabled by default.
- rdi-ccm - Raise alarms when CCMs with the RDI bit set occur on the network. The defect logs when a local MEP receives a CCM with the RDI flag set to true from the remote MEP. Enabled by default.
- measurement [delay | loss] - Configure delay or loss measurement.
  - delay
    - qos cos 0-7 - Configure QoS parameters and set cos to a value between 0 and 7.
    - single-ended - Configure single-ended performance measurement.
    - tx-interval [minutes | seconds] - Sets the time for periodic transmission of CCMs. Configure interval in minutes or seconds. For example, set the interval and unit to one of the following supported transmission intervals:
      - 3.33 milliseconds
      - 10 milliseconds
      - 100 milliseconds
      - 1 second
      - 10 seconds
      - 1 minute
      - 10 minutes
  - loss
    - qos cos 0-7 - Configure QoS parameters and set cos to a value between 0 and 7.
    - single-ended - Configure single-ended performance measurement.
    - synthetic - Configure synthetic loss measurement.
      - qos cos 0-7 - Configure QoS parameters and set cos to a value between 0 and 7.
      - single-ended - Configure single-ended performance measurement.
    - tx-interval [minutes | seconds] - Sets the time for periodic transmission of CCMs. Configure interval in minutes or seconds. For example, set the interval and unit to one of the following supported transmission intervals:
      - 3.33 milliseconds
      - 10 milliseconds
      - 100 milliseconds
      - 1 second
      - 10 seconds
      - 1 minute
      - 10 minutes

feature

Thefeature command allows the user to reserve the number of TCAM banks for the following features such as ACL, flow-spec, IPsec, l2-protocol, PBR, QoS, TCP-MSS-ceiling, traffic-policy.

Theexit command returns the switch to global configuration mode.

Command Mode

Hardware TCAM

Command Syntax

feature

Example

This commands allows the switch to configure the TCAM flow-spec feature for IPv4 ports.

switch(config-hw-tcam)# feature flow-spec port ipv4 bank maximum count 12

flowcontrol receive

The flowcontrol receive command configures administrative settings for inbound flowcontrol packets. Ethernet ports use flow control to delay packet transmission when port buffers run out of space. Ports transmit a pause frame when their buffers are full, signaling their peer ports to delay sending packets for a specified period.

The flowcontrol receive command configures the configuration mode port's ability to receive flowcontrol pause frames.

off: port does not process pause frames that it receives.
on: port processes pause frames that it receives.
desired: port autonegotiates flow control; processes pause frames if the peer is set to send desired.

Desired is not an available parameter option. Ethernet data ports cannot be set to desired. Management ports are set to desired by default and with the no flowcontrol receive command.

The port linking process includes flow control negotiation. Ports must have compatible flow control settings to create a link. The table below lists the compatible flow control settings.

Table 9. Compatible Settings for Flow Control Negotiation – Local Port Receiving
local port	peer port
receive on	send on or send desired
receive off	send off or send desired
receive desired	send on , send off, or send desired

The no flowcontrol receive and default flowcontrol receive commands restore the default flowcontrol setting for the configuration mode interface by removing the corresponding flowcontrol receive command from running-config. The default setting is off for Ethernet data ports and desired for Management ports.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

flowcontrol receive STATE

no flowcontrol receive

default flowcontrol receive

Parameters

STATE flow control pause frame processing setting. Options include:

On
Off

Example

These commands set the flow control received on Ethernet interface 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# flowcontrol receive on
switch(config-if-Et5)#

flowcontrol send

The flowcontrol send command configures administrative settings for outbound flow control packets. Ethernet ports use flow control to delay packet transmission when port buffers run out of space. Ports transmit a pause frame when their buffers are full, signaling their peer ports to delay sending packets for a specified period.

The flowcontrol send command configures the configuration mode port's ability to transmit flow control pause frames.

off: port does not send pause frames.
on: port sends pause frames.
desired: port autonegotiates flow control; sends pause frames if the peer is set to receive desired.

Desired is not an available parameter option. Ethernet data ports cannot be set to desired. Management ports are set to desired by default and with the no flowcontrol send command.

Table 10. Compatible Settings for Flow Control Negotiation Local Port Transmitting
local port	peer port
send on	receive on or receive desired
send off	receive off or receive desired
send desired	receive on , receive off, or receive desired

The no flowcontrol send and default flowcontrol send commands restore the default flow control setting for the configuration mode interface by removing the corresponding flowcontrol send command from running-config. The default setting is off for Ethernet data ports and desired for Management ports.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

flowcontrol send STATE

no flowcontrol send

default flowcontrol send

Parameters

STATE Flow control send setting. Options include:

on
off

Example

These commands set the flow control sent on interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# flowcontrol send on
switch(config-if-Et5)#

hardware counter feature

You can enable on a per feature basis the hardware counter feature command from the global configuration mode. The no hardware counter feature disables the feature. Multiple ingress and egress hardware counter features can work concurrently.

Command Mode

Global configuration mode

Command Syntax

Parameters

vlan-interface Enables VLAN interface counters
- in Enables the counting of ingress VLAN interface counters. When configured, the switch counts the number of unicast packets, multicast packets and total octets ingressing through the VLANinterface for every VLAN interface configured in the system.
- out Enables the counting of egress VLAN interface counters. When configured, the switch counts the number of unicast packets, multicast packets and total octets egressing the vlan interface for every vlan interface configured in the system.
subinterfaceEnables the counting subinterface counters.
- inEnables the counting of ingress subinterface counters. When configured, the switch counts the number of unicast packets, multicast packets and total octets ingressing through the subinterface for every L3 subinterface configured in the system.
- out Enables the counting of egress subinterface counters. When configured, the switch counts the number of unicast packets, multicast packets and total octets egressing the subinterface for every L3 subinterface configured in the system.
vniEnables the counting of per VNI counters.
- encap Enables the per encap counters. When enabled, the switch counts the number of packets/octets coming from the edge, encapsulated on the device and directed towards the core.
- decap Enables the per VTEP decap counters. When enabled, the switch counts the number of packets/octets coming from the core, decapsulated on the device and heading towards the edge per each VTEP.
routeConfigures the route counters for the specified ip version and ip-address/ip-prefix. When enabled, the switch counts the number of packets/bytes hitting a route.
- ipv4Identifies the IPv4 route.
- ipv6 Identifies the IPv6 route.
vrf name The VRF name is optional and default VRF is assumed if no VRF is specified.
ip-address Specifies the target IP address.
ip-address-prefix Specifies the target IP address prefix.
gre tunnel interfaceEnables GRE tunnel interface counters.
- in Enables GRE tunnel interface decap counters. When enabled, the switch counts the number of unicast GRE packets and total octets getting decapsulated on the tunnel interface.
- out Enables GRE Tunnel Interface encap counters. When enabled, the switch counts the number of unicast GRE packets and total octets getting encapsulated on the Tunnel Interface.

Examples

switch# hardware counters feature vlan-interface in

switch# hardware counter feature vlan-interface out

switch# hardware counter feature subinterface in

switch# hardware counter feature subinterface out

switch(config)# hardware counter feature vni encap

switch(config)# hardware counter feature vni decap

switch(config)# hardware counter feature vtep encap

switch(config)# hardware counter feature vtep decap

switch(config)# hardware counter feature gre tunnel interface in

switch(config)# hardware counter feature gre tunnel interface out

hardware counter feature in (DCS-7050x, 7350x, 7300x)

The hardware counter feature command enables the switch to count the ingress traffic on the Layer 3 port of the switch. Any traffic on Layer 3 sub-interfaces and VLAN interface with IPv4 and IPv6 addresses are accounted irrespective of the routing decision.

The no hardware counter feature in command disable the counter configuration from the switch ports. By default the ingress counter is disabled on the switch.

Command Mode

Global Configuration

Command Syntax

hardware counter feature [INTERFACE]in

no hardware counter feature [INTERFACE]in

Parameters

INTERFACE Layer 3 interface on the switch.

subinterface Displays the subinterface traffic count.
vlan-interface Displays the VLAN-interface traffic count.

Examples

This command configures the ingress traffic count on the sub-interfaces.
```
switch# hardware counter feature subinterface in
```
This command configures the ingress traffic count on the VLAN interface.
```
switch# hardware counter feature vlan-interface in
```

These commands enable the QSFP+ interface in port group 1 and SFP+ interfaces in port group 2 on a DCS-7050Q-16 switch, display the port group status, and display interface status.


switch(config)# hardware port-group 1 select Et15/1-4
switch(config)# hardware port-group 2 select Et21-24
switch(config)# show hardware port-group

Portgroup: 1    Active Ports: Et17-20
Port            State
------------------------------------------
Ethernet17      ErrDisabled
Ethernet18      ErrDisabled
Ethernet19      ErrDisabled
Ethernet20      ErrDisabled
Ethernet15/1    Active
Ethernet15/2    Active
Ethernet15/3    Active
Ethernet15/4    Active

Portgroup: 2    Active Ports: Et16/1-4
Port            State
------------------------------------------
Ethernet16/1    Active
Ethernet16/2    Active
Ethernet16/3    Active
Ethernet16/4    Active
Ethernet21      ErrDisabled
Ethernet22      ErrDisabled
Ethernet23      ErrDisabled
Ethernet24      ErrDisabled
switch(config)# show interfaces status
Port      Name              Status       Vlan        Duplex  Speed Type
Et1/1                       connected    in Po621      full    40G 40GBASE-CR4
Et1/2                       errdisabled  inactive    unconf unconf 40GBASE-CR4
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et15/1                      connected    in Po711      full    40G 40GBASE-CR4
Et15/2                      errdisabled  inactive    unconf unconf Not Present
Et15/3                      errdisabled  inactive    unconf unconf Not Present
Et15/4                      errdisabled  inactive    unconf unconf Not Present
Et16/1                      errdisabled  inactive    unconf unconf Not Present
Et16/2                      errdisabled  inactive    unconf unconf Not Present
Et16/3                      errdisabled  inactive    unconf unconf Not Present
Et16/4                      errdisabled  inactive    unconf unconf Not Present
Et17                        errdisabled  inactive    unconf unconf Not Present
Et18                        errdisabled  inactive    unconf unconf Not Present
Et19                        errdisabled  inactive    unconf unconf Not Present
Et20                        errdisabled  inactive    unconf unconf Not Present
Et21                        connected    425           full    10G 10GBASE-SRL
Et22                        connected    611           full    10G 10GBASE-SRL
Et23                        connected    in Po998      full    10G 10GBASE-SLR
Et24                        connected    in Po998      full    10G 10GBASE-SLR
switch(config)#

These commands enable the QSFP+ interface in port group 1 and SFP+ interfaces in port group 2 on a DCS-7050Q-16 switch, display the port group status, and display interface status.


switch(config)# hardware port-group 1 select Et15/1-4
switch(config)# hardware port-group 2 select Et21-24

switch(config)# show hardware port-group

Portgroup: 1    Active Ports: Et17-20
Port            State
------------------------------------------
Ethernet17      ErrDisabled
Ethernet18      ErrDisabled
Ethernet19      ErrDisabled
Ethernet20      ErrDisabled
Ethernet15/1    Active
Ethernet15/2    Active
Ethernet15/3    Active
Ethernet15/4    Active

Portgroup: 2    Active Ports: Et16/1-4
Port            State
------------------------------------------
Ethernet16/1    Active
Ethernet16/2    Active
Ethernet16/3    Active
Ethernet16/4    Active
Ethernet21      ErrDisabled
Ethernet22      ErrDisabled
Ethernet23      ErrDisabled
Ethernet24      ErrDisabled
switch(config)# show interfaces status
Port      Name              Status       Vlan        Duplex  Speed Type
Et1/1                       connected    in Po621      full    40G 40GBASE-CR4
Et1/2                       errdisabled  inactive    unconf unconf 40GBASE-CR4
<-------OUTPUT OMITTED FROM EXAMPLE-------->
Et15/1                      connected    in Po711      full    40G 40GBASE-CR4
Et15/2                      errdisabled  inactive    unconf unconf Not Present
Et15/3                      errdisabled  inactive    unconf unconf Not Present
Et15/4                      errdisabled  inactive    unconf unconf Not Present
Et16/1                      errdisabled  inactive    unconf unconf Not Present
Et16/2                      errdisabled  inactive    unconf unconf Not Present
Et16/3                      errdisabled  inactive    unconf unconf Not Present
Et16/4                      errdisabled  inactive    unconf unconf Not Present
Et17                        errdisabled  inactive    unconf unconf Not Present
Et18                        errdisabled  inactive    unconf unconf Not Present
Et19                        errdisabled  inactive    unconf unconf Not Present
Et20                        errdisabled  inactive    unconf unconf Not Present
Et21                        connected    425           full    10G 10GBASE-SRL
Et22                        connected    611           full    10G 10GBASE-SRL
Et23                        connected    in Po998      full    10G 10GBASE-SLR
Et24                        connected    in Po998      full    10G 10GBASE-SLR
switch(config)#

hardware port-group

The hardware port-group command configures a port group to activate either a single interface at a higher speed such as QSFP-DD at 400Gb/s, or multiple interfaces at a lower speed such as QSFP-56 at 200Gb/s.

The no hardware port-group and default hardware port-group commands restore the default settings for the specified port group, by removing the corresponding hardware port-group command from running-config.

The hardware port-group command is available on DCS-7280CR3-36S, DCS-7050Q-16, and DCS-7050QX-32S switches, and has different parameters on each platform.

Command Mode

Global Configuration

Command Syntax

hardware port-group port_group_id select port_group_mode

no hardware port-group port_group_id [ select port_group_mode ]

default hardware port-group port_group_id [ select port_group_mode ]

Parameters

port_group_id

Label of the port group. On the 7280CR3-36S and 7050Q-16, the valid options are 1 and 2. On the 7050QX-32S, only label 1 is available.
port_group_mode
Ports activated by the command. Options vary by platform and depend on the port_group_id value.
- DCS-7280CR3-36
  - Port group 1:
    
    1x-qsfp-dd(Et33): Ethernet33/1 is capable of 400Gb/s. Ethernet34 is inactive.
    
