Port Channels and LACP

This chapter describes channel groups, port channels, port channel interfaces, and the Link Aggregation Control Protocol (LACP). This chapter contains the following sections:

Port Channel Introduction

Arista’s switching platforms support industry-standard link aggregation protocols. Arista switches optimize traffic throughput by using MAC addressing, IP addressing, and services fields to effectively load share traffic across aggregated links. Managers can configure multiple ports into a logical port channel, either statically or dynamically through the IEEE Link Aggregation Control Protocol (LACP). Various negotiation modes are supported to accommodate different configurations and peripheral requirements, including LACP fallback to support devices that need simple network connectivity to retrieve images or configurations prior to engaging port channel aggregation modes.

Arista’s Multi-chassis Link Aggregation protocol (MLAG) supports LAGs across paired Arista switches to provide both link aggregation and active/active redundancy.

Port Channel Conceptual Overview

Channel Groups and Port Channels

A port channel is a communication link between two switches supported by matching channel group interfaces on each switch. A port channel is also referred to as a Link Aggregation Group (LAG). Port channels combine the bandwidth of multiple Ethernet ports into a single logical link.

A channel group is a collection of Ethernet interfaces on a single switch. A port channel interface is a virtual interface that serves a corresponding channel group and connects to a compatible interface on another switch to form a port channel. Port channel interfaces can be configured and used in a manner similar to Ethernet interfaces. Port channel interfaces are configurable as Layer 2 interfaces, Layer 3 (routable) interfaces, and VLAN members. Most Ethernet interface configuration options are also available to port channel interfaces.

Port Channel Subinterfaces

Port channel subinterfaces divide a single port channel interface into multiple logical L3 interfaces based on the 802.1q tag (VLAN ID) of incoming traffic. Subinterfaces are commonly used in the L2/L3 boundary device, but they can also be used to isolate traffic with 802.1q tags between L3 peers by assigning each subinterface to a different VRF.

For further details about subinterfaces, see Subinterfaces.

Link Aggregation Control Protocol (LACP)

The Link Aggregation Control Protocol (LACP), described by IEEE 802.3ad, defines a method for two switches to automatically establish and maintain link aggregation groups (LAGs, also called channel groups or port channels). Using LACP, a switch can configure LACP-compatible ports into a dynamic LAG. The ports try to complete LACP negotiation automatically with the linked ports (also configured as a dynamic LAG) on the partner switch. The maximum number of ports per LAG varies by platform; numbers for each platform in the latest EOS release are available here: https://www.arista.com/en/support/product-documentation/supported-features.

Static LAGs

In static mode (with the channel-group mode configured as on on the member interfaces), the switch aggregates links without an awareness of LAGs on the partner switch and without LACP negotiation. The member ports do not send LACP packets or process inbound LACP packets on static LAGs. Packets may drop when static LAG configurations differ between switches.

Dynamic LAGs

Dynamic LAGs are aware of their partners’ port-channel states. Interfaces configured as dynamic LAGs are designated as active or passive.
  • Active interfaces send LACP Protocol Data Units (LACP PDUs) at a rate of one per second when forming a channel with an interface on the peer switch. An aggregate forms if the peer runs LACP in active or passive mode.

     

  • Passive interfaces only send LACP PDUs in response to PDUs received from the partner. The partner switch must be in active mode and initiates negotiation by sending a LACP packet. The passive mode switch receives and responds to the packet to form a LAG.

     

An active interface can form port channels with passive or active partner interfaces, but port channels are not formed when the interface on each switch is passive.

Table 1 summarizes the effect of different LACP mode combinations:

Table 1. LACP Mode Combinations
Switch 1 Switch 2 Comments
active active Links aggregate when LACP negotiation is successful.
active passive Links aggregate when LACP negotiation is successful.
passive passive Links do not aggregate because LACP negotiation is not initiated.
on (static) on (static) Links aggregate without LACP.
on (static) active or passive Links aggregate on the static switch without LACP; links do not aggregate on the other switch, and no port-channel connection is established with the partner.

 

During synchronization, interfaces in dynamic LAGs transmit one LACP PDU per second. After synchronization is complete, interfaces exchange one PDU every thirty seconds, facilitated by a default timeout of 30 seconds and a failure tolerance of three. Under these parameters, when the switch does not receive a LACP PDU for an interface during a ninety-second period, it records the partner interface as failed and removes the interface from the port channel.

Fallback Mode

An active interface that is not in fallback mode does not form a LAG until it receives PDUs from, and negotiates with its peer. Fallback mode allows an active LACP interface to maintain a LAG without receiving PDUs from its peer. The fallback timer specifies the period the LAG waits to receive a peer PDU. Upon timer expiry, the port channel reverts to its configured fallback mode if one is configured.

 

Static fallback: the port channel maintains one active port while in fallback mode; all its other member ports are in standby mode until a LACP PDU is received by the port channel. All member ports send (and can receive) LACP PDUs, but only the active port sends or receives data.

 

Individual fallback: all member ports act as individual switch ports while in fallback mode. Individual port configuration (rather than port channel configuration) is active while the port channel is in fallback mode, with the exception of ACLs. This includes VLAN membership. All member ports send and receive data, and continue to send LACP PDUs. As soon as a LACP PDU is received by a member of the port channel, all ports revert to normal port-channel operation.

The switch uses a link aggregation hash algorithm to determine the forwarding path within a link aggregation group. The IP and MAC header fields can be selected as components of the hash algorithm.

Port Channel Mirroring

EOS supports Port Channels as mirroring destinations for both ingress and egress source directions. Traffic mirrors to a port channel and load-balances based on the global port channel load balancing configuration.

Configure port channel members as a mirroring source port for both ingress and egress source directions. A port channel has higher privileges in mirroring source membership than its members. When configuring a port channel and members as mirroring source ports, only the port channel source port becomes active.

Port Channel Configuration Procedures

Configuring a Channel Group

Creating a Channel Group

The channel-group command assigns the configuration-mode Ethernet interfaces to a channel group, creates the channel group if it does not already exist, and specifies LACP attributes for the channel.

Channel groups are associated with a port channel interface immediately upon their creation. A command that creates a new channel group also creates a port channel with a matching ID. The port channel is configured in port-channel configuration mode. Configuration changes to a port channel interface propagate to all Ethernet interfaces in the corresponding channel group.

LACP is enabled on the member interfaces by setting the channel-group mode to active or passive. Setting the mode to on disabled LACP on the member interfaces and creates a static channel group.