    2x-qsfp-56(Et33,Et34): Ethernet33/1 is not capable of 400Gb/s. Ethernet34 is active.
  - Port group 2:
    
    1x-qsfp-dd(Et35): Ethernet35/1 is capable of 400Gb/s. Ethernet36 is inactive.
    
    2x-qsfp-56(Et35,36): Ethernet35/1 is not capable of 400Gb/s. Ethernet36 is active.
- DCS-7050Q-16
  - Port group 1:
    
    Et15/1-4: QSFP+ port is activated on port group 1.
    
    Et17-20: SFP+ ports are activated on port group 1.
  - Port group 2:
    
    Et16/1-4: QSFP+ port is activated on port group 2.
    
    Et21-23: SFP+ ports are activated on port group 2.
- DCS-7050QX-32S
  - Port group 1:
    
    Et15/1-4: QSFP+ port is activated on port group 1.
    
    Et17-20: SFP+ ports are activated on port group 1.
  - Port group 2:
    
    Invalid port group.

Examples

On a DCS-7280CR3-36S switch, the following commands activate Ethernet35/1 as a QSFP-DD (400Gb/s) port and deactivate Ethernet36, and then display the port-group status.

switch(config)# hardware port-group 2 select 1x-qsfp-dd(Et35)
!
                  WARNING!
   Changing the port-group mode will cause all
   interfaces on ports 35,36 to flap.

Do you wish to proceed with this command? [y/N]y
switch(config)# show hardware port-group

Portgroup: 1    Active Ports: Et33/1-4,34/1-4
Limitations: 400G unavailable on Ethernet33/1
Port            State
------------------------------------------
Ethernet33/1    Active
Ethernet33/2    Active
Ethernet33/3    Active
Ethernet33/4    Active
Ethernet33/5    Inactive
Ethernet33/6    Inactive
Ethernet33/7    Inactive
Ethernet33/8    Inactive
Ethernet34/1    Active
Ethernet34/2    Active
Ethernet34/3    Active
Ethernet34/4    Active

Portgroup: 2    Active Ports: Et35/1-8
Port            State
------------------------------------------
Ethernet35/1    Active
Ethernet35/2    Active
Ethernet35/3    Active
Ethernet35/4    Active
Ethernet35/5    Active
Ethernet35/6    Active
Ethernet35/7    Active
Ethernet35/8    Active
Ethernet36/1    Inactive
Ethernet36/2    Inactive
Ethernet36/3    Inactive
Ethernet36/4    Inactive
switch(config)#

On a DCS-7280CR3-36S switch, the following commands restore settings for port group 2 to the default values, and then display the port-group status.

switch(config)# no hardware port-group 2
!
                  WARNING!
   Changing the port-group mode will cause all
   interfaces on ports 35,36 to flap.

Do you wish to proceed with this command? [y/N]y
switch(config)# show hardware port-group

Portgroup: 1    Active Ports: Et33/1-4,34/1-4
Limitations: 400G unavailable on Ethernet33/1
Port            State
------------------------------------------
Ethernet33/1    Active
Ethernet33/2    Active
Ethernet33/3    Active
Ethernet33/4    Active
Ethernet33/5    Inactive
Ethernet33/6    Inactive
Ethernet33/7    Inactive
Ethernet33/8    Inactive
Ethernet34/1    Active
Ethernet34/2    Active
Ethernet34/3    Active
Ethernet34/4    Active

Portgroup: 2    Active Ports: Et35/1-4,36/1-4
Limitations: 400G unavailable on Ethernet35/1
Port            State
------------------------------------------
Ethernet35/1    Active
Ethernet35/2    Active
Ethernet35/3    Active
Ethernet35/4    Active
Ethernet35/5    Inactive
Ethernet35/6    Inactive
Ethernet35/7    Inactive
Ethernet35/8    Inactive
Ethernet36/1    Active
Ethernet36/2    Active
Ethernet36/3    Active
Ethernet36/4    Active
switch(config)#

hardware tcam

The hardware tcam command places the switch in Hardware TCAM configuration mode.

The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

hardware tcam

Related Commands

profile
interface ethernet

Example

This command places the switch in Hardware TCAM configuration mode.

switch(config)# hardware tcam
switch(config-hw-tcam)#

interface ethernet create

The interface ethernet create command is used to configure a range of Ethernet subinterfaces. The command places the switch in Ethernet-interface configuration mode for the specified range of subinterfaces.

Command Mode

Global Configuration

Command Syntax

interface ethernet create sub_range

Parameters

sub_range Range of subinterfaces to be configured. Subinterfaces are named by adding a period followed by a unique subinterface number to the name of the parent interface.

Example

This command enters interface configuration mode for Ethernet subinterfaces 1/1.1-100:

switch(config)# interface ethernet create 1/1.100
switch(config-if-Et1/1.1-100)#

interface ethernet

The interface ethernet command places the switch in Ethernet-interface configuration mode for the specified interfaces. The command can specify a single interface or multiple interfaces.

Ethernet interfaces are physical interfaces and are not created or removed.

Interface management commands include:

description
exit
load-interval
mtu
shutdown (Interfaces)

Ethernet management commands include:

flowcontrol
mac-address
speed

Chapters describing supported protocols and other features list additional configuration commands available from Ethernet interface configuration mode.

Command Mode

Global Configuration

Command Syntax

interface ethernet e_range

Parameter

e_range Ethernet interfaces (number, range, or comma-delimited list of numbers and ranges). Valid Ethernet numbers depend on the switch's available Ethernet interfaces.

Examples

This command enters interface configuration mode for Ethernet interfaces 1 and 2:
```
switch(config)# interface ethernet 1-2
switch(config-if-Et1-2)#
```
This command enters interface configuration mode for interface ethernet 1:
```
switch(config)# interface ethernet 1
switch(config-if-Et1)#
```

interface management

The interface management command places the switch in management-interface configuration mode for the specified interfaces. The list can specify a single interface or multiple interfaces if the switch contains more than one management interface.

Management interfaces are physical interfaces and are not created or removed.

Interface management commands include:

description
exit
load-interval
mtu
shutdown (Interfaces)

Ethernet management commands include:

flowcontrol
mac-address
speed

Chapters describing supported protocols and other features list additional configuration commands available from management-interface configuration mode.

Command Mode

Global Configuration

Command Syntax

interface management m_range

Parameter

m_range Management interfaces (number, range, or comma-delimited list of numbers and ranges).

Valid management numbers depend on the switchs available management interfaces. A value of 0, where available, configures the virtual management interface on a dual-supervisor modular switch. Management interface 0 accesses management port 1 on the active supervisor of a dual-supervisor modular switch.

Examples

This command enters the interface configuration mode for management interfaces 1 and 2.
```
switch(config)# interface management 1-2
switch(config-if-Ma1-2)#
```
This command enters the interface configuration mode for management interface 1:
```
switch(config)# interface management 1
switch(config-if-Ma1)#
```

link-debounce

The link-debounce command configures the link debounce time for the configuration mode interface. Link debounce time is the time that advertisements for new link states are delayed after the link state is established. By default, debounce time is set to zero, disabling link debounce.

Debounce times for link-up and link-down transitions can be independently configured.

Link-up debounce time: the delay before an interface advertises link down to link up transitions.
Link-down debounce time: the delay before an interface advertises link up to link down transitions.

The no link-debounce and default link-debounce commands restore the default debounce setting for the configuration mode interface by removing the corresponding link-debounce command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

link-debounce time WAIT_TIME

no link-debounce time WAIT_TIME

default link-debounce time WAIT_TIME

Parameters

WAIT_TIME Link debounce period (milliseconds). All debounce values range from 0 (disabled) to 30000 (30 seconds). Options include:

0 - 30000 One debounce value assigned as both link up and link down.
0 - 30000 0 - 30000 Two debounce values: link up is first, link down is second.

Examples

These commands set the link-up and link-down debounce period to 10 seconds on interface ethernet 5.

switch(config)# interface ethernet 5
switch(config-if-Et5)# link-debounce time 10000
switch(config-if-Et5)#

These commands set the link-up debounce to 10 seconds and the link-down debounce period to zero on interface ethernet 5.
```
switch(config)# interface ethernet 5
switch(config-if-Et5)# link-debounce time 10000 0
switch(config-if-Et5)#
```
These commands set the link-up debounce to 0 and the link-down debounce period to 12.5 seconds on interface ethernet 5.
```
switch(config)# interface ethernet 5
switch(config-if-Et5)# link-debounce time 0 12500
switch(config-if-Et5)#
```

link-error

The link-error command places the Ethernet Operations, Administration, and Management (EOAM) profile in the EOAM link-error sub-mode.

The no link-error and default link-error commands exit from the EOAM link-error sub-mode.

Command Mode

EOAM Configuration

Command Syntax

link-error

no link-error

default link-error

Related Commands

monitor ethernet oam profile
show monitor ethernet oam profile

Example

These commands place the EOAM profile profile1 in the link-error sub-mode.

switch(config)# monitor ethernet oam
switch(config-eoam)# profile profile1
switch(config-eoam-profile-profile1)# link-error
switch(config-eoam-profile-profile1-link-error)#

mac-address

The mac-address command assigns a MAC address to the configuration mode interface. An interfaces default MAC address is its burn-in address.

The no mac-address and default mac-address commands revert the interface to its default MAC address by removing the corresponding mac-address command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

mac-address address

no mac-address

default mac-address

Parameter

address MAC address assigned to the interface. Format is dotted hex notation (H.H.H). Disallowed addresses are 0.0.0 and FFFF.FFFF.FFFF.

Example

This command assigns the MAC address of 001c.2804.17e1 to interface ethernet 7, then displays interface parameters, including the assigned address.

switch(config)# interface ethernet 7
switch(config-if-Et7)# mac-address 001c.2804.17e1
switch(config-if-Et7)# show interface ethernet 7
Ethernet3 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 001c.2804.17e1 (bia 001c.7312.02e2)
  Description: b.e45
  MTU 9212 bytes, BW 10000000 Kbit
  Full-duplex, 10Gb/s, auto negotiation: off
  Last clearing of "show interface" counters never
  5 seconds input rate 7.84 kbps (0.0% with framing), 10 packets/sec
  5 seconds output rate 270 kbps (0.0% with framing), 24 packets/sec
     1363799 packets input, 222736140 bytes
     Received 0 broadcasts, 290904 multicast
     0 runts, 0 giants
     0 input errors, 0 CRC, 0 alignment, 0 symbol
     0 PAUSE input
     2264927 packets output, 2348747214 bytes
     Sent 0 broadcasts, 28573 multicast
     0 output errors, 0 collisions
     0 late collision, 0 deferred
     0 PAUSE output
switch(config-if-Et7)#

monitor ethernet oam profile

The monitor ethernet oam profile command applies the EOAM profile to the specific interface in interface configuration mode.

The no monitor ethernet oam profile and default monitor ethernet oam profile commands remove the EOAM profile from the interface.

Command Mode

Interface Configuration

Command Syntax

monitor ethernet oam profile name

no monitor ethernet oam profile

default monitor ethernet oam profile

Parameters

name The EOAM profile name. An EOAM profile cannot be named as summary.

Related Commands

link-error
show monitor ethernet oam profile

Example

These commands apply the EOAM profile profile1 to the interface ethernet 1/1.

switch(config)# interface ethernet 1/1
switch(config-if-Et1/1)# monitor ethernet oam profile profile1

monitor ethernet oam

The monitor ethernet oam command places the switch in the Ethernet Operations, Administration, and Management (EOAM) configuration mode.

The no monitor ethernet oam and default monitor ethernet oam commands exit from the EOAM configuration mode.

Command Mode

Global Configuration

Command Syntax

monitor ethernet oam

no monitor ethernet oam

default monitor ethernet oam

Example

This command places the switch in the EOAM configuration mode.

switch(config)# monitor ethernet oam
switch(config-eoam)#

monitor link-flap policy default-profiles

The monitor link-flap policy default-profiles permits you to enter the link-flap configuration mode and add a list of Damping profiles as the default profiles for the switch.

Command Mode

Global Configuration

Command Syntax

monitor link-flap policy [default-profiles | profiles]

Parameters

link-flap - Specify the flap-setting values for link flap errdisable cause
policy - Manage profiles for link flap detection.
default-profiles profile_name - Add default Damping profiles to a switch.

Example

Use the following command to add Damping profiles, dp1, dp2, dp5 to the list of default Damping profiles:

switch(config)#monitor link-flap policy
switch(config-link-flap)#default-profiles dp1, dp2, dp5

monitor link-flap policy profile damping

The monitor link-flap policy profile puts the switch in Link-Flap Configuration Mode and allows you to add Damping profiles to the configuration. This command then enters the Link-Flap Damping Profile Configuration mode.

The no monitor link-flap policy profiles command removes all Damping profiles from an interface.

Command Mode

Link-Flap Configuration Mode

Command Syntax

monitor link-flap profile profile_name damping

Parameters

profile_name - Specify a name for the Damping profile.

Example

Use the following command to create a Damping profile, MyDampingProfile:

switch(config)#monitor link-flap policy
switch(config-link-flap)#profile MyDampingProfile damping
switch(config-link-flap-damping-profile-MyDampingProfile)#

penalty mac fault

The penalty mac fault parameter permits configuration of the Damping policy MAC fault changes after entering the Link-Flap Damping Profile Configuration mode.