 

Example
These commands assign Ethernet interfaces 1 and 2 to channel group 10 (creating the channel group if it does not already exist), enable LACP on those interfaces, and place the channel group in a negotiating state.
switch(config)# interface ethernet 1-2
switch(config-if-Et1-2)# channel-group 10 mode active
switch(config-if-Et1-2)#

 

Adding an Interface to a Channel Group

The channel-group command is also used to add the configuration mode interface to an existing channel group. When adding channels to a previously created channel group, the channel-group mode for the new channel must match the mode for the existing group.

 

Example
These commands add Ethernet interfaces 7 through 10 to previously created channel group 10, using the channel-group mode (active) under which it was created.
switch(config)# interface ethernet 7-10
switch(config-if-Et7-10)# channel-group 10 mode active
switch(config-if-Et7-10)#

Removing an Interface from a Channel Group

The no channel-group command removes the configuration mode interface from the specified channel group. Deleting all members of a channel group does not remove the associated port channel interface from running-config.

 

Example
These commands removes interface ethernet 8 from previously created channel group 10.
switch(config)# interface ethernet 8
switch(config-if-Et8)# no channel-group
switch(config-if-Et8)#

Configuring a Port-Channel as Mixed-Speed

By default, only configured members of the same speed become active. The port-channel speed mixed command configures a port channel with the ability to have active members of multiple speeds.

 

Note: Available on the 7020, 7280, 7500, and 7800 platforms. Minimum links is not available on mixed-speed port channels.

 

 

Example
switch(config)# interface port-channel 1
switch(config-if-Po1)# port-channel speed mixed

 

Configuring Minimum Links

 

Note: Minimum links is not available on Mixed-Speed Port-Channels. If a minimum requirement is desired for a Mixed-Speed Port-Channel, consider Minimum Speed instead. On Port-Channels that are not mixed-speed, if both Minimum Links and Minimum Speed are configured, then Minimum Speed will take precedence.

 

Configuring Minimum Speed

The port-channel speed minimumcommand specifies the cumulative minimum speed of all active members in order for a port channel to become active. If there is less than the specified by this command, the port channel interface does not become active.

 

Note: If both minimum speed and minimum links are configured, minimum speed will take precedence.

 

 

Example

These command sets 100 Gbps as the minimum speed needed for port channel 1 to become active.

switch(config)# interface port-channel 1
switch(config-if-Po1)# port-channel speed minimum 100 gbps

 

Deleting a Channel Group

A channel group is deleted by removing all Ethernet interfaces from the channel group. A channel group’s LACP mode can be changed only by deleting the channel group and then creating an equivalent group with a different LACP mode. Deleting a channel group by removing all Ethernet interfaces from the group preserves the port channel interface and its configuration settings.

View running-config to verify the deletion of all Ethernet interfaces from a channel group.

Configuring a Port Channel Interface

Creating a Port Channel Interface

The switch provides two methods for creating port channel interfaces:
  • creating a channel group simultaneously creates an associated port channel.

     

  • the interface port-channel command creates a port channel without assigning Ethernet channels to the new interface.

     

The interface port-channel command places the switch in interface-port channel configuration mode.

 
Example
This command creates interface port-channel 8 and places the switch in port channel interface configuration mode.
switch(config)# interface port-channel 8
switch(config-if-Po8)#

 

Deleting a Port Channel Interface

The no interface port-channel command deletes the configuration mode port channel interface and removes the channel group assignment for each Ethernet interface assigned to the group associated with the port channel interface. Removing all Ethernet interfaces from a channel group does not remove the associated port channel interface from running-config.

Configuring Port Channel Mirroring

Port Channels can be configured as a mirroring destination or a mirroring source.

Configuring a Port Channel as a Mirroring Destination

Use the following command to configure a port channel as a mirroring destination:

switch(config)#monitor session 1 destination Port-Channel 1

Unconfigured port channel interfaces can be configured as mirroring destinations, but do not become active until after configuring the port channel. Use the show monitor session to display the status of the configured mirroring destination.

Configuring a Port Channel as a Mirroring Source

Configure an interface member, Ethernet3/3/1 and Ethernet4/32/1, of a port channel as a mirroring source interface, with the session name, testmember:

switch#show Port-Channel 10
Port Channel Port-Channel10:
 Active Ports: Ethernet4/32/1 Ethernet3/3/1
 
switch(config)#monitor session testmember source et3/3/1
switch(config)#monitor session testmember source et4/32/1
switch(config)#monitor session testmember destination po1

Configuring a new monitor session testlag with the port channel interface as a mirroring source inactivates previously the port-channel member testmember monitor session.

switch(config)#monitor session testlag source po10
switch(config)#monitor session testlag destination et5/22/1

Use the show monitor session to display the status of the configured mirroring sources. Port channel member now displays a status of inactive.

switch(config)#show monitor session
                
Session testlag
------------------------
Source Ports:
   Both:    Po10
Destination Ports:
    Et5/22/1 :  active
                
Session testmember
------------------------
Source Ports:
   Both:        Et4/32/1
   Inactive:    Et3/3/1 ( Lag configured as source ) 
Destination Ports:
   Po1 :  active

Removing port channel member Et3/3/1 from port channel 10 reactivates the interface as a mirroring source interface.

switch(config)#interface ethernet 3/3/1
switch(config-if-Et3/3/1)#no channel-group 10
switch(config-if-Et3/3/1)#exit
                
switch(config)#show port-channel 10
Port Channel Port-Channel10:
  Active Ports: Ethernet4/32/1

Interface Et3/3/1 no longer displays as an inactive port in the show monitor session output.

switch(config)#show monitor session 
                
Session testlag
-----------------------
Source Ports:
  Both:        Po10
Destination Ports:
    Et5/22/1 :  active
                
Session testmember
----------------------
Source Ports:
  Both:        Et3/3/1, Et4/32/1
Destination Ports:
  Po1 :  active

Displaying Port Channel Mirroring Information

Use the following command to display information about mirroring to a destination:

switch#show Port-Channel 1
Port Channel Port-Channel1
 Active Ports: Ethernet1/1
                
switch#show monitor session
Session 1
------------------------
Source Ports:
Destination Ports:
   Po1 :  active

Use the following command to display information about mirroring to a source:

switch#show monitor session
Session testmember
------------------------
                
Source Ports:
  Both:        Et3/3/1, Et4/32/1
                
Destination Ports:
  Po1 :  active

Maximum Port Channel ID Increase

Previously, the maximum valid port channel ID was equal to the maximum number of port channels configurable on the system, 2000, and this feature increases the maximum ID to 999,999 while maintaining the same limit of 2000 port channels on the system.