Command Mode

Link-Flap Damping Profile Configuration Mode

Command Syntax

penalty mac fault [local | remote] penalty_value

Parameters

mac - Configure the penalty for MAC address state changes.
fault - Configure the penalty for MAC fault changes.
local - Configure the penalty for local fault changes.
remote - Configure the penalty for remote fault changes.
penalty_value - Configure a value between 1 and 5000. Specify 0 for no penalty.

Example

Use the following commands to configure a local MAC fault penalty of 2500 for the Damping profile, MyDampingProfile:

switch(config)#monitor link-flap policy
                switch(config-link-flap)#profile MyDampingProfile damping
                switch(config-link-flap-damping-profile-MyDampingProfile)#penalty mac fault local 2500

penalty threshold

The penalty threshold parameter permits configuration of the link flap damping threshold for the penalty after entering the Link-Flap Damping Profile Configuration mode.

Command Mode

Link-Flap Damping Profile Configuration Mode

Command Syntax

penalty threshold [maximum | reuse | suppression] penalty_value

Parameters

maximum penalty_value - Configure the maximum value of the penalty for a link. Specify a penalty value between 0 and 1000000 with a default value of 12000.
reuse penalty_value - Configure the penalty value to trigger the reuse of a suppressed link. Specify a penalty value between 0 and 1000000 with a default value of 750.
suppression penalty_value - Configure the penalty value to trigger suppression of a link. Specify a penalty value between 0 and 1000000 with a default value of 200.

Example

Use the following commands to configure the penalty thresholds, reuse 800, suppression 2200, and maximum 15000 for the damping profile, MyDampingProfile:

switch(config)#monitor link-flap policy
switch(config-link-flap)#profile MyDampingProfile damping
switch(config-link-flap-damping-profile-MyDampingProfile)#penalty reuse 800 suppression 2200 maximum 15000

period

The period command configures the link monitoring period that is specified for a link error in terms of number of frames or seconds.

Theno period command removes the period type specified on the chosen link error. The defaultperiodcommand configures the link monitoring period as zero seconds.

Command Mode

Link-error Configuration

Command Syntax

{fcs | symbol} period num {seconds | frames}

no {fcs | symbol} period num {seconds | frames}

default {fcs | symbol} period num {seconds | frames}

Parameters

fcs Inbound packets with Frame Check Sequence (FCS) error.
symbol Inbound packets with symbol error.
num The link monitoring period in frames or seconds. The frames value ranges from 1 to 4000000000. The seconds value ranges from 2 to 200 seconds. The default value is 2 seconds.
- seconds The monitor errors per num seconds.
- frames The monitor errors per num frames.

Related Commands

action
threshold

Example

These commands set the frames period type for the profile profile1 in the Link-error configuration mode for 300 frames.

switch(config)# monitor ethernet oam                        
switch(config-eoam)# profile profile1
switch(config-eoam-profile-profile1)# link-error
switch(config-eoam-profile-profile1-link-error)# symbol period 300 frames

phy link detection aggressive

The phy link detection aggressive command allows configuration of interfaces for aggressive link-up declaration (~50 ms) on those interfaces. no/default phy link detection aggressive configuration reverts to a more reliable link-up with at least a two-second delay. When the aggressive mode is not supported, the system generates an advisory message.

Command Mode

Global Configuration

Command Syntax

phy link detection aggressive

no phy link detection aggressive

default phy link detection aggressive

Examples

This command configures aggressive link detection.

switch(config-if-Et1)# phy link detection aggressive
switch(config-if-Et1)#

This command configures aggressive link detection but fails on a platform that does not support the feature.

switch(config-if-Et1)# phy link detection aggressive
detection     detection not supported on this hardware platform
switch(config-if-Et1)#

poe disabled

Power over Ethernet (PoE) is enabled on all Ethernet ports by default on switches that support PoE. The poe disabled command disables PoE on the configuration-mode interface.

The no poe disabled and default poe disabled commands restore PoE on the interface by removing the corresponding poe disabled command from running-config.

Command Mode

Interface-Ethernet Configuration

Command Syntax

poe disabled

no poe disabled

default poe disabled

Example

These commands disable PoE on interface ethernet 7.

switch(config)# interface ethernet 7
switch(config-if-Et7)# poe disabled
switch(config-if-Et7)#

poe legacy detect

IEEE-compliant Powered Devices (PDs) are recognized by a specific resistance signature to a test signal sent by the switch, but non-compliant (legacy or proprietary) PDs may use a capacitive signature instead. The poe legacy detect command causes the configuration-mode interface to attempt to use hardware detection for these non-compliant PoE devices and power them. By default, legacy PD detection is disabled, and legacy devices are not powered.

The no poe legacy detect and default poe legacy detect commands restore the default behavior by removing the corresponding poe legacy detect command from running-config.

Command Mode

Interface-Ethernet Configuration

Command Syntax

poe legacy detect

no poe legacy detect

default poe legacy detect

Example

These commands configure interface ethernet 7 to attempt to detect and power capacitive PDs.

switch(config)# interface ethernet 7
switch(config-if-Et7)# poe legacy detect
switch(config-if-Et7)#

poe limit

Power over Ethernet (PoE) power output is limited by the hardware-negotiated power level and by the total power capacity of the switch. The poe limit command sets an additional maximum power output for the configuration-mode interface. The power limit represents the power output at the Ethernet port; actual power delivered to the PD will be lower due to power loss along the Ethernet cable.

Note: If a power limit is set by this command, Power Via MDI TLVs will not be sent from the interface. See Configuring LLDP for Power over Ethernet for details.

The no poe limit and default poe limit commands restore the default power limitation by removing the corresponding poe limit command from running-config.

Command Mode

Interface-Ethernet Configuration

Command Syntax

poe limit {class class_num | watt_num watts}

no poe limit

default poe limit

Parameters

class_num Specifies the power output limit by power class. Values range from 0-6 as follows:
- Class 0 = 15.4 W
- Class 1 = 4 W
- Class 2 = 7 W
- Class 3 = 15.4 W
- Class 4 = 30 W
- Class 5 = 45 W
- Class 6 = 60 W
watt_num Specifies the power output limit in watts. Values range from 0-60. A value of 0 watts prevents the port from providing PoE power.

Examples

These commands limit nominal PoE power output on interface ethernet 7 to 10 W.

switch(config)# interface ethernet 7
switch(config-if-Et7)# poe limit 10 watts
switch(config-if-Et7)#

These commands limit nominal PoE power output on interface ethernet 7 to 4 W.

switch(config)# interface ethernet 7
switch(config-if-Et7)# poe limit class 1
switch(config-if-Et7)#

power budget

Power over Ethernet (PoE) budget is not set on all Ethernet ports by default on switches that support PoE. The power budget [n] watts command sets a limit of 'n' watts available for use by the ports on the switch. Otherwise, available power for PoE is limited to the sum of all power provided by the PSUs minus the power reserved for the chassis.

The no power budget restores the default state.

Command Mode

Interface-Ethernet Configuration

Command Syntax

power budget [n] watts

no power budget

Example

The following command sets the PoE power budget to 600W.

switch(config)# power budget 600 watts

power budget exceed action (warning | hold-down)

When the Power over Ethernet (PoE) ports exceeds the budgeted amount, the switch issues a warning and continues to provide additional power above the budgeted limit. The power budget exceed action hold-down command causes the switch to issue a warning and limit the power to the configured limit.

The no power budget restores the default state.

Command Mode

Interface-Ethernet Configuration

Command Syntax

power budget exceed action hold-down

no power budget

Example

The following commands set the PoE power budget to 600W and configure the switch to not exceed the limit.

switch(config)# power budget 600 watts
switch(config)# power budget exceed action hold-down

profile

The profile command creates an Ethernet Operations, Administration, and Management (EOAM) profile in the EOAM configuration mode.

The no profile and default profile commands exit from the EOAM configuration mode.

Command Mode

EOAM Configuration

Command Syntax

profile profile_name

no profile profile_name

default profile profile_name

Parameter

profile_name The profile name that is specified.

Related Commands

monitor ethernet oam profile
show monitor ethernet oam profile

Guidelines

Run the shutdown or no shutdown command to bring the port back to the normal state.

Example

These commands create an EOAM profile profile1 in the EOAM configuration mode.

switch(config)# monitor ethernet oam
switch(config-eoam)# profile profile1
switch(config-eoam-profile-profile1)#

qos scheduling

The qos scheduling command places the switch in the QoS scheduling mode under which the scheduling groups and scheduling policies are configured for shared shaper across multiple subinterfaces.

The no qos scheduling command removes the QoS scheduling configuration from the running-config.

Command Mode

QoS Scheduling Mode

Command Syntax

qos scheduling

no qos scheduling

Example

These commands create a scheduling policy with the desired shape rate and optional guaranteed bandwidth:

switch(config)# qos scheduling
switch(config-qos-scheduling)# scheduling policy P1
switch(config-qos-scheduling-policy-P1)# shape rate 75000000
switch(config-qos-scheduling-policy-P1)# bandwidth guaranteed 10000000

recovery-time

The recovery-time command configures the recovery timeout value for link fault signaling.

The no recovery-time command and the default recovery-timecommand removes the recovery timeout value specified for the chosen link error.

Command Mode

Link-error Configuration

Command Syntax

recovery-time value

no recovery-time value

default recovery-time value

Parameters

value Specifies the recovery timeout value for LFS. The value ranges from 20 to 200.

Related Commands

action
period
threshold

Example

These commands set the recovery time value of 40 for the profile profile1 in the Link-error configuration mode.

switch(config)# monitor ethernet oam
switch(config-eoam)# profile profile1                      
switch(config-eoam-profile-profile1)# link-error
switch(config-eoam-profile-profile1-link-error)# recovery-time 40

refresh traffic-policy field-set

The refresh traffic-policy field-set provides the ability to refresh a field set for a traffic policy. Refresh all field sets or a field set by name.

Command Mode

EXEC

Command Syntax

refresh traffic-policy field-set [all | integer | ipv4 | ipv6 | l4-port | mac | vlan] prefix prefix_name

Command parameters

all - Refresh all field sets.
integer - Refresh a field set of integer ranges.
ipv4 - Refresh a field set of IPv4 address ranges.
ipv6 - Refresh a field set of IPv6 address ranges.
l4-ports - Refresh a field set of Layer 4 port ranges.
mac - Refresh a field set of MAC addresses.
vlan - Refresh a field set of VLAN IDs.
prefix prefix_name - Refresh a specific field set.

Example

Use the following command to refresh the IPv4 field set, mybigfieldset:

switch# refresh traffic-policy field-set ipv4 mybigfieldset
Refreshed ipv4 field-set mybigfieldset source URL
Number of accept prefixes: 100
Number of except prefixes: 0

The following error messages can be displayed if a problem exists with the configuration:

! IPv4 prefix field-set 'mybigfieldset' is not defined. - Undefined field set in the configuration.
% Failed to import file:/tmp/mybigfieldset.txt: aborted due to CLI error - An error exists in the URL contents.
% Failed to import file:/tmp/foo.txt: IPv4 prefix field-set 'mybigfieldset' not found in the URL - Cannot locate the field set in the URL.
% Failed to import file:/tmp/foo.txt: [Errno 2] No such file or directory: '/tmp/mybigfieldset.txt' - The URL no longer reachable or cannot find the requested file.

show cfm continuity-check end-point

The show cfm continuity-check command displays continuity and connectivity information for a CFM configuration.

Command Mode

EXEC

Command Syntax

switch# show cfm continuity-check end-point [remote-defect | counters] [ domain domain_name [ association association_ID [ end-point end_point_id ] ] ]

Parameters

domain domain_name - Name of the domain for the endpoint.
association association_ID - The CFM association ID for the endpoint.
end-point end_point_id - The endpoint ID of the desired endpoint.
remote-defect - Display the remote defects for the endpoint.
counters - Display counters for software CFM configurations.

Examples

To display the current status of the CFM endpoints, use the following command:

switch# show cfm continuity-check end-point
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Interface: Ethernet1.1
TX RDI state: false, Last TX RDI cleared: never
   Remote MEP ID    Connectivity          Last LOC Detected    Last LOC Cleared
------------------- ------------------ ----------------------- ----------------
                2    reachable                         never              never

switch# show cfm continuity-check end-point
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Interface: Ethernet1.1
TX RDI state: true, Last TX RDI set: 0:00:04 ago
      Remote MEP ID    Connectivity          Last LOC Detected    Last LOC Cleared
     ------------------- ------------------ ----------------------- ----------------
                    2    unreachable                 0:00:04 ago               never

show cfm endpoint

The show cfm command displays information about a CFM configuration.

Command Mode

EXEC

Command Syntax

switch# show cfm end-point [ domain domain_name [ association association_ID [ end-point end_point_id ] ] ]

Parameters

domain domain_name - Name of the domain for the endpoint.
association association_ID - The CFM association ID for the endpoint.
end-point end_point_id - The endpoint ID of the desired endpoint.

Example>

To display the current status of the CFM endpoints, use the following command:

switch# show cfm end-point
Maintenance domain: domain6, Level: 6
Maintenance association: 100, Direction: up, CCM TX interval: 1 seconds
Maintenance end point ID: 1, Status: active, Interface: Ethernet1.1
  Remote MEP ID    Status
------------------- ------
            2       active

show hardware counter

The show hardware counter command displays counter events across time intervals.

Command Mode

EXEC

Command Syntax

show hardware counter

Example

This command displays counter events across all time intervals, which are currently more than one standard deviation apart from a given time interval.

switch(config-handler-eventHandler1-counters)# show hardware counter events
-----------------------------------------------------------------------------------------
Interval | Event Name  | Chip | First  | Last  | Count | Z-Score
 |  | Name | Occurrence  | Occurrence  |  | 
-----------------------------------------------------------------------------------------
5 Min  | MacCounters |  All | 2017-01-31 09:31:35 | 2017-01-31 09:44:32 |  5 | -6.9430
10 Min | MacCounters |  All | 2017-01-31 09:39:43 | 2017-01-31 09:44:32 |  3 | -4.8123
-----------------------------------------------------------------------------------------
switch(config-handler-eventHandler1-counters)#

show hardware port-group

The show hardware port-group command displays the status of DCS-7050Q-16 port-groups. Port groups contain one QSFP+ interface and a set of four SFP+ interfaces. In each port group, either the QSFP+ interface or the SFP+ interface set is enabled. The port groups are configured independent of each other.

Port group 1 contains interface 15 (QSFP+) and interfaces 17-20 (SFP+).
Port group 2 contains interface 16 (QSFP+) and interfaces 21-24 (SFP+).

Command Mode

EXEC

Command Syntax

show hardware port-group

Guidelines

The hardware port-group command is available on on DCS-7050Q-16 switches.

Example

This command displays the status of ports in the two port groups on a DCS-7050Q-16 switch.

switch# show hardware port-group

Portgroup: 1    Active Ports: Et15/1-4
Port            State
------------------------------------------
Ethernet17      ErrDisabled
Ethernet18      ErrDisabled
Ethernet19      ErrDisabled
Ethernet20      ErrDisabled
Ethernet15/1    Active
Ethernet15/2    Active
Ethernet15/3    Active
Ethernet15/4    Active

Portgroup: 2    Active Ports: Et16/1-4
Port            State
------------------------------------------
Ethernet16/1    Active
Ethernet16/2    Active
Ethernet16/3    Active
Ethernet16/4    Active
Ethernet21      ErrDisabled
Ethernet22      ErrDisabled
Ethernet23      ErrDisabled
Ethernet24      ErrDisabled
switch>

show hardware system forwarding-chips

The command, show hardware system forwarding-chips displays information about the forwarding chips on your switch.

Command Mode

Global Configuration

Command Syntax

show hardware system forwarding-chips

Parameters

system - Displays information about the system hardware components configuration.
forwarding-chips - Displays details about the forwarding chips on a switch.

Example

Use the following command to display information about the forwarding chips on your switch:

switch# show hardware system forwarding-chips
Slot      Chip Label   Chip Version Chip Name   Forwarding Agent
--------- ------------ ------------ ----------- ----------------
Fabric1   FabricAsic-0 88775B0      Fe3200      Sand            
Fabric1   FabricAsic-1 88775B0      Fe3200      Sand            
Fabric2   FabricAsic-0 88775B0      Fe3200      Sand            
Fabric2   FabricAsic-1 88775B0      Fe3200      Sand            
Fabric3   FabricAsic-0 88775B0      Fe3200      Sand            
Fabric3   FabricAsic-1 88775B0      Fe3200      Sand            
Fabric4   FabricAsic-0 88775B0      Fe3200      Sand            
Fabric4   FabricAsic-1 88775B0      Fe3200      Sand            
Fabric5   FabricAsic-0 88775B0      Fe3200      Sand            
Fabric5   FabricAsic-1 88775B0      Fe3200      Sand            
Fabric6   FabricAsic-0 88775B0      Fe3200      Sand            
Fabric6   FabricAsic-1 88775B0      Fe3200      Sand            
Linecard3 SwitchAsic-0 88682A1      JerichoPlus Sand            
Linecard3 SwitchAsic-1 88682A1      JerichoPlus Sand            
Linecard3 SwitchAsic-2 88682A1      JerichoPlus Sand            
Linecard3 SwitchAsic-3 88682A1      JerichoPlus Sand            
Linecard6 SwitchAsic-0 88682A1      JerichoPlus Sand            
Linecard6 SwitchAsic-1 88682A1      JerichoPlus Sand            
Linecard6 SwitchAsic-2 88682A1      JerichoPlus Sand            
Linecard6 SwitchAsic-3 88682A1      JerichoPlus Sand

The output displays the following information:

Slot - the location of the forwarding chip
Chip Label - the type of forwarding chip
Chip Version - the version of the forwarding chip
Chip Name - the name of the forwarding chip
Forwarding Agent - the type of forwarding agent on the chip

show interface counters

Use the show interface counters command to view the VLAN interface, subinterface, and the GRE Tunnel interface ingress and egress counters. The show interface counters command output includes the L3 interfaces when the corresponding hardware counter feature is enabled.

Command Mode

EXEC

Command Syntax

show interface counters

Example

Use the show interface counters command to display the VLAN interface, subinterface, GRE tunnel interface ingress and egress counters:

switch# show interface counters
L3 Interface       InOctets     InUcastPkts     InMcastPkts
Vl12                      0               0               0
Et1.1                     0               0               0
                   InOctets          InPkts
Tun1 		       0               0


L3 Interface       OutOctets     OutUcastPkts     OutMcastPkts
Vl12                      0               0               0
Et1.1                     0               0               0
                   OutOctets          OutPkts
Tun1 		        0               0

show interfaces counters ip

Use the show interfaces counters ip command to display IPv4, IPv6 packets, and octets.

Command Mode

EXEC

Command Syntax

show interfaces counters ip

Example

The following command IPv4 and IPv6 ingress and egress counters: configuration mode.

switch# show interfaces counters ip
Interface   IPv4InOctets    IPv4InPkts     IPv6InOctets    IPv6InPkts
Et1/1            0               0               0               0Et1/2            0               0               0               0
Et1/3            0               0               0               0
Et1/4            0               0               0               0
 ...
Interface  IPv4OutOctets  IPv4OutPkts    IPv6OutOctets   IPv6OutPkts    
Et1/1            0               0               0               0
Et1/2            0               0               0               0
Et1/3            0               0               0               0
Et1/4            0               0               0               0
                        ...

show interfaces counters bins

The show interfaces counters bins command displays packet counters, categorized by packet length, for the specified interfaces. Packet length counters that the command displays include:

64 bytes
65-127 bytes
128-255 bytes
256-511 bytes
512-1023 bytes
1024-1522 bytes
larger than 1522 bytes

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] counters bins

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.

Related Commands

show interfaces counters
show interfaces counters errors
show interfaces counters queue
show interfaces counters rates

Example

This command displays packet counter results for interface ethernet 1 and interface ethernet 2.

switch# show interfaces ethernet 1-2 counters bins
Input
Port                64 Byte      65-127 Byte     128-255 Byte     256-511 Byte
------------------------------------------------------------------------------
Et1                    2503         56681135          1045154          1029152
Et2                       8         50216275          1518179          1086297

Port          512-1023 Byte   1024-1522 Byte    1523-MAX Byte
-------------------------------------------------------------
Et1                  625825         17157823          8246822
Et2                  631173         27059077          5755101
switch>

show interfaces counters errors

The show interfaces counters errors command displays the error counters for the specified interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] counters errors

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.

Display Values

The table displays the following counters for each listed interface:

FCS: Inbound packets with CRC error and proper size.
Align: Inbound packets with improper size (undersized or oversized).
Symbol: Inbound packets with symbol error and proper size.
Rx: Total inbound error packets.
Runts: Outbound packets that terminated early or dropped because of underflow.
Giants: Outbound packets that overflowed the receiver and were dropped.
Tx: Total outbound error packets.

Related Commands

show interfaces counters
show interfaces counters bins
show interfaces counters queue
show interfaces counters rates

Examples

This command displays the error packet counters on interface ethernet 1 and interface ethernet 2.

switch# show interfaces ethernet 1-2 counters errors
Port               FCS    Align   Symbol       Rx    Runts   Giants       Tx
Et1                  0        0        0        0        0        0        0
Et2                  0        0        0        0        0        0        0
switch>

show interfaces counters queue

The show interfaces counters queue command displays the queue drop counters for the specified interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] counters queue

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.

Related Commands

show interfaces counters
show interfaces counters bins
show interfaces counters errors
show interfaces counters rates

Example

This command displays the queue drop counters for interface ethernet 1 and interface ethernet 2.

switch# show interfaces ethernet 1-2 counters queue
Port                  InDrops
Et1                       180
Et2                       169
switch>

show interfaces counters rates

The show interfaces counters rates command displays the received and transmitted packet rate counters for the specified interfaces. Counter rates provided include megabits per second (Mbps), kilopackets per second (Kpps) and utilization percentage.

All port rates are approximately calculated. Note that, when displaying the rate information of a port channel, the rate value of the port channel differs from the sum of the rates for the member ports. The discrepancy is likely to be larger for port channels with fewer ports except for port channels with single ports. The rate values of individual member ports are less inaccurate than the rate values of the port channel as a whole.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] counters rates

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.

Related Commands

show interfaces counters
show interfaces counters bins
show interfaces counters errors
show interfaces counters queue

Example

This command displays rate counters for interface ethernet 1 and interface ethernet 2.

switch# show interfaces ethernet 1-2 counters rates
Port        Intvl   In Mbps      %  In Kpps  Out Mbps      % Out Kpps
Et1          0:05      53.3   0.5%        5      31.2   0.3%        2
Et2          0:05      43.3   0.4%        4       0.1   0.0%        0
switch#

show interfaces counters

The show interface counters command displays the Layer 3 ingress traffic count information. Run this command to view the traffic counts on a sub-interface or VLAN interface. The clear counters command resets the counters to zero. Counters displayed by the command include:

inbound bytes
inbound unicast packets
inbound multicast packets
inbound broadcast packets
outbound bytes
outbound unicast packets
outbound multicast packets
outbound broadcast packets

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] counters [incoming]

Parameters

INTERFACE Interface type and numbers. Options include:
- no parameter All interfaces.
- ethernet e_range Ethernet interface range specified by e_range.
- management m_range Management interface range specified by m_range.
- port-channel p_range Port-Channel Interface range specified by p_range.
- subinterface Displays the subinterface traffic counts.
- vlan-interface Displays the VLAN-interface traffic counts.
incoming Displays the traffic count for the ingress port.
Note: When no interface is specified, the output starts with ingress and egress counters section for regular interfaces, followed by section for the ingress L3 Interface counters.

Related Commands

show interfaces counters bins
show interfaces counters errors
show interfaces counters queue
show interfaces counters rates

Examples

This command displays byte and packet counters for interface ethernet 1 and interface ethernet 2

switch# show interfaces ethernet 1-2 counters
Port                 InOctets     InUcastPkts     InMcastPkts     InBcastPkts
Et1               99002845169        79116358           75557            2275
Et2               81289180585        76278345           86422              11

Port                OutOctets    OutUcastPkts    OutMcastPkts    OutBcastPkts
Et1                4347928323         6085482          356173            2276
Et2                4512762190         5791718          110498              15
switch>

This command displays the ingress traffic count on a VLAN interface vl12.

switch# show interface vl12 counters incoming
L3 Interface InOctets InUcastPkts InMcastPkts
Vl12           3136          47           2

show interfaces flow-control

The show interfaces flow-control command displays administrative and operational flow control data for the specified interfaces. Administrative data is the parameter settings stored in running-config for the specified interface; the switch uses these settings to negotiate flow control with the peer switch. Operational data is the resolved flow control setting that controls the ports behavior.

Command Mode

EXEC

Command Syntax

show [INTERFACE] flow-control

Parameters

INTERFACE Interface type and number for which flow control data is displayed.

no parameter All interfaces.
ethernet e_range Ethernet interfaces in the specified range.
management m_range Management interfaces in the specified range.

Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command shows the settings for Ethernet interfaces 1-10.

switch# show flow-control interface ethernet 1-10
Port       Send FlowControl  Receive FlowControl  RxPause       TxPause
           admin    oper     admin    oper
---------  -------- -------- -------- --------    ------------- -------------
Et1        off      off      off      off         0             0
Et2        off      off      off      off         0             0
Et3        off      off      off      off         0             0
Et4        off      off      off      off         0             0
Et5        off      off      off      off         0             0
Et6        off      off      off      off         0             0
Et7        off      off      off      off         0             0
Et8        off      off      off      off         0             0
Et9        off      off      off      off         0             0
Et10       off      off      off      off         0             0
switch#

show interfaces hardware default

The show interfaces hardware default command displays the static interface capability information of the specified interfaces. This command displays information related to the speed, auto-negotiation, error correction, and modulation capabilities (when applicable) of a system’s ports. The command also provides information displayed by the show interfaces hardware command, such as model number, interface type, duplex mode, and flow control settings of the specific interface. Compared to the show interfaces hardware command, this command accounts for the capabilities of the system architecture only, and does not consider the capabilities of a transceiver.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] hardware default

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.

Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Examples

This command displays the static interface capability information at the default level.

switch> show interfaces hardware default
Ethernet1
  Model:     DCS-7020TR-48
  Type:      1000BASE-T
  Speed/Duplex: 100M/full,1G/full
  Flowcontrol:  rx-(off,on,desired),tx-(off)
  Autoneg CL28: 100M/full,1G/full
  Autoneg CL37: 1G/full
switch>

This command displays the static interface capability information for interface ethernet 4/1/1

switch> show interfaces ethernet 4/1/1 hardware default
Ethernet4/1/1
  Model:     7500R2AK-36CQ-LC
  Type:      40GBASE-CR4
  Speed/Duplex: 1G/full,10G/full,25G/full,40G/full,50G/full,100G/full
  Flowcontrol:  rx-(off,on,desired),tx-(off)
  Autoneg CL28: 1G/full,10G/full
  Autoneg CL73:
IEEE:           25G/full,40G/full,100G/full
Consortium: 25G/full,50G/full
  Error Correction:
Reed-Solomon: 25G,50G,100G
Fire-code:   25G,50G

show interfaces hardware

The show interfaces hardware command displays the model number, interface type, duplex mode, and flow control settings of the specified interfaces. The capabilities command is available on Ethernet and management interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] hardware

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.

Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the model number, interface type, duplex mode, and flow control settings for interface ethernet 2 and interface ethernet 18.

switch# show interfaces ethernet 2,18 hardware
Ethernet2
  Model:        DCS-7150S-64-CL
  Type:         10GBASE-CR
  Speed/Duplex: 10G/full,40G/full,auto
  Flowcontrol:  rx-(off,on,desired),tx-(off,on,desired)
Ethernet18
  Model:        DCS-7150S-64-CL
  Type:         10GBASE-SR
  Speed/Duplex: 10G/full
  Flowcontrol:  rx-(off,on),tx-(off,on)
switch#

show interfaces interactions

The show interfaces interactions command aims to provide users a resource that explains various relationships between Ethernet interfaces. It describes interactions in which a configuration on an interface causes another set of interfaces to become inactive or have reduced capabilities. Examples include a primary interface consuming subordinate interfaces to service a four-lane speed or platform restrictions that require four interfaces of a port to operate at the same speed.

Command Mode

EXEC

Command Syntax

show interfaces [intf] interactions

Parameter

intf Hardware Ethernet interface. You can restrict the output by interface name.

Examples

The information is displayed as a text dump. Each section of information appears on a separate indentation level. The first indent level is the interface, the second is the desired configuration, and the third is the list of interactions. For example, the output below describes the following:

If the user wants to configure Ethernet2/1 for 40G, Ethernet2/2-4 becomes inactive.

If the user wants to configure Ethernet2/1 for 10G, it does not affect other interfaces.

switch# show interface et2/1 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet2/1:
  For speed 40G
    Ethernet2/2-4 become inactive
  For speed 10G*
    No interactions with other interfaces

The asterisk next to the 10G entry indicates that these same interactions apply for speeds lower than 10G that the interface supports. In other words, if this interface also supported 1G or 100M, the configuration does not affect other interfaces.

Types of Interactions

No Interactions

If there are no interactions for the given interfaces, the display shows No interfaces interactions. Depending on what configurations actually have interactions, the line could appear at a number of different indentation levels. The rules are:

If all specified interfaces have no interactions, print at the first indentation level.
If only some specified interfaces have no interactions and those interfaces have no interactions at any speeds, print at the second indentation level for those interfaces.

If only some specified interfaces have no interactions and those interfaces only have interactions at some speeds, print at the third indentation level for those speeds.

switch# show int et1,2 interactions
No interfaces interactions

switch# show int et1,2,5/1 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet1
  No interactions with other interfaces
Ethernet2
  No interactions with other interfaces
Ethernet5/1
  For speed 40G
    Ethernet5/2-4 become inactive
  For speed 10G*
    No interactions with other interfaces

Inactive Interfaces

If a configuration on an interface causes other interfaces to become inactive, a message similar to the ones bolded below appear. A common example of this is configuring a QSFP28 port for 100G, which results in the /2,/3, and /4 interfaces becoming inactive. Note that display information for inactive interfaces are included in the specified range, ignoring whether or not inactive interfaces are exposed.

switch# show interfaces et11/1,11/3 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet11/1:
  For speed 100G-4
    Ethernet11/2-4 become inactive
  For speed 50G-2
    Ethernet11/2,11/4 become inactive
    Ethernet11/3 is limited to 50G-2
  For speed 40G
    Ethernet11/2-4 become inactive
  For speed 25G
    Ethernet11/2-4 are limited to 25G
  For speed 10G*
    Ethernet11/2-4 are limited to 10G*
Ethernet11/3:
  For speed 50G-2
    Ethernet11/4 becomes inactive
    Primary interface Ethernet11/1 must be operating at 50G-2
  For speed 25G
    Primary interface Ethernet11/1 must be operating at 25G
  For speed 10G*
    Primary interface Ethernet11/1 must be operating at 10G*

Required Primary Interface Configuration

Some interface configurations require a particular primary interface configuration to function. These interactions are captured with messages similar to the ones bolded below.

switch# show interfaces et11/1,11/3 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet11/1:
  For speed 100G-4
    Ethernet11/2-4 become inactive
  For speed 50G-2
    Ethernet11/2,11/4 become inactive
    Ethernet11/3 is limited to 50G-2
  For speed 40G
    Ethernet11/2-4 become inactive
  For speed 25G
    Ethernet11/2-4 are limited to 25G
  For speed 10G*
    Ethernet11/2-4 are limited to 10G*
Ethernet11/3:
  For speed 50G-2
    Ethernet11/4 becomes inactive
    Primary interface Ethernet11/1 must be operating at 50G-2
  For speed 25G
    Primary interface Ethernet11/1 must be operating at 25G
  For speed 10G*
    Primary interface Ethernet11/1 must be operating at 10G*

Hardware Speed-Group Requirements

Some interface configurations require an additional speed-group configuration in order to operate correctly.If speed-group configurations are required, there will be a message displayed similar to the ones bolded below.

Note: A single speed-group may include more than one compatibility setting. Using the example below as reference, Ethernet1/1 at 100G-4 and Ethernet2/1 at 40G are compatible configurations as long as hardware speed-group 1 can include 50g and 10g rates simultaneously.

switch# show interfaces et1/1,2/1 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet1/1:
  For speed 100G-4
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 50g
  For speed 40G
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 10g
  For speed 25G
    Ethernet2/1,2/3 become inactive
    Ethernet1/3 is limited to 25G/10G
    Hardware speed-group 1 must include 25g
  For speed 10G
    Ethernet2/1,2/3 become inactive
    Ethernet1/3 is limited to 25G/10G
    Hardware speed-group 1 must include 10g
Ethernet2/1:
  For speed 100G-4
    Ethernet2/3 becomes inactive
    Ethernet1/1 must be operating at 100G-4/50G-2/40G
    Hardware speed-group 1 must include 50g
  For speed 40G
    Ethernet2/3 becomes inactive
    Ethernet1/1 must be operating at 100G-4/50G-2/40G
    Hardware speed-group 1 must include 10g

Compatible Parent Interface Configuration

The parent interface may be configured for any one of the list of compatible rates. Additionally, more than one interface may be required to be configured at a compatible rate. These interactions are captured with messages similar to the ones bolded below

Note: Using the example below as a reference, suppose that Ethernet1/1 is configured for 100G-4 and that the goal is to configure Ethernet1/8 to 50G-1. According to the display, Ethernet1/1 is configured for a compatible rate. That said, in order for Ethernet1/1 to operate at 100G-4, hardware speed-group 1 must be configured to include the 25g compatibility setting. Additionally, hardware speed-group 1 must also include the 50g compatibility setting to enable Ethernet1/8 to operate at 50G-1. Interactions on Ethernet1/5 and Ethernet1/7 must be considered as well (omitted from the example for brevity).

switch# show interfaces et1/1,1/8 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet1/1:
  Ethernet1/1-4/8 share 18 interface hardware resources
  For speed 400G-8
    Ethernet1/2-8 become inactive
    Hardware speed-group 1 must include 50g
  For speed 200G-4
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 50g
  For speed 100G-2
    Ethernet1/2 becomes inactive
    Hardware speed-group 1 must include 50g
  For speed 100G-4
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 25g
  For speed 50G-1
    Hardware speed-group 1 must include 50g
  For speed 50G-2
    Ethernet1/2 becomes inactive
    Hardware speed-group 1 must include 25g
  For speed 40G
    Ethernet1/2-4 become inactive
    Hardware speed-group 1 must include 10g
  For speed 25G
    Hardware speed-group 1 must include 25g
  For speed 10G
    Hardware speed-group 1 must include 10g
Ethernet1/8:
  For speed 50G-1
    Ethernet1/1 must be operating at 200G-4/100G-2/100G-4/50G-1/50G-2/40G/25G/10G
    Ethernet1/5 must be operating at 100G-2/50G-1/50G-2/25G/10G
    Ethernet1/7 must be operating at 50G-1/25G/10G
    Hardware speed-group 1 must include 50g

Speed-limited Interfaces

Some interface configurations limit at what other interfaces can operate. If such limitations occur, a message displays similar to the ones bolded below.

switch# show interfaces et11/1,11/3 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet11/1:
  For speed 100G-4
    Ethernet11/2-4 become inactive
  For speed 50G-2
    Ethernet11/2,11/4 become inactive
    Ethernet11/3 is limited to 50G-2
  For speed 40G
    Ethernet11/2-4 become inactive
  For speed 25G
    Ethernet11/2-4 are limited to 25G
  For speed 10G*
    Ethernet11/2-4 are limited to 10G*
Ethernet11/3:
  For speed 50G-2
    Ethernet11/4 becomes inactive
    Primary interface Ethernet11/1 must be operating at 50G-2
  For speed 25G
    Primary interface Ethernet11/1 must be operating at 25G
  For speed 10G*
    Primary interface Ethernet11/1 must be operating at 10G*

Interfaces Sharing Logical Ports

Some interface ranges share logical port resources. If an interface shares logical ports with other interfaces, a message displays similar to the ones bolded below.

switch# show interfaces et1/1,4/1 interactions
* = includes less than 10G speeds that the interface is capable of

Ethernet1/1:
  Ethernet1/1-4/8 share 18 interface hardware resources
  For speed 400G-8
    ...
Ethernet4/1:
  Ethernet1/1-4/8 share 18 interface hardware resources
  For speed 400G-8
    ...

show interface link-flap damping

The show interface link-flap damping command displays information about the configured dynamic link flap damping parameters.

Command Mode

Global Configuration

Command Syntax

show interface link-flap damping

Parameters

Interface - Displays the names of interfaces configured with one or more damping profiles assigned to it. A single interface can be displayed multiple times if configured with more than one profile.
Profile - Displays the name of the profile assigned to the interface.
Penalty - Displays the current damping demerit value for the profile and interface.
Suppressed - Displays the timestamp when the interface entered the damped state. No entry displayed if the interface has not entered the damped state.
Re-use - Displays the timestamp of the expected exit from the damped state after detecting no more flaps on the interface. No entry displayed if the interface has not entered the damped state.

Example

Use the show interface link-flap damping command to display information about the current status of all interfaces with Link Flap damping enabled:

switch#show interface link-flap damping
Interface  Profile       Penalty  Suppressed           Re-use
---------- ------------- -------- -------------------  -------------------
Ethernet1  TestProfile1  2000     2023-10-24 18:47:00  2023-10-24 18:48:25
Ethernet1  TestProfile2  0
Ethernet3  TestProfile1  2500     2023-10-24 18:46:59  2023-10-24 18:48:43
Ethernet3  TestProfile2  300

show interfaces negotiation

The show interfaces negotiation command displays the speed, duplex, and flow control auto-negotiation status for the specified interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] negotiation [INFO_LEVEL]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.
INFO_LEVEL Amount of information that is displayed. Options include:
- no parameter Displays status and negotiated setting of local ports.
- detail Displays status and negotiated settings of local ports and their peers.

Examples

This command displays the negotiated status of management 1 and management 2 interfaces.

switch# show interface management 1-2 negotiation
Port       Autoneg            Negotiated Settings
           Status   Speed     Duplex    Rx Pause  Tx Pause
---------  -------  --------  --------  --------  --------
Ma1        success  100M      full      off       off
Ma2        success  auto      auto      off       off
switch>

This command displays the negotiated status of management 1 interface and its peer interface.

switch# show interface management 1 negotiation detail
Management1 :

Auto-Negotiation Mode     10/100/1000 BASE-T (IEEE Clause 28)
Auto-Negotiation Status   Success

  Advertisements       Speed           Duplex     Pause
                       --------------- ---------- --------------------
      Local            10M/100M/1G     half/full  Disabled
      Link Partner     None            None       None

  Resolution           100Mb/s         full       Rx=off,Tx=off
switch>

show interfaces phy

The show interfaces phy command displays physical layer characteristics for the specified interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] phy [INFO_LEVEL]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interfaces in specified range.
Valid e_range formats include number, number range, or comma-delimited list of numbers and ranges.
INFO_LEVEL Amount of information that is displayed. Options include:
- no parameter Command displays table that summarizes PHY data.
- detail Command displays data block for each specified interface.