Configuration

This feature does not involve any specific configuration procedure, but it does include visible changes to port channel configuration commands. In the following examples, suppose port channels 1-2000 have already been configured, so creating Port-Channel 2001 would exceed the configuration limit.
switch(config)# interface create port-channel 2001
Port channel config limit 2000 reached. No interfaces were created.

 

 

switch(config-ifEtX)# channel-group 2001 mode 
Port channel config limit 2000 reached. No interfaces were created.

 

Show Commands

Changes to existing show commands simply involve displaying when a port channel is inactive. In the following examples, suppose port channels 2001-4001 are configured, Port-Channel 4001 is inactive, and Ethernet1 is a member of Port-Channel 4001.
switch(config)# show lacp 1-$ aggregates
Port channel 4001 is inactive. The number of configured port channels exceeds the config limit 2000.
Port-Channels1-2000,4002-999999 not configured as LAG
Port Channel Port-Channel2001:
Aggregate ID: [(8000,00-1c-73-04-36-d7,0001,0000,0000),(8000,00-1c-73-09-a0-f3,0001,0000,0000)]
  Bundled Ports: Ethernet43 Ethernet44 Ethernet45 Ethernet46
Port Channel Port-Channel2002:
Aggregate ID: [(8000,00-1c-73-01-02-1e,0002,0000,0000),(8000,00-1c-73-04-36-d7,0002,0000,0000)]
  Bundled Ports: Ethernet47 Ethernet48
Port Channel Port-Channel2003:
Aggregate ID: [(8000,00-1c-73-04-36-d7,0003,0000,0000),(8000,00-1c-73-0c-02-7d,0001,0000,0000)]
  Bundled Ports: Ethernet3 Ethernet4
Port Channel Port-Channel2004:
Aggregate ID: [(0001,00-22-b0-57-23-be,0031,0000,0000),(8000,00-1c-73-04-36-d7,0004,0000,0000)]
  Bundled Ports: Ethernet42
Port Channel Port-Channel2005:
Aggregate ID: [(0001,00-22-b0-5a-0c-51,0033,0000,0000),(8000,00-1c-73-04-36-d7,0005,0000,0000)]
  Bundled Ports: Ethernet41




switch(config)# show lacp 1-$ counters
Port channel 4001 is inactive. The number of configured port channels exceeds the config limit 2000.
Port-Channels1-2000,4002-999999 not configured as LAG


switch(config)# show lacp 1-$ internal
Port channel 4001 is inactive. The number of configured port channels exceeds the config limit 2000.
Port-Channels1-2000,4002-999999 not configured as LAG
LACP System-identifier: 8000,00-1c-73-04-36-d7
State: A = Active, P = Passive; S=ShortTimeout, L=LongTimeout;
       G = Aggregable, I = Individual; s+=InSync, s-=OutOfSync;
       C = Collecting, X = state machine expired,
       D = Distributing, d = default neighbor state
             |Partner                                 Actor
Port Status  | Sys-id                 Port#  State    OperKey  PortPriority
----------------------------------------------------------------------------
Port Channel Port-Channel2001:
Et43 Bundled | 8000,00-1c-73-09-a0-f3    43  ALGs+CD   0x0001         32768
Et44 Bundled | 8000,00-1c-73-09-a0-f3    44  ALGs+CD   0x0001         32768
Et45 Bundled | 8000,00-1c-73-09-a0-f3    45  ALGs+CD   0x0001         32768
Et46 Bundled | 8000,00-1c-73-09-a0-f3    46  ALGs+CD   0x0001         32768

switch(config)# show lacp 1-$ peer
Port channel 4001 is inactive. The number of configured port channels exceeds the config limit 2000.
Port-Channels1-2000,4002-999999 not configured as LAG
State: A = Active, P = Passive; S=ShortTimeout, L=LongTimeout;
       G = Aggregable, I = Individual; s+=InSync, s-=OutOfSync;
       C = Collecting, X = state machine expired,
       D = Distributing, d = default neighbor state
               |                          Partner
Port   Status  | Sys-id                  Port#   State     OperKey  PortPri
----------------------------------------------------------------------------
Port Channel Port-Channel2001:
Et1    Bundled | 8000,00-1c-73-00-13-19      1   ALGs+CD    0x0001    32768
Et2    Bundled | 8000,00-1c-73-00-13-19      2   ALGs+CD    0x0001    32768
Port Channel Port-Channel2002:
Et23   Bundled | 8000,00-1c-73-04-36-d7     47   ALGs+CD    0x0002    32768
Et24   Bundled | 8000,00-1c-73-04-36-d7     48   ALGs+CD    0x0002    32768
Port Channel Port-Channel2004*:
Et3    Bundled | 8000,00-1c-73-0b-a8-0e     45   ALGs+CD    0x0001    32768
Et4    Bundled | 8000,00-1c-73-0b-a8-0e     46   ALGs+CD    0x0001    32768
Port Channel Port-Channel2005*:
Et19   Bundled | 8000,00-1c-73-0c-30-09     49   ALGs+CD    0x0005    32768
Et20   Bundled | 8000,00-1c-73-0c-30-09     50   ALGs+CD    0x0005    32768
Port Channel Port-Channel2006*:
Et6    Bundled | 8000,00-1c-73-01-07-b9     49   ALGs+CD    0x0001    32768
Port Channel Port-Channel2007*:
Et5    Bundled | 8000,00-1c-73-0f-6b-22     51   ALGs+CD    0x0001    32768
Port Channel Port-Channel2008*:
Et10   Bundled | 8000,00-1c-73-10-40-fa     51   ALGs+CD    0x0001    32768
 
* - Only local interfaces for MLAGs are displayed. Connect to the peer to
    see the state for peer interfaces.

switch(config)# show lacp interface Ethernet1 [(internal|neighbor|peer)]
Interface Ethernet1 is a member of an inactive LACP port channel. The number of configured port channels exceeds the config limit 2000.

switch(config)# show port-channel 1-$
Port Channel Port-Channel2001:
  No Active Ports
...
Port Channel Port-Channel4000:
  No Active Ports
Port Channel Port-Channel4001:
  Inactive, The number of configured port channels exceeds the config limit 2000.

switch(config)# show port-channel (dense|summary)

                  Flags
-------------------------- ----------------------------- -------------------------
   a - LACP Active            p - LACP Passive           * - static fallback
   F - Fallback enabled       f - Fallback configured    ^ - individual fallback
   U - In Use                 D - Down                   
   + - In-Sync                - - Out-of-Sync            i - incompatible with agg
   P - bundled in Po          s - suspended              G - Aggregable
   I - Individual             S - ShortTimeout           w - wait for agg
   E - Inactive. The number of configured port channels exceeds the config limit

Number of channels in use: ...
Number of aggregators: ...

   Port-Channel       Protocol    Ports
------------------ -------------- -------------------
   Po2001(U)          LACP(a)     Et47(PG+) Et48(PG+)
   Po2002(U)          LACP(a)     Et39(PG+) Et40(PG+)
   Po4001(E)          Static      Et7(P)

 

Limitations

  • The number of configured port channels can exceed the configurable limit if two configuration sessions simultaneously create two different port channels. In this scenario, port channels that exceed the limit are inactive. This is uncommon and does not impact traffic in any way. If an inactive port channel exists and an active port channel is deleted, then the inactive port channel is activated.

     

  • Only port channels with ID from 1 to 2000 are configured as MLAG port channels.

     

Configuring Port Channel Subinterfaces

When configuring subinterfaces on a port channel interface (the virtual interface associated with a port channel), the following restrictions apply:

An L3 interface with subinterfaces configured on it should not be made a member of a port channel.
  • An interface that is a member of a port channel should not have subinterfaces configured on it.

     

  • A subinterface cannot be made a member of a port channel.

     

Port channel subinterfaces are otherwise configured similarly to Ethernet subinterfaces. For additional information, see Subinterfaces.

Configuring LACP

Configuring the Channel-group Mode

The channel-group mode is configured when a channel group is created using the channel-group command. A channel group’s mode cannot be modified without deleting the entire channel group, but it can be modified without deleting the port channel interface associated with the channel group. The mode setting defines whether the port channel is static or dynamic, and whether a dynamic port channel is active or passive.

Examples
  • These commands create a dynamic channel group and place it in LACP active mode.
    switch(config)# interface ethernet 1-2
    switch(config-if-Et1-2)# channel-group 10 mode active
    switch(config-if-Et1-2)#

     

  • These commands create a static channel group.
    switch(config)# interface ethernet 4-5
    switch(config-if-Et4-5)# channel-group 11 mode on
    switch(config-if-Et4-5)#

     

Configuring the System Priority

Each switch is assigned a globally unique system identifier by concatenating the system priority (16 bits) to the MAC address of one of its physical ports (48 bits). The system identifier is used by peer devices when forming an aggregation to verify that all links are from the same switch. The system identifier is also used when dynamically changing aggregation capabilities in response to LACP information; the system with the numerically lower system identifier is permitted to dynamically change advertised aggregation capabilities.

The lacp system-priority command configures the switch’s LACP system priority.

 
Example
This command assigns the system priority of 8192 to the switch.
switch(config)# lacp system-priority 8192
switch(config)#

 

Configuring Port Priority

LACP port priority determines the port that is active in a LAG in fallback mode. Numerically lower values have higher priority. Port priority is supported on port channels that are enabled with LACP physical interfaces.

The lacp port-priority command sets the aggregating port priority for the configuration mode interface.

 
Example
This command assigns the port priority of 4096 to Ethernet interface 1.
switch(config-if-Et1)# lacp port-priority 4096
switch(config-if-Et1)#

 

Configuring the LACP Packet Reception Rate

The lacp timer command sets the reception rate of LACP packets on the local device for the interface being configured. This command supports the following reception rates:
  • normal: LACP packets are received at the following rates:
    • 30 seconds for synchronized interfaces.
    • One second for interfaces that are being synchronized.

       

  • fast: LACP packets are received every second.

     

 
Example
This command sets the LACP reception rate to one second on the Ethernet interface 4.
switch(config-if-Et4)# lacp timer fast
switch(config-if-Et4)#

 

Configuring LACP Fallback

Fallback mode (static or individual) is configured on a port channel interface with the port-channel lacp fallback command. The fallback timeout interval is configured with the port-channel lacp fallback timeout command. Fallback timeout settings persist in running-config without taking effect for interfaces that are not configured into fallback mode. The default fallback timeout period is 90 seconds.

 
Examples
  • These commands enable LACP static fallback mode, then configure an LACP fallback timeout of 100 seconds on port channel interface 13. If LACP negotiation fails, only the member port with the lowest LACP priority will remain active until an LACP PDU is received by one of the member ports.
    switch(config)# interface port-channel 13
    switch(config-if-Po13)# port-channel lacp fallback static
    switch(config-if-Po13)# port-channel lacp fallback timeout 100
    switch(config-if-Po13)# show active
    interface Port-Channel13
       port-channel lacp fallback static
       port-channel lacp fallback timeout 100
    switch(config-if-Po13)#

     

  • These commands enable LACP individual fallback mode, then configure an LACP fallback timeout of 50 seconds on port channel interface 17. If LACP negotiation fails, all member ports will act as individual switch ports, using port-specific configuration, until a LACP PDU is received by one of the member ports.
    switch(config)# interface port-channel 17
    switch(config-if-Po17)# port-channel lacp fallback individual
    switch(config-if-Po17)# port-channel lacp fallback timeout 50
    switch(config-if-Po17)# show active
    interface Port-Channel17
       port-channel lacp fallback individual
       port-channel lacp fallback timeout 50
    switch(config-if-Po17)#

     

Configuring Minimum Links

The port-channel min-links command specifies the minimum number of interfaces that the configuration mode LAG requires to be active. If there are fewer ports than specified by this command, the port channel interface does not become active.