Examples

This command summarizes PHY information for Ethernet interfaces 1-5.

switch# show interfaces ethernet 1-5 phy
Key:
   U    = Link up
   D    = Link down
   R    = RX Fault
   T    = TX Fault
   B    = High BER
   L    = No Block Lock
   A    = No XAUI Lane Alignment
   0123 = No XAUI lane sync in lane N

                                  State    Reset
Port           PHY state        Changes    Count PMA/PMD PCS   XAUI
-------------- --------------- -------- -------- ------- ----- --------
Ethernet1      linkUp             14518     1750 U..     U.... U.......
Ethernet2      linkUp             13944     1704 U..     U.... U.......
Ethernet3      linkUp             13994     1694 U..     U.... U.......
Ethernet4      linkUp             13721     1604 U..     U.... U.......
Ethernet5      detectingXcvr          3        1               D..A0123
switch#

This command displays detailed PHY information for interface ethernet 1.

switch# show interfaces ethernet 1 phy detail
Current System Time: Mon Dec  5 11:32:57 2011
Ethernet1
                              Current State     Changes            Last Change
  PHY state                   linkUp              14523            0:02:01 ago
  HW resets                                        1751            0:02:07 ago
  Transceiver                 10GBASE-SRL          1704            0:02:06 ago
  Transceiver SN              C743UCZUD
  Oper speed                  10Gbps
  Interrupt Count                                 71142
  Diags mode                  normalOperation
  Model                       ael2005c
  Active uC image             microInit_mdio_SR_AEL2005C_28
  Loopback                    none
  PMA/PMD RX signal detect    ok                  11497            0:37:24 ago
  PMA/PMD RX link status      up                  11756            0:37:24 ago
  PMA/PMD RX fault            ok                  11756            0:37:24 ago
  PMA/PMD TX fault            ok                      0                  never
  PCS RX link status          up                   9859            0:02:03 ago
  PCS RX fault                ok                   9832            0:02:03 ago
  PCS TX fault                ok                    330            0:27:44 ago
  PCS block lock              ok                   9827            0:02:03 ago
  PCS high BER                ok                   8455            0:02:05 ago
  PCS err blocks              255                                  0:02:03 ago
  PCS BER                     16                  50092            0:02:05 ago
  XFI/XAUI TX link status     up                   1282            0:27:44 ago
  XFI/XAUI RX fault           ok                    585            0:27:44 ago
  XFI/XAUI TX fault           ok                   2142            0:02:05 ago
  XFI/XAUI alignment status   ok                   2929            0:02:05 ago
  XAUI lane 0-3 sync          (0123) = 1111        2932            0:02:05 ago
  XAUI sync w/o align HWM     0                                          never
  XAUI sync w/o align max OK  5
  XAUI excess sync w/o align  0                                          never
  Xcvr EEPROM read timeout                           46    4 days, 6:33:45 ago
  Spurious xcvr detection                             0                  never
  DOM control/status fail                             0
  I2C snoop reset             0
  I2C snoop reset (xcvr)      0
  Margin count                5                last > 0            0:00:00 ago
  EDC resets                  1                                    0:02:03 ago
  EDC FFE0 - FFE11            -4 -5 57 -6 -6 -2 1 0 -2 -1 1 -1
  EDC FBE1 - FBE4             6 -1 5 -1
  EDC TFBE1 - TFBE4           1 2 1 2
  EDC VGA1, VGA3              12 115
  TX path attenuation         3.0 dB
  TX preemphasis              (0,63,4) (pre,main,post)
switch#

show interfaces status errdisabled

The show interfaces status errdisabled command displays interfaces that are in errdisabled state, including their link status and errdisable cause.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] status errdisabled

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
port-channel p_range Port-Channel Interface range specified by p_range.
Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the error-disabled ports.

switch# show interfaces status errdisabled

Port    Name           Status        Reason
------- -------------- ------------- ------------------
Et49/2                 errdisabled   multi-lane-intf
Et49/3                 errdisabled   multi-lane-intf
Et49/4                 errdisabled   multi-lane-intf
switch>

show interfaces status

The show interfaces status command displays the interface name, link status, vlan, duplex, speed, and type of the specified interfaces. When the command includes a link status, the results are filtered to display only interfaces whose link status match the specified type.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE]status [STATUS_TYPE]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All existing interfaces.
ethernet e_range Ethernet interfaces in the specified range.
management m_range Management interfaces in the specified range.
port-channel p_range All existing port-channel interfaces in the specified range.
Valid e_range, m_range, and p_range formats include number, number range, or comma-delimited list of numbers and ranges.
STATUS_TYP Einterface status upon which the command filters output. Options include:
- no parameter Command does not filter on interface status.
- connected Interfaces connected to another port.
- notconnect Unconnected interfaces that are capable of connecting to another port.
- disabled Interfaces that have been powered down or disabled.
- sub-interfaces L3 subinterfaces configured on the switch.
  Command may include multiple status types (connected, notconnect, disabled), which can be placed in any order.

Examples

This command displays the status of Ethernet interfaces 1-5.

switch# show interfaces ethernet 1-5 status
Port      Name              Status       Vlan        Duplex  Speed Type
Et1                         connected    1             full    10G 10GBASE-SRL
Et2                         connected    1             full    10G 10GBASE-SRL
Et3                         connected    1             full    10G 10GBASE-SRL
Et4                         connected    1             full    10G 10GBASE-SRL
Et5                         notconnect   1             full    10G Not Present
switch>

This command displays status information for all subinterfaces configured on the switch.

switch# show interfaces status sub-interfaces
Port       Name    Status       Vlan     Duplex Speed  Type                Flags
Et1.1              connect       101      full   10G   dot1q-encapsulation
Et1.2              connect       102      full   10G   dot1q-encapsulation
Et1.3              connect       103      full   10G   dot1q-encapsulation
Et1.4              connect       103      full   10G   dot1q-encapsulation
switch>

show interface transceiver dom

The show interface [<intf>] transceiver dom command displays the most important current performance data on the media (line) side.

Example

switch# show interface Ethernet11/1 transceiver dom
Ch: Channel, N/A: not applicable, TX: transmit, RX: receive
mA: milliamperes, dBm: decibels (milliwatts), C: Celsius, V: Volts

Port 11
Last update: 0:00:05 ago
                                             Value
                                        ----------------
   Case temperature                         66.59 C
   Voltage                                   3.26 V
   TX power                                -10.23 dBm
   RX total power                          -11.61 dBm
   RX channel power                        -11.94 dBm
   Pre-FEC BER                           1.82e-03 
   Post-FEC errored frames ratio         0.00e+00 
   Chromatic dispersion (short link)         0.00 ps/nm
   Chromatic dispersion (long link)          0.00 ps/nm
   Differential group delay                  9.31 ps
   SOPMD                                     0.00 ps^2
   Polarization dependent loss               0.40 dB
   Received OSNR estimate                   35.10 dB
   Received ESNR estimate                   17.50 dB
   Carrier frequency offset                  0.00 MHz
   Error vector magnitude                  100.00 %
   SOP rate of change                        0.00 krad/s
   Laser temperature                        59.54 C
   Laser frequency                         193100.00 GHz

BER: Bit Error Rate
FEC: Forward Error Correction
OSNR: Optical Signal to Noise Ratio
ESNR: Electrical Signal to Noise Ratio
SOP: State of Polarization
SOPMD: State of Polarization Mode Dispersion

show interface transceiver eeprom

The show interface [<intf>] transceiver eeprom command displays the parsed capabilities.

Example

For 400GBASE-ZR, parsing of frequency tuning, power tuning ( page 04h ) and VDM configuration pages (20h-23h) is added.

switch# show interface Ethernet15/1 transceiver eeprom
Ethernet15 EEPROM:
...
  Frequency tuning support (04h:128-129):
    Grid spacing capabilities (04h:128):
      100 GHz grid supported (04h:128): true
      12.5 GHz grid supported (04h:128): false
      25 GHz grid supported (04h:128): false
      3.125 GHz grid supported (04h:128): false
      33 GHz grid supported (04h:128): false
      50 GHz grid supported (04h:128): false
      6.25 GHz grid supported (04h:128): false
      75 GHz grid supported (04h:128): true
    Tunable wavelength (04h:128): true
    Fine tuning support (04h:129): false
  Supported channel boundaries (04h:130-161):
    100 GHz grid (04h:150-153):
      Lowest channel (04h:150-151): -18
      Lowest frequency (04h:150-151): 191300000 MHz
      Highest channel (04h:152-153): 30
      Highest frequency (04h:152-153): 196100000 MHz
    75 GHz grid (04h:158-161):
      Lowest channel (04h:158-159): -72
      Lowest frequency (04h:158-159): 191300000 MHz
      Highest channel (04h:160-161): 120
      Highest frequency (04h:160-161): 196100000 MHz
  Programmable output power advertisement (04h:196-201):
    Lane programmable output power supported (04h:196): false
  VDM configuration (20h:128-255;21h:128-255):
    VDM group 1 (20h:128-255):
      Parameter 1 (20h:128-129):
        Lane (20h:128): 0
        Threshold ID (20h:128): 0
        Parameter type (20h:129): Laser temperature
      Parameter 3 (20h:132-133):
        Lane (20h:132): 0
        Threshold ID (20h:132): 2
        Parameter type (20h:133): eSNR host input
      Parameter 4 (20h:134-135):
        Lane (20h:134): 1
        Threshold ID (20h:134): 2
        Parameter type (20h:135): eSNR host input
      Parameter 5 (20h:136-137):
        Lane (20h:136): 2
        Threshold ID (20h:136): 2
        Parameter type (20h:137): eSNR host input
...
       Parameter 84 (21h:166-167):
        Lane (21h:166): 0
        Threshold ID (21h:166): 14
        Parameter type (21h:167): MER
  Number of VDM groups supported (2Fh:128): 2

show interfaces transceiver channels

The show interfaces transceiver channels command displays current wavelength/frequency settings for the specified channels.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE e_range] transceiver channels

Parameters

INTERFACE Interface type and port numbers.

ethernet e_range Ethernet interface range specified by e_range.

Related Commands

transceiver channel
show interfaces transceiver hardware

Example

This command displays the supported wave lengths/frequencies and their corresponding channel numbers on Ethernet interface 4 to slot 3 through 4.

switch(config-as-if-Et4/1/3)# show interfaces ethernet 4/3/4 transceiver 
channels
Name: Et4/3/4
100GHz- 50GHz-
Wavelength Frequency spacing spacing
(nm) (GHz) Channel Channel
---------- --------- ------- -------
1567.95 191,200 1 1
1567.54 191,250 2
1567.13 191,300 2 3
1566.72 191,350 4
....
1529.16 196,050 98
1528.77 196,100 50 99
1528.38 196,150 100
switch(config-as-if-Et4/1/3)#

show interfaces transceiver hardware

The show interfaces transceiver hardware command displays current wavelength/frequency settings for the specified transceiver interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] ethernet e_range transceiver hardware

Parameters

INTERFACE Interface type and port numbers.

ethernet e_range Ethernet interface range specified by e_range.

Related Commands

transceiver channel
show interfaces transceiver channels

Example

This command displays the current wavelength/frequency settings on interface ethernet 4 to slot 3 through 4.

switch(config-as-if-Et4/1/3)# show interfaces ethernet 4 / 3 / 4 transceiver hardware
Name: Et4/3/4
Media Type: 10GBASE-DWDM
Configured Channel : 39
Configured Grid (GHz) : 50
Computed Frequency (GHz) : 193,100
Computed Wavelength (nm) : 1552.52
Operational Channel : 39 (Default)
Operational Grid (GHz) : 50 (Default)
Operational Frequency (GHz): 193,100
Operational Wavelength (nm): 1552.52
switch(config-as-if-Et4/1/3)#

show interfaces transceiver properties

The show interfaces transceiver properties command displays configuration information for the specified interfaces. Information provided by the command includes the media type, interface speed-duplex settings, speed-duplex operating state.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] transceiver properties

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
Valid e_range and m_range formats include number, number range, or comma-delimited list of numbers and ranges.

Related Commands

show interfaces transceiver

Example

This command displays the media type, speed, and duplex properties for Ethernet interfaces 1-3.

switch# show interfaces ethernet 1-3 transceiver properties
Name : Et1
Administrative Speed: 10G
Administrative Duplex: full
Operational Speed: 10G (forced)
Operational Duplex: full (forced)
Media Type: 10GBASE-SRL

Name : Et2
Administrative Speed: 10G
Administrative Duplex: full
Operational Speed: 10G (forced)
Operational Duplex: full (forced)
Media Type: 10GBASE-SRL

Name : Et3
Administrative Speed: 10G
Administrative Duplex: full
Operational Speed: 10G (forced)
Operational Duplex: full (forced)
Media Type: 10GBASE-SRL

switch>

show interfaces transceiver

The show interfaces transceiver command displays operational transceiver data for the specified interfaces.

Command Mode

EXEC

Command Syntax

show interfaces [INTERFACE] transceiver [DATA_FORMAT]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter All interfaces.
ethernet e_range Ethernet interface range specified by e_range.
management m_range Management interface range specified by m_range.
Valid e_range, and m_range formats include number, number range, or comma-delimited list of numbers and ranges.
DATA_FORMAT format used to display the data. Options include:
- no parameter table entries separated by tabs.
- csv table entries separated by commas.

Related Commands

show interfaces transceiver properties

Example

This command displays transceiver data on interface ethernet 1 through interface ethernet 4.

switch# show interfaces ethernet 1-4 transceiver
If device is externally calibrated, only calibrated values are printed.
N/A: not applicable, Tx: transmit, Rx: receive.
mA: milliamperes, dBm: decibels (milliwatts).
                             Bias      Optical   Optical
        Temp       Voltage   Current   Tx Power  Rx Power  Last Update
Port    (Celsius)  (Volts)   (mA)      (dBm)     (dBm)     (Date Time)
-----   ---------  --------  --------  --------  --------  -------------------
Et1      34.17      3.30      6.75     -2.41     -2.83     2011-12-02 16:18:48
Et2      35.08      3.30      6.75     -2.23     -2.06     2011-12-02 16:18:42
Et3      36.72      3.30      7.20     -2.02     -2.14     2011-12-02 16:18:49
Et4      35.91      3.30      6.92     -2.20     -2.23     2011-12-02 16:18:45
switch#

show interface link-flap damping

The show interface link-flap damping command displays information about the configured dynamic link flap damping parameters.

Command Mode

Global Configuration

Command Syntax

show interface link-flap damping

Parameters

Interface - Displays the names of interfaces configured with one or more damping profiles assigned to it. A single interface can be displayed multiple times if configured with more than one profile.
Profile - Displays the name of the profile assigned to the interface.
Penalty - Displays the current damping demerit value for the profile and interface.
Suppressed - Displays the timestamp when the interface entered the damped state. No entry displayed if the interface has not entered the damped state.
Re-use - Displays the timestamp of the expected exit from the damped state after detecting no more flaps on the interface. No entry displayed if the interface has not entered the damped state.

Example

Use the show interface link-flap damping command to display information about the current status of all interfaces with Link Flap damping enabled:

switch#show interface link-flap damping
Interface  Profile       Penalty  Suppressed           Re-use
---------- ------------- -------- -------------------  -------------------
Ethernet1  TestProfile1  2000     2023-10-24 18:47:00  2023-10-24 18:48:25
Ethernet1  TestProfile2  0
Ethernet3  TestProfile1  2500     2023-10-24 18:46:59  2023-10-24 18:48:43
Ethernet3  TestProfile2  300

show monitor ethernet oam profile

The show monitor ethernet oam profile command displays configuration information for the specified ethernet OAM profile name or ?the summary information of all configured profile names.