 

Note: In static LAGs, the min-links value must be met for the LAG to be active. The LAG will not become active until it has at least the min-links number of functioning links in the channel group. If failed links cause the number to drop below the minimum, the LAG will go down and administrator action will be required to bring it back up. In dynamic LAGs, the LACP protocol must determine that at least min-links physical ports are aggregable (they are physically compatible and have the same keys both remotely and locally) before it begins negotiating to make any ports active members of the port-channel. However once negotiation begins, an error on the partner’s side or an error in programming of member interfaces can cause the LAG to become active with fewer than the minimum number of links. EOS evaluates min-links after min-links-review-timeout (linearly proportional to configured min-links) when LACP protocol collecting and/or distributing state changes. If the number of active member interfaces in a port-channel is less than configured min-links, it brings the corresponding port-channel Link Down and syslogs LAG-4-MINLINK_INTF_INSUFFICIENT message. If additional interfaces get programmed as collecting and distributing, EOS re-evaluates min-links on the port-channel. If sufficient number of interfaces are available to be a part of port-channel, then all interfaces of the corresponding port-channel are re-enabled for LACP negotiation and the port-channel becomes Link Up. LAG-4-MINLINK_INTF_NORMAL is syslogged after min-links-review-timeout if the min-links condition is satisfied; otherwise LAG-4-MINLINK_INTF_INSUFFICIENT is syslogged and the port-channel goes Link Down. If an interface remains in collecting state but not in distributing state for min-links-review-timeout, it is moved out of collecting state. It is periodically re-enabled after min-links-retry-timeout (which is 360 seconds) till it progresses to collecting and distributing. Meanwhile, if a port-channel becomes Link Up because sufficient number of interfaces progressed to collecting and distributing states, then this interface is enabled for LACP negotiation.

 

 
Example
This command sets four as the minimum number of ports required for port channel 5 to become active.
switch(config-if-Po5)# port-channel min-links 4
switch(config-if-Po5)#

 

Configuring Minimum Links Review Interval

The port-channel min-links review interval command enables or disables timer based min-links review feature for all port-channels. The timer based min-links feature is enabled when all of the following conditions are true. It is disabled otherwise:
  • The min-links configured is greater than 1.
  • LACP fallback is disabled.
  • The number of interfaces configured in the port-channel is more than min-links.
  • The number of active member interfaces in the port-channel is less than min-links.
  • The default timer values are:
    • min-links-review-timeout = min-links-timeout-base + f (configured min-links).
    • min-links-timeout-base = 180 seconds.
    • min-links-retry-timeout = 360 seconds.

       

Displaying Port Channel Information

Port channel information is accessed using some of the show commands listed under Interface Display Commands. Ensure that while using the show interfaces counters rates command to view the rate information of a port channel, rate values for the individual member ports are less inaccurate than rate values of the port channel.

Both the port channel rate and the individual port rates are calculated approximations; the rate value of a port channel might vary from the total of the rates for the member ports. The discrepancy is likely to be larger for port channels with fewer ports, and will be most obvious in single-port port channels.

Load Balancing Hash Algorithms

The switch balances packet load across multiple links in a port channel by calculating a hash value based on packet header fields. The hash value determines the active member link through which the packet is transmitted. This method, in addition to balancing the load in the LAG, ensures that all packets in a data stream follow the same network path.

In network topologies that include MLAGs or Multiple Paths with Equal Cost (ECMP), programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links. This uneven distribution is avoided by performing different hash calculations on each switch routing the paths.

The port-channel load-balance command specifies the seed for hashing algorithms that balance the load across ports comprising a port channel. Available seed values vary by switch platform.

 

Example
This command configures the hash seed of 10 on 7150 Series (FM6000 platform) switches.
switch(config)# port-channel load-balance fm6000 10
switch(config)#

 

Load Balance Hash Algorithms on 7048 and 7500 Series Switches

One command configures the load balance hash algorithm on 7048 and 7500 Series switches:

  • port-channel load-balance petraA fields ip: controls the hash algorithm for IP packets by specifying the algorithm’s use of IP and MAC header fields. Fields that the command can specify include source and destination IP addresses, source and destination port fields (for TCP and UDP packets), and the entire MAC address header.

The hash algorithm for non-IP packets is not configurable and always includes the entire MAC header.

 

Example
These commands configure the load balance algorithm for IP packets by using the entire MAC header.
switch(config)# port-channel load-balance petraA fields ip mac-header
switch(config)#

 

Load Balance Hash Algorithms on 7500E Series Switches

One command configures the load balance hash algorithm on 7500E Series switches:

port-channel load-balance arad fields ip: controls the hash algorithm for IP packets by specifying the algorithm’s use of IP and MAC header fields. Fields that the command can specify include source and destination IP addresses, source and destination port fields (for TCP and UDP packets), and the entire MAC address header.

The hash algorithm for non-IP packets is not configurable and always includes the entire MAC header.

 

Example
These commands configure the load balance algorithm for IP packets by using the entire MAC header.
switch(config)# port-channel load-balance arad fields ip mac-header
switch(config)#

 

Dynamic and Symmetric LAG Hashing

Dynamic LAG hashing enables high link utilization and highly even distribution among LAG members by employing a randomized hashing algorithm. Symmetric LAG hashing allows the two flows of a bidirectional communication link, even when the two flows enter the switch on different ingress ports, to be hashed to the same member of a LAG on egress.

Dynamic and symmetric LAG hashing policies are enabled via named port-channel load-balancing profiles. LAG load-balancing policies can be provisioned on per line-card basis using these profiles. Load-balancing profiles can be used to provision all LAG load-balance attributes, including hash polynomials, hash seeds, and hash fields.

When no specific LAG hashing profile is assigned to a line card, then a global LAG hashing profile can be defined and applied to all the line cards with no LAG hashing defined on them.

Note, if no profile is selected as global profile then the default profile takes the precedence and set as a global profile. The default profile is reserved and if it is set as a global profile it cannot be deleted, if the profile is deleted then the following warning message is displayed.

 

Note: When a global profile is already set and if some other profile is tried to configured as a default profile the following warning message is displayed “! A global load balancing profile myProfile is currently active. This setting will not take effect.”

 

 

Examples
  • These commands configure a load balance profile for symmetric hashing.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# load-balance arad profile
    switch(config-sand-load-balance-profile-symmetric-profile-1)# hash symmetric
    switch(config-sand-load-balance-profile-symmetric-profile-1)# show active
    load-balance policies
       load-balance arad profile symmetric-profile-1
          hash symmetric

     

  • These commands configure a load balance profile for dynamic hashing.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# load-balance arad profile
    switch(config-sand-load-balance-profile-dynamic-hash-profile-1)# distribution clock
    switch(config-sand-load-balance-profile-dynamic-hash-profile-1)# show active load-balance policies
       load-balance arad profile dynamic-hash-profile-1
          distribution clock

     

  • This command assigns a named load-balancing profile to a linecard.
    switch(config)# port-channel load-balance module 3-7 sand profile Linecard5
    switch(config)#

     

  • This command unassigns a named load-balancing profile to a linecard.
    switch(config)# no port-channel load-balance module 3-7 sand profile Linecard5
    switch(config)#

     

  • This command configures a global profile on all line cards on which LAG hashing is not defined.
    switch(config)# port-channel load-balance sand profile myGlobalProfile

     

  • These commands designates a default profile as a global profile, if no other profile is set as a global profile.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# load-balance sand profile default

     

  • These commands configure a hash seed in a profile and assigns it as a global profile.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# load-balance sand profile myGlobalProfile
    switch(config-sand-load-balance-profile-myGlobalProfile)# hash seed 20
    switch(config)# port-channel load-balance sand profile myGlobalProfile

     

  • This command assigns a named load-balancing profile to a linecard.
    switch(config)# port-channel load-balance module 3-7 sand profile Linecard5
    switch(config)#

     

  • This command unassigns a named load-balancing profile to a linecard.
    switch(config)# no port-channel load-balance module 3-7 sand profile Linecard5
    switch(config)#

     

Load Balance Hash Algorithms on 7050 Series Switches

Three commands configure the load balance hash algorithm on 7050 Series switches:
  • port-channel load-balance trident fields ip controls the hash algorithm for IP packets by specifying the algorithm’s use of IP and MAC header fields. Fields that the command can specify include source and destination IP addresses, source and destination port fields (for TCP and UDP packets), and fields specified by the port-channel load-balance trident fields mac command.

     

  • port-channel load-balance trident fields ipv6 controls the hash algorithm for IPv6 packets by specifying the algorithm’s use of IP and MAC header fields. Fields that the command can specify include source and destination IP addresses, source and destination port fields (for TCP and UDP packets), and fields specified by the port-channel load-balance trident fields mac command.

     

  • port-channel load-balance trident fields mac controls the hash algorithm for non-IP packets b specifying the algorithm’s use of MAC header fields. Fields that the command can specify include the MAC source address, MAC destination address, and Ethernet type fields.

     

 

Example
These commands configure the switch’s port channel load balance for non IP packets by using the MAC destination and Ethernet type fields in the hashing algorithm.
switch(config)# port-channel load-balance trident fields mac dst-mac eth-type
switch(config)#

 

Load Balance Hash Algorithms on 7150 Series Switches

Load balance profiles specify parameters used by hashing algorithms that distribute traffic across ports comprising a port channel or among component ECMP routes. The switch supports 16 load balance profiles, including the default profile. The default load balance profile is configured through port-channel load-balance fm6000 fields ip and port-channel load-balance fm6000 fields mac commands.

Load Balance Profiles

Load balance profiles are managed in load-balance-policies configuration mode. The load-balance-policies configuration mode provides commands that display the contents of all configured profiles and place the switch in load-balance-profile command. Load balance profiles are created by entering the load-balance-profile mode and edited while in that mode.

The load-balance policies command places the switch in load-balance-policies configuration mode. Load balance profiles specify the inputs used by the hashing algorithms that distribute traffic across ports comprising a port channel or among ECMP routes.

 

Examples
  • This command places the switch in load-balance-policies configuration mode.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)#

     

  • This command displays the contents of the four load balance profiles configured on the switch.
    switch(config-load-balance-policies)# show active
    
    load-balance policies
       load-balance fm6000 profile F-01
          port-channel hash-seed 22
          fields ip dscp
          distribution random port-channel
       !
       load-balance fm6000 profile F-02
          fields ip protocol dst-ip
          distribution random port-channel
       !
       load-balance fm6000 profile F-03
          fields ip protocol dst-ip
          fields mac dst-mac eth-type
          distribution random ecmp port-channel
       !
       load-balance fm6000 profile F-04
    
    switch(config-load-balance-policies)#

     

Creating a Load Balance Profile

The load-balance fm6000 profile command places the switch in load-balance-profile configuration mode to configure a specified load balance profile. The command specifies the name of the profile that subsequent commands modify. It creates a profile if the profile it references does not exist.

 
Example
These commands enter load-balance-profile configuration mode, creates the LB-5 profile, and lists the default settings for the profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-5
switch(config-load-balance-profile-LB-5)# show active all

load-balance policies
   load-balance fm6000 profile LB-5
      port-channel hash-seed 0
      fields mac dst-mac src-mac eth-type vlan-priority vlan-id
      fields ip protocol dst-ip dst-port src-ip src-port dscp
      no distribution symmetric-hash
      no distribution random

switch(config-load-balance-profile-LB-5)#

 

Configuring a Load Balance Profile
These commands are available in load-balance-profile configuration mode to specify the parameters that comprise a profile.
  • The fields ip command specifies the L3/L4 data fields used by the hash algorithm defined by the configuration mode load balance profile.

     

  • The fields mac command specifies the L2 data fields used by the hash algorithm defined by the configuration mode load balance profile.

     

  • The distribution symmetric-hash command enforces traffic symmetry on data distributed by the hash algorithm defined by the configuration mode load balance profile. Symmetric traffic is the flow of both directions of a data stream across the same physical link.

     

  • The distribution random command specifies the random distribution of data packets handled by the hash algorithm defined by the configuration mode load balance profile.

     

 
Example
These commands configure the following components of the hash algorithm defined by the LB-7 load balance profile:
  • L2 header fields: MAC destination address, VLAN priority.

     

  • L3/L4 header fields: Source IP address, protocol field.

     

  • Symmetric hash distribution of IP and non-IP packets.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# load-balance fm6000 profile LB-7
    switch(config-load-balance-profile-LB-7)# fields ip src-ip protocol
    switch(config-load-balance-profile-LB-7)# fields mac dst-mac vlan-priority
    switch(config-load-balance-profile-LB-7)# distribution symmetric-hash mac-ip
    switch(config-load-balance-profile-LB-7)# show active
    load-balance policies
       load-balance fm6000 profile LB-7
          fields mac dst-mac vlan-priority
          fields ip protocol src-ip
          distribution symmetric-hash mac-ip
    switch(config-load-balance-profile-LB-7)# exit
    switch(config-load-balance-policies)# exit
    switch(config)# exit

     

Assigning a Load Balance Profile to an Interface

The ingress load-balance profile command applies a specified load-balance profile to the configuration mode interface. Load balance profiles specify parameters used by hashing algorithms that distribute traffic across ports comprising a port channel or among ECMP routes. The switch supports 16 load balance profiles, including the default profile.