Command Mode

EXEC

Command Syntax

show monitor ethernet oam profile [name | summary]

Parameters

name The EOAM profile name.
summary The EOAM summary of all profiles that are configured.

Related Commands

link-error
monitor ethernet oam profile

Examples

This command displays the OAM profile configuration information for the specific profile name.

switch# show monitor ethernet oam profile[name] 

         Ethernet OAM Profile : p

         Error Type : symbol

                           Threshold  :    20  frames
                           Action     :           log
                           Period     :    20 seconds

         Error Type : fcs
                           Threshold  :    10  frames
                           Action     :     linkfault
                           Period     :   100  frame

         Recovery Timeout : 20

This command displays the OAM profile configuration summary for all profiles configured.

switch# show monitor ethernet oam profile [name] summary

         Eoam Profile : p 
            Configured on:  Et3/1-4,5

show platform fm6000 agileport map

The show platform fm6000 agileport map command displays the list of Ethernet interfaces that are combinable to form a higher speed port.

Command Mode

Privileged EXEC

Command Syntax

show platform fm6000 agileport map

Example

These commands displays the agile port map for the switch, then configures Ethernet interface 13 as a 40G port, subsuming Ethernet interfaces 15, 17 and 19.

switch# show platform fm6000 agileport map

-----------------------------------------------------------------
Agile Ports       |        Interfaces subsumed in 40G link
-----------------------------------------------------------------
Ethernet1         |  Ethernet3      Ethernet5      Ethernet7
Ethernet2         |  Ethernet4      Ethernet6      Ethernet8
Ethernet13        |  Ethernet15     Ethernet17     Ethernet19
Ethernet14        |  Ethernet16     Ethernet18     Ethernet20

switch# config
switch(config)# interface ethernet 13
switch(config-if-Et13)# speed 40gfull

  WARNING!  Executing this command will cause the forwarding agent
            to be restarted. All interfaces will briefly drop links
            and forwarding on all interfaces will momentarily stop.


            Do you wish to proceed with this command? [y/N]

Ethernet13 configured for 40G.
Ethernet15, Ethernet17 and Ethernet19 are now subsumed.
switch(config-if-Et13)#

show platform trident flexcounters

Use the show platform trident flexcounters command to display the L3 interfaces when the corresponding hardware counter feature is enabled.

Command Mode

Privileged EXEC

Command Syntax

show platform trident flexcounters [vni [egress summary | ingress summary]]|[[vtep [decap summary | encap summary]]

Parameters

vni Displays the VNI feature state.
- egress summary Displays the egress direction flexcounters summary.
- ingress summary Displays the ingress direction flexcounters summary.
vtep Displays the VTEP feature state
- decap summary Displays the decap direction flexcounter summary.
- encap summary Displays the encap direction flexcounter summary.

Examples

The following example displays the headings for the show platform tridant flexcounters vni egress summary show command.

switch# show platform tridant flexcounters vni egress summary
VNI      EgrVfiIndex    PoolId    OffsetMode    BaseCounterIndex
-----------------------------------------------------------------

The following example displays the headings for the show platform trident flexcounters vni ingress summary show command.

switch# show platform trident flexcounters vni ingress summary
VNI      VfiIndex    PoolId    OffsetMode    BaseCounterIndex
--------------------------------------------------------------

The following example displays the headings for the show platform trident flexcounters vtep decap summary show command.

switch# show platform trident flexcounters vtep decap summary
VTEP      SvpIndex    PoolId    OffsetMode    BaseCounterIndex
---------------------------------------------------------------

The following example displays the headings for the show platform trident flexcounters vtep encap summaryshow command.

switch# show platform trident flexcounters vtep encap summary
VTEP      DvpIndex    PoolId    OffsetMode    BaseCounterIndex
---------------------------------------------------------------

show platform trident flexcounters l3intf

Use the show platform trident flexcounters l3intf command to display the subinterface, SVI, and GRE tunnel interface features.

Command Mode

EXEC

Command Syntax

show platform trident flexcounters l3intf [[in | out] [summary | values]]

Parameters

in summary Displays the details of the hardware resources allocated to the ingress subinterface, SVI, and GRE Tunnel Interface features.
out summary Displays the details of the hardware resources allocated to the egress subinterface, SVI, and GRE Tunnel Interface features.
in values Displays the counters in the counter and snapshot table for the ingress subinterface, SVI, and GRE Tunnel Inteface features.
out values Displays the counters in the counter and snapshot table for the egress subinterface, SVI, and GRE Tunnel Interface features.

Note: The counter values in this show command output are not reset by the clear counters command.

Examples

Use the show platform trident flexcounters l3intf in summary command to display the details of the hardware resources allocated to the ingress subinterface, SVI, and GRE Tunnel Interface features.

switch# show platform trident flexcounters l3intf in summary
L3intf     CounterIndex    PoolId    OffsetMode   BaseCounterIndex
-------------------------------------------------------------------

Use the show platform trident flexcounters l3intf out summary command to display the details of the hardware resources allocated to the egress subinterface, SVI, and GRE Tunnel Interface features.

switch# show platform trident flexcounters l3intf out summary
L3intf     CounterIndex    PoolId    OffsetMode   BaseCounterIndex
-------------------------------------------------------------------

Use the show platform trident flexcounters l3intf in values command to display the counters in the counter and snapshot table for the ingress subinterface, SVI, and GRE Tunnel Interface features.

switch# show platform trident flexcounters l3intf in values
L3intf   Offser Bytes(cntTbl)    Bytes(snapTbl)    Pkts(cntTbl)    Pkts(snapTbl)
---------------------------------------------------------------------------------

Use the show platform trident flexcounters l3intf out values command to display the counters in the counter and snapshot table for the egress subinterface, SVI, and GRE Tunnel Interface features.

switch# show platform trident flexcounters l3intf out values

L3intf   Offser Bytes(cntTbl)    Bytes(snapTbl)    Pkts(cntTbl)    Pkts(snapTbl)
--------------------------------------------------------------------------------

show poe

The show poe command displays PoE information for a specified port range or for all ports.

Command Mode

Privileged EXEC

Command Syntax

show poe [INTERFACE]

Parameters

INTERFACE Interface type and numbers. Options include:

no parameter Display information for all interfaces.
ethernet e_range Ethernet interface range specified by e_range.

Example

This command displays PoE information for interface ethernet 46.

switch(config)# show poe interface ethernet 46

Port Enabled Enabled Limit  Power   State   Class  Power Current Voltage Temperature
---- ------- ------- ------ ------- ------- ------ ----- ------- ------- -----------
46      True    True 15.40W  15.40W powered class0 1.40W 27.00mA  55.04V      41.25C
switch(config-if-Et7)#

show qos scheduling

The show qos scheduling command displays the QoS configuration on one or more scheduling groups. Both group name and parent interface name are optional, in which case all groups will be displayed.

Command Mode

Privileged EXEC

Command Syntax

show qos scheduling Options

Parameter

Options include the Group, Interface or the Hierarchy.

Example

This command displays the QoS configuration for scheduling group G1 of interface Ethernet1.

switch# show qos scheduling group G1 Ethernet1
Interface: Et1
Scheduling Group Name: G1
Bandwidth: 10.1 / 10.0 (Gbps)
Shape Rate: 75.2 / 75.0 (Gbps)

Member         Bandwidth        Shape Rate
                (units)           (units)
------       -------------  ------------------
Et1.1           - /  - (-)  50.1 / 50.0 (Gbps)
Et1.2           - /  - (-)  30.1 / 30.0 (Gbps)

show route counters

Use the show route [ipv4 | ipv6] counters to display the IPv4 or IPv6 pack and byte counts.

Command Mode

EXEC

Command Syntax

show route [ipv4 | ipv6]

Parameters

ipv4 Displays IPv4 route counters.
ipv6 Displays IPv6 route counters.

Example

The following example displays the IPv4 packet and byte count.

switch# show route ipv4 counters
Vrf Name        Prefix       Packet Count    Byte Count
-------- ---------------- ------------------ ----------
 default    22.0.0.0/8                     0          0
 default    32.0.0.0/8                     0          0

show transceiver status interface

The show transceiver status interface [<intf>] command displays the most important alarms, faults and interface status.

Example

For 400GBASE-ZR modules, media and host side coherent alarms, host-side pre-FEC BER, defined in the Coherent CMIS and post-FEC BER have been added to the command’s output:

switch# show transceiver status interface Ethernet14/1
                                Current State        Changes       Last Change
                                -------------        -------       -----------
Port 14
  Transceiver                   400GBASE-ZR                1       0:15:09 ago
  Transceiver SN                200554050                          
  Presence                      present                            
  Adapters                      none                               
  Bad EEPROM checksums                                     0       never
  Resets                                                   0       0:15:14 ago
  Interrupts                                               0       never
  Data path firmware fault      ok                         0       never
  Module firmware fault         ok                         0       never
  Temperature high alarm        ok                         0       never
  Temperature high warn         ok                         0       never
  Temperature low alarm         ok                         0       never
  Temperature low warn          ok                         0       never
  Voltage high alarm            ok                         0       never
  Voltage high warn             ok                         0       never
  Voltage low alarm             ok                         0       never
  Voltage low warn              ok                         0       never
  Module state                  ready                      4       0:14:55 ago
  Data path 1 state             activated                  4       0:07:21 ago
  Data path 2 state             activated                  4       0:07:21 ago
  Data path 3 state             activated                  4       0:07:21 ago
  Data path 4 state             activated                  4       0:07:21 ago
  Data path 5 state             activated                  4       0:07:21 ago
  Data path 6 state             activated                  4       0:07:21 ago
  Data path 7 state             activated                  4       0:07:21 ago
  Data path 8 state             activated                  4       0:07:21 ago
  RX LOS                        ok                         2       0:05:54 ago
  TX fault                      ok                         0       never
  RX CDR LOL                    ok                         0       never
  TX power high alarm           ok                         0       never
  TX power high warn            ok                         2       0:07:39 ago
  TX power low alarm            ok                         2       0:07:50 ago
  TX power low warn             ok                         4       0:07:39 ago
  TX bias high alarm            ok                         0       never
  TX bias high warn             ok                         0       never
  TX bias low alarm             ok                         0       never
  TX bias low warn              ok                         0       never
  RX power high alarm           ok                         0       never
  RX power high warn            ok                         0       never
  RX power low alarm            ok                         0       never
  RX power low warn             ok                         0       never
  TX loss of alignment       ok                         0       never
  TX out of alignment           ok                         0       never
  TX clock monitor unit LOL     ok                         0       never
  TX reference clock LOL        ok                         0       never
  TX deskew LOL                 ok                         0       never
  TX FIFO error                 ok                         0       never
  RX demodulator LOL            ok                         0       never
  RX CD compensation LOL        ok                         0       never
  RX loss of alignment          ok                         0       never
  RX out of alignment           ok                         0       never
  RX deskew LOL                 ok                         0       never
  RX FIFO error                 ok                         0       never
  RX FEC excessive degrade      ok                         0       never
  RX FEC detected degrade       ok                         0       never
  Freq tuning in progress       idle                       0       never
  Freq tuning busy              ok                         0       never
  Freq tuning invalid channel   ok                         0       never
  Freq tuning completed         no                         2       0:07:34 ago
Ethernet14/1
  Operational speed             400Gbps                            
  Pre-FEC bit error rate        0.00e+00                           
  Post-FEC errored frames ratio 0.00e+00                           
  TX LOS
    Host lane 1                 ok                         0       never
    Host lane 2                 ok                         0       never
    Host lane 3                 ok                         0       never
    Host lane 4                 ok                         0       never
    Host lane 5                 ok                         0       never
    Host lane 6                 ok                         0       never
    Host lane 7                 ok                         0       never
    Host lane 8                 ok                         0       never
  TX CDR LOL
    Host lane 1                 ok                         0       never
    Host lane 2                 ok                         0       never
    Host lane 3                 ok                         0       never
    Host lane 4                 ok                         0       never
    Host lane 5                 ok                         0       never
    Host lane 6                 ok                         0       never
    Host lane 7                 ok                         0       never
    Host lane 8                 ok                         0       never
  TX adaptive input EQ fault
    Host lane 1                 ok                         0       never
    Host lane 2                 ok                         0       never
    Host lane 3                 ok                         0       never
    Host lane 4                 ok                         0       never
    Host lane 5                 ok                         0       never
    Host lane 6                 ok                         0       never
    Host lane 7                 ok                         0       never
    Host lane 8                 ok                         0       never

Note:In the operational state, module state is ‘Ready’ and datapath state for all 8 lanes is activated.

show VXLAN counters vni

Use the show VXLAN counters vni command to display the encapsulation and decapsulation counters at the VNI.

Command Mode

Privledged EXEC

Command Syntax

show VXLAN counters vni [encap | decap]

Parameters

encapDisplays the encapsulation related counters at the VNI.
decap Displays the decapsulation related counters at the VNI.

Examples

The following show VXLAN counters vni encap command displays the encapsulation related commands at the VNI.

switch# show VXLAN counters vni encap
                                      Encap BUM   Encap Drop
VNI       Encap Bytes  Encap Packets  Packets     Packets
-------- ------------- -------------- ----------- -----------
2824963             0               0           0           0
7023745             0               0           0           0

Encap Packets displays the total count of L2 packets that have been successfully encapsulated by the VNI towards the VTEP.

Encap Drop Or Exception Packets display the total count of L2 packets that have been encapsulated and dropped for any reason.

The following show VXLAN counters vni decap command displays the decapsulation related counters at the VNI.

switch# show VXLAN counters vni decap
                                                      Decap Drop Or             
                            Decap Known   Decap BUM       Exception
VNI       Decap Bytes   Unicast Packets      Packets        Packets
-------   -----------   ---------------   ----------   -------------
2824963             0                 0            0               0
7023745             0                 0            0               0

Decap Known UnicastPkts displays the total count of L2 known unicast packets coming into the VTI hitting the VTEP and getting decapsulated.