 
Example
This command applies the LB-1 load balance profile to interface port-channel 100.
switch(config)# interface port-channel 100
switch(config-if-Po100)# ingress load-balance profile LB-1
switch(config-if-Po100)# show active
interface Port-Channel100
   ingress load-balance profile LB-1
switch(config-if-Po100)#

 

Default Load Balance Profile

Two commands configure the load balance default profile on 7150 Series switches:
  • port-channel load-balance fm6000 fields ip controls the hash algorithm for IP packets by specifying the algorithm’s use of IP and MAC header fields. Fields that the command can specify include source and destination IP addresses, source and destination port fields (for TCP and UDP packets).

     

  • port-channel load-balance fm6000 fields mac controls the hash algorithm for non-IP packets by specifying the algorithm’s use of MAC header fields. Fields that the command can specify include include the MAC source address, MAC destination address, and Ethernet type, VLAN-ID, and VLAN-priority fields.

     

Examples
  • These commands configure the load balance default profile for IP packets by using source and destination IP address fields, along with source and destination port fields for TCP, and UDP packets.
    switch(config)# port-channel load-balance fm6000 fields ip ip-tcp-udp-header
    switch(config)#

     

  • This command applies the default load balance profile to interface port-channel 100.
    switch(config)# interface port-channel 100
    switch(config-if-Po100)# no ingress load-balance profile
    switch(config-if-Po100)# show active
    interface Port-Channel100
    switch(config-if-Po100)#

Port Channel and LACP Configuration Commands

channel-group

The channel-group command assigns the configuration mode Ethernet interfaces to a channel group, creates the group if it does not already exist, and sets the port-channel mode for the group. When adding interfaces to a previously created channel group, the port-channel mode for the newly added interfaces must match the mode for the existing group.

Channel groups are associated with a port channel interface immediately upon their creation. A command that creates a new channel group also creates a port channel with a matching ID. The port channel is configured in Port-channel Configuration Mode. Configuration changes to a port channel interface propagate to all Ethernet interfaces in the corresponding channel group. The interface port-channel command places the switch in the interface-port-channel configuration mode.

The no channel-group and default channel group commands remove the configuration-mode interface from the specified channel group.

 

Command Mode

Interface-Ethernet Configuration

 

Command Syntax

channel-group number mode group_mode

no channel-group

default channel-group

 

Parameters
  • number     Specifies a channel group ID. Values range from 1 through 2000.
  • group_mode      Specifies the channel-group mode for the channel group. Values include:
    • on       Port channel is static and LACP is disabled on member interfaces. Port neither verifies nor negotiates port channel membership.
      • active       Port channel is dynamic and member interfaces are active LACP ports that transmit and receive LACP negotiation packets.
      • passive      Port channel is dynamic and member interfaces are passive LACP ports that respond to LACP negotiation packets but do not generate them.

         

Guidelines: Port Channels

You can configure a port channel to contain many ports, but only a subset may be active at a time. All active ports in a port channel must be compatible. Compatibility includes many factors and is platform-specific. For example, compatibility may require identical operating parameters such as speed and Maximum Transmission Unit (MTU). Compatibility may only be possible between specific ports because of the internal organization of the switch.

 

Guidelines: MLAG Configurations

Static LAG is not recommended in MLAG configurations. However, these considerations apply when the channel group mode is on while configuring static MLAG:
  • When configuring multiple interfaces on the same static port channel:
    • all interfaces must physically connect to the same neighboring switch.
    • the neighboring switch must configure all interfaces into the same port channel.

       

The switches are misconfigured when these conditions are not met.

Disable the static port channel membership before moving any cables connected to these interfaces or changing a static port channel membership on the remote switch.

 
Examples
  • These commands assign Ethernet interfaces 8 and 9 to channel group 10, and enable LACP in negotiating mode.
    switch(config)# interface ethernet 8-9
    switch(config-if-Et8-9)# channel-group 10 mode active
    switch(config-if-Et8-9)# show active
    interface Ethernet8
       channel-group 10 mode active
    interface Ethernet9
       channel-group 10 mode active
    switch(config-if-Et8-9)#

     

  • These commands assign Ethernet interfaces 12 and 13 to static channel group 11. LACP is disabled on these interfaces.
    switch(config)# interface ethernet 12-13
    switch(config-if-Et12-13)# channel-group 11 mode on
    switch(config-if-Et12-13)# show active
    interface Ethernet12
       channel-group 11 mode on
    interface Ethernet13
       channel-group 11 mode on
    switch(config-if-Et12-13)#

distribution random

The distribution random command specifies the random distribution of data packets handled by the hash algorithm defined by the configuration mode load balance profile. All data fields and hash seeds that are configured for the profile are used as seeds for the random number generator that defines the distribution of individual packets.

Command options allow for the random distribution of traffic across port channel links and ECMP routes. Random distribution can be enabled for either, both, or neither.

The no distribution random and default distribution random commands remove random distribution on the configuration mode load balance profile by deleting the corresponding distribution random command from the configuration.

 

Command Mode

Load-balance-profile Configuration

 

Command Syntax

distribution random BALANCE_TYPE

no distribution random

default distribution random

 

Parameters

SCOPE       Specifies use of random distribution for port channels and ECMP routes. Options include:
  • no parameter      Random distribution is enabled for ECMP routes and port channel links.
  • ecmp      Random distribution is enabled for ECMP routes.
  • port-channel      Random distribution is enabled for port channel links.
  • port-channel ecmp      Random distribution is enabled for ECMP routes and port channel links.
  • ecmp port-channel      Random distribution is enabled for ECMP routes and port channel links.

     

Guidelines

The distribution random command takes precedence over the distribution symmetric-hash command when both methods are simultaneously enabled.

 

Related Commands

load-balance fm6000 profile places the switch in the load-balance-profile configuration mode.

 
Example
These commands configure symmetric hashing on all traffic distributed through the algorithm defined by the LB-1 load balance profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-1
switch(config-load-balance-profile-LB-1)# distribution random ecmp port-channel
switch(config-load-balance-profile-LB-1)# show active
load-balance policies
   load-balance fm6000 profile LB-1
      distribution random ecmp port-channel
switch(config-load-balance-profile-LB-1)#

distribution symmetric-hash

The distribution symmetric-hash command enforces traffic symmetry on data distributed by the hash algorithm defined by the configuration mode load balance profile. Symmetric traffic is the flow of both directions of a data stream across the same physical link.