Decap BUM Packets displays the total count of L2 BUM packets coming into the VTI hitting the VTEP and getting decapsulated.

Decap Drop or Exception Packets displays the count of L2 packets coming into the VTI and getting dropped for any reason.

speed

The speed command configures the transmission speed and duplex setting for the configuration mode interface. The scope and effect of this command depends on the interface type. Interface types include:

40GBASE (QSFP+): Default is 4x10G-full. Speed forced 40gfull and Speed auto 40gfull configure interface as a 40G port.
10GBASE-T: Default is 10G-full. Speed command affects interface.
10GBASE (SFP+): Default is 10G-full. Speed command does not affect interface.
1000BASE (copper): Default is 1G-full. speed auto 100full affects interface.
1000BASE (fiber): Default is 1G-full. Speed command does not affect interface.
10/100/1000: Default is auto-negotiation. Speed command (10/100/1000 options) affects interface.

The speed 40gfull and auto 40gfull commands configure a QSFP+ Ethernet interface as a 40G port. The no speed and no auto 40gfull commands configure a QSFP+ Ethernet interface as four 10G ports. These commands must be applied to the /1 port. These commands are hitless on the 7050X, 7060X, 7250X, 7260X, 7280SE, 7300X, 7320X and 7500E series platforms. On all other platforms, these commands restart the forwarding agent, which will result in traffic disruption.

The no speed and default speed commands restore the default setting for the configuration mode interface by removing the corresponding speed command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

speed MODE

no speed

default speed

Parameters

MODE Transmission speed and duplex setting. Options include:

speed auto auto negotiation mode. (For SFP-1G-T, auto-negotiates 1Gbps, this is because no speed is specified, and we are defaulting to advertise 1G).
speed auto 40gfull auto negotiation mode with clause 73 auto negotiation.
speed auto 1G full/ speed 1G auto-negotiated 1Gbps (note that per BASE-T standard, 1G must be negotiated).
speed auto 100full auto-negotiated 100Mbps.
speed 100full non-negotiated and true-forced 100Mbps.
Note: Interfaces using clause 73 auto negotiation must connect to a device that runs clause 73 auto negotiation.
sfp-1000baset auto auto-negotiation mode (fu).
10000full 10G full duplex.
1000full 1G full duplex.
1000half 1G half duplex.
100full 100M full duplex.
100gfull 100G full duplex.
100half 100M half duplex.
10full 10M full duplex.
10half 10M half duplex.
40gfull 40G full duplex.

On 40GBASE and 100GBASE interfaces, options that change the SFP+ and MXP interfaces (the auto 40gfull, the 40gfull, and the no speed options) may restart the forwarding agent on some switch platforms, disrupting traffic on all ports for more than a minute.

Guidelines

Note: The SFP-1G-T transceivers advertise one speed at a time only. Hence, the desired speed and negotiation must be configured explicitly using the speed auto, speed auto 1G full/ speed 1G, speed auto 100full, and speed 100full commands.

Examples

This command configures a 40GBASE interface as a 40G port.

switch(config)# interface ethernet 49/1
switch(config-if-Et49/1)# speed 40gfull
switch(config-if-Et49/1)# show interface ethernet 49/1 - 49/4 status
Port      Name          Status       Vlan        Duplex  Speed Type
Et49/1                  connected    in Po999      full    40G 40GBASE-CR4
Et49/2                  errdisabled  inactive    unconf unconf 40GBASE-CR4
Et49/3                  errdisabled  inactive    unconf unconf 40GBASE-CR4
Et49/4                  errdisabled  inactive    unconf unconf 40GBASE-CR4
switch(config-if-Et49/1)#

This command configures a 40GBASE interface as four 10G ports (default configuration).

switch(config-if-Et49/1)# no speed
switch(config-if-Et49/1)# show interface ethernet 49/1 - 49/4 status
Port      Name          Status       Vlan        Duplex  Speed Type
Et49/1                  connected    routed        full    10G 40GBASE-SR4
Et49/2                  connected    routed        full    10G 40GBASE-SR4
Et49/3                  connected    routed        full    10G 40GBASE-SR4
Et49/4                  notconnect   inactive      full    10G 40GBASE-SR4
switch(config-if-Et49/1)#

system

The system command allows the user to configure the system-wide TCAM profiles such as default, mirroring-acl, mpls-evpn, pbr-match-nexthop-group, qos, tap-aggregation-default, tap-aggregation-extended, tc-counters, test, and VXLAN-routing.

The exit command returns the switch to global configuration mode.

Command Mode

Hardware TCAM

Command Syntax

system profile name

Parameter

name TCAM profile name.

Reference

hardware tcam

Example

This commands allow the switch to configure the TCAM profile qos.

switch(config-hw-tcam)# system profile qos

threshold

The threshold command configures the link monitoring threshold value that is specified for a link error.

The no threshold and the default threshold commands remove the threshold value specified for the chosen link error.

Command Mode

Link-error Configuration

Command Syntax

[fcs | symbol] threshold threshold_value

no [fcs | symbol] threshold threshold_value

default [fcs | symbol] threshold threshold_value

Parameters

fcs Inbound packets with Frame check sequence (FCS) error.
symbol Inbound packets with symbol error.
threshold_value Specifies the threshold value in number of errors. The value ranges from 1 to 100.

Related Commands

action
period

Example

These commands set the threshold value of 20 for the profile profile1 in the link-error configuration mode.

switch(config)# monitor ethernet oam
switch(config-eoam)# profile profile1
switch(config-eoam-profile-profile1)# link-error                        
switch(config-eoam-profile-profile1-link-error)# symbol threshold 20

traffic-policies field-set

The traffic-policies field-set creates field sets of prefixes, ports, or VLAN IDs to load from a location set by a URL. Reuse large field sets without copying and pasting each field set into a configuration. The no traffic-policies field-set disables the feature, and the default traffic-policies field-set sets the feature to the default settings.

Command Mode

Traffic Policies Configuration Mode

Command Syntax

Parameters

integer - Configure a field set of integer ranges.
ipv4 - Configure a field set of IPv4 address ranges.
ipv6 - Configure a field set of IPv6 address ranges.
l4-ports - Configure a field set of Layer 4 port ranges.
mac - Configure a field set of MAC addresses.
vlan - Configure a field set of VLAN IDs.
abort - Abandon all changes.
commit - Commit all changes.
except - Configure any exceptions to the field set.
limit - Limit the configuration within a field set.
remove - Remove IP prefix from the IP prefix set.
source - Configure a source of a field set.
- and-results - please provide info on this option
- bgp - please provide info on this option
- file: - Provide alocal URL to load the field set entries.
- flash: - Provide the local URL from a flash drive and add the field set entries.
- http: - Provide a remote URL to load the field set entries.
- https: - Provide a remote URL to load the field set entries
- scp: - Provide a remote URL to load the field set entries.
- static - Configure a static entry for field sets.

Example

Use the following command to add the HTTP URL, http://1.1.1.1, with the field set, mybigfieldset, to a traffic policy:

switch(config)#traffic-policies
            switch(config-traffic-policies)#

field-set ipv4 prefix mybigfield-set switch(config-traffic-policies-field-set ipv4 prefix mybigfieldset)#source http://1.1.1.1

transceiver channel

The transceiver channel command displays transceiver wavelength/frequency by channel number. The channel numbering depends on the selected grid-spacing mode. The default grid-spacing mode is 50GHz-spacing.

If the startup configuration does not specify the channel number for the interface, the transceiver will automatically tune to the default channel (i.e. channel-39 of 50GHz-spacing grid) when it is inserted.
If the configured wavelength/frequency is not supported by the transceiver, the transceiver is tuned to the default channel (i.e. channel-39 of 50GHz-spacing grid).

The interface is shutdown before the channel number is configured.

Command Mode

Global Configuration

Command Syntax

transceiver channel CHANNEL_NUMBER grid-spacing SPACING_GRID

no transceiver channel CHANNEL_NUMBER grid-spacing SPACING_GRID

default transceiver channel CHANNEL_NUMBER grid-spacing SPACING_GRID

Parameters

CHANNEL-NUMBER The default channel is 39 (50GHz-spacing grid) which corresponds to a frequency of 193,100 GHz and a wavelength of 1552.52 nm.
GRID_SPACING Grid-spacing mode (optional) depends on the selected grid-spacing mode. The default grid-spacing mode is 50GHz-spacing. For example, channel 39 of 50GHz-spacing grid is equivalent to channel 20 of 100GHz-spacing grid, which corresponds to a frequency of 193,100 GHz and a wavelength of 1552.52 nm.
- SPACING_GRID default grid-spacing mode in GHz.

Related Commands

show interfaces transceiver channels
show interfaces transceiver hardware

Example

This command tunes the transceiver on slot number 4 to slot 1 through 3 of 50GHz-spacing grid.

switch(config-as)# interface ethernet 4/1/3
switch(config-if-Et4/1/3)# transceiver channel 1 grid-spacing 50
switch(config-if-Et4/1/3)#

transceiver qsfp default-mode

The transceiver qsfp default-mode command specifies the transmission mode of all QSFP transceiver modules that are not explicitly configured.

Each QSFP+ module Ethernet interface is configurable as a single 40G port or as four 10G ports. The switch displays four ports for each interface. Each ports status depends on the interface configuration:

The /1 port is active (connected or not connected), regardless of the interface configuration.
The /2, /3, and /4 ports are error-disabled when the interface is configured as a single 40G port.
All ports are active (connected or not connected), when the interface is configured as four 10G ports.

QSFP modules that are not configured through a speed command are operated as four 10G ports.

The no transceiver qsfp default-mode and default transceiver qsfp default-mode commands restore the default-mode transceiver setting from 40G to4x10G.

Command Mode

Global Configuration

Command Syntax

transceiver qsfp default-mode 4x10G

no transceiver qsfp default-mode

default transceiver qsfp default-mode

Note: QSFP100 ports with external PHY always have 40G as the default QSFP mode.

Guidelines

The transceiver qsfp default-mode 4x10g statement is always in running-config and cannot be modified or removed in the current release.

Example

When default QSFP mode is configured as 4x10G, the show running-config contains transceiver qsfp default-mode 4x10G. show interfaces hardware shows 10G as the default speed.

switch(config)# transceiver qsfp default-mode 4x10G
switch(config)# show running-config | grep 4x10G
transceiver qsfp default-mode 4x10G
switch(config)# show interfaces ethernet 35/1 hardware
*  = Requires speed group setting change
Ethernet35/1
  Model:          DCS-7280CR3-32P4
  Type:           40GBASE-CR4
  Speed/Duplex:   10G/full(default),40G/full,auto
  Flowcontrol:    rx-(off,on,desired),tx-(off)

When QSFP mode configuration is reverted to the default, show running-configdoes not contain transceiver qsfp default-mode 4x10G. show interfaces hardware shows 40G as the default speed.

switch(config)# no transceiver qsfp default-mode
switch(config)# show running-config | grep 4x10G
switch(config)# show interfaces ethernet 35/1 hardware
*  = Requires speed group setting change
Ethernet35/1
  Model:          DCS-7280CR3-32P4
  Type:           40GBASE-CR4
  Speed/Duplex:   10G/full,40G/full(default),auto
  Flowcontrol:    rx-(off,on,desired),tx-(off)

Page 8 of 15

End of Support

EOS 4.33.1F User Manual - Link Layer Discovery Protocol

Link Layer Discovery Protocol

LLDP Introduction

LLDP Overview

LLDP Data Units

Transmission and Reception

Transmission

Reception

Storing LLDP Information

Guidelines and Limitations

LLDP Configuration Procedures

Enabling LLDP Globally

Example

Enabling LLDP on an Interface

Optional LLDP Parameters

Setting the LLDP Timer

Setting the LLDP Hold Time

Setting the LLDP Re-initialization Timer

Setting the IP Management Address to be used in the TLV

Selecting the LLDP TLVs

Configuring LLDP for Power over Ethernet

New LLDP Fields Defined by IEEE 802.3at-2009

Clearing LLDP Statistics

Displaying LLDP Information

Viewing LLDP Global Information

Viewing LLDP Local Information

Viewing LLDP Neighbors

Viewing LLDP Traffic

LLDP Configuration Commands

Global Configuration Commands

Interface Configuration Commands – Ethernet Interface

Privileged EXEC Commands

EXEC Commands

clear lldp counters

clear lldp table

lldp hold-time

lldp management-address

lldp management-address vrf

lldp receive

lldp receive packet tagged drop

lldp run

lldp timer reinitialization

lldp timer

lldp tlv transmit

lldp transmit

poe negotiation lldp disabled

show lldp counters

show lldp local-info

show lldp neighbors

show lldp

EOS 4.33.1F User Manual - Virtual LANs (VLANs)

Virtual LANs (VLANs)

VLAN Introduction

VLAN Conceptual Overview

VLAN Definition

VLAN Switching

VLAN Trunking and Trunk Groups

Q-in-Q Trunking

TPID (Configurable Ethertypes)

VLAN Routing

VLAN Interfaces

Internal VLANs

Support for Private VLAN

Limitations

On DCS-7280R, DCS-7280R2, DCS-7500R, DCS-7500R2, DCS-7020R

On All Platforms except 7300X3, CCS-720XP, DCS-7050X3

On All Platforms

Show Commands

On DCS-7280R, DCS-7280R2, DCS-7500R, DCS-7500R2, DCS-7020R

VLAN Translation

VLAN Configuration Procedures

Creating and Configuring VLANs

VLAN Policy

Configuring VLAN Switching

Access Ports

Trunk Ports

Dot1q Tunnel Ports

TPID Configuration

Layer 2 802.1Q Encapsulation