Two symmetric-hash options specify the traffic upon which symmetry is enforced:
  • distribution symmetric-hash mac specifies that only non-IP traffic is hashed symmetrically. IP traffic is hashed normally without regard to symmetry.

     

  • distribution symmetric-hash mac-ip specifies that all traffic is hashed symmetrically.

     

The no distribution symmetric-hash and default distribution symmetric-hash commands remove the specified hashing symmetry restriction on the configuration mode load balance profile by deleting the corresponding distribution symmetric-hash command from running-config.

 

Command Mode

Load-balance-profile

 

Command Syntax

distribution symmetric-hash FIELD_TYPE

no distribution symmetric-hash

default distribution symmetric-hash

 

 

Parameters

FIELD_TYPE      Fields the hashing algorithm uses for Layer 3 routing. Options include:
  • mac      Non-IP traffic is hashed symmetrically.
  • mac-ip      All traffic is hashed symmetrically.

     

Guidelines

The distribution random command takes precedence over the distribution symmetric-hash command when both methods are simultaneously enabled.

 

Related Commands

load-balance fm6000 profile places the switch in the load-balance-profile configuration mode.

 
Example
These commands configure symmetric hashing on all traffic distributed through the algorithm defined by the LB-1 load balance profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-1
switch(config-load-balance-profile-LB-1)# distribution symmetric-hash mac-ip
switch(config-load-balance-profile-LB-1)# show active
load-balance policies
   load-balance fm6000 profile LB-1
      distribution symmetric-hash mac-ip
switch(config-load-balance-profile-LB-1)#

fields ip

The fields ip command specifies the L3/L4 data fields used by the hash algorithm defined by the configuration mode load balance profile. When a load balance profile is assigned to a port channel or Ethernet interface, its associated hash algorithm determines the distribution of packets that ingress the interface. Profile algorithms can load balance packets across port channel links or ECMP routes.

The switch calculates a hash value by using the packet header fields to balance packets across links. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no fields ip configures the algorithm not to use L3/L4 data fields. The default fields ip command restores the default data L3/L4 fields to the load balancing algorithm defined by the configuration mode profile by removing the corresponding fields ip or no fields ip command from running-config.

 

Command Mode

Load-balance-profile Configuration

 

Command Syntax

fields ip IP_FIELD

no fields ip

default fields ip

 

Parameters

IP_FIELD       Specifies the L3/L4 fields the hashing algorithm uses. Options include:
  • dscp      Algorithm uses dscp field.
  • dst-ip      Algorithm uses destination IP address field.
  • dst-port      Algorithm uses destination TCP/UDP port field.
  • protocol      Algorithm uses protocol field.
  • src-ip      Algorithm uses source IP address field.
  • src-port      Algorithm uses source TCP/UDP port field.

     

Command may include from one to six fields, in any combination and listed in any order. The default setting is the selection of all fields.

 

Related Commands

load-balance fm6000 profile places the switch in the load-balance-profile configuration mode.

 
Example
These commands specify the IP source and protocol fields as components of the hash algorithm defined by the LB-1 load balance profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-1
switch(config-load-balance-profile-LB-1)# fields ip src-ip protocol
switch(config-load-balance-profile-LB-1)# show active
load-balance policies
   load-balance fm6000 profile LB-1
      fields ip protocol src-ip
switch(config-load-balance-profile-LB-1)#

fields mac

The fields mac command specifies the L2 data fields used by the hash algorithm defined by the configuration mode load balance profile. When a load balance profile is assigned to a port channel or Ethernet interface, its associated hash algorithm determines the distribution of packets that ingress the interface. Profile algorithms can load balance packets across port channel links or ECMP routes.

The switch calculates a hash value using the packet header fields to balance packets across links. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no fields mac configures the algorithm not to use L2 data fields. The default fields mac command restores the default data L2 fields to the load balancing algorithm defined by the configuration mode profile by removing the corresponding fields mac or no fields mac command from running-config.

 

Command Mode

Load-balance-profile Configuration

 

Command Syntax

fields mac MAC_FIELD

no fields mac

default fields mac

 

Parameters

MAC_FIELD       Specifies the L2 fields the hashing algorithm uses. Options include:
  • dst-mac      Algorithm uses the MAC destination field.
  • eth-type      Algorithm uses the Ethernet port type field.
  • src-mac      Algorithm uses MAC source field.
  • vlan-id      Algorithm uses VLAN ID field.
  • vlan-priority      Algorithm uses VLAN priority field.

     

Related Commands

The load-balance fm6000 profile command places the switch in to the load-balance-profile configuration mode.

 
Example
These commands specify the MAC destination and VLAN priority fields as components of the hash algorithm defined by the LB-1 load balance profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-1
switch(config-load-balance-profile-LB-1)# fields mac dst-mac vlan-priority
switch(config-load-balance-profile-LB-1)# show active
load-balance policies
   load-balance fm6000 profile LB-1
      fields mac dst-mac vlan-priority
switch(config-load-balance-profile-LB-1)#

hash-seed

The hash-seed command specifies the seed used by the hash algorithm defined by the configuration mode load balance profile. Profile algorithms can load balance packets across port channel links or ECMP routes.

The no hash-seed and default hash-seed commands restore the default hash seed value of 0 to the load balancing algorithm defined by the configuration mode profile by removing the corresponding hash-seed command from running-config.

 

Command Mode

Load-balance-profile Configuration

 

Command Syntax

hash-seed number

no hash-seed number

default hash-seed number

 

Parameters

number      Specifies the value of the hash seed. Value ranges from 0 to 39.

 
Example
These commands configure the hash seed 20 in a profile and assign it as the global profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance sand profile myGlobalProfile
switch(config-sand-load-balance-profile-myGlobalProfile)# hash-seed 20
switch(config)# port-channel load-balance sand profile myGlobalProfile

ingress load-balance profile

The ingress load-balance profile command applies the specified load-balance profile to the configuration mode interface. Load balance profiles specify parameters used by hashing algorithms that distribute traffic across ports comprising a port channel or among ECMP routes. The switch supports 16 load balance profiles, including the default profile.

Load balance profiles can be assigned to Ethernet and port channel interfaces. Profiles define the distribution method of traffic that ingresses the interface among the ports comprising a port channel or routes comprising an ECMP.

The default load balance profile is configured through port-channel load-balance fm6000 fields ip and port-channel load-balance fm6000 fields mac commands.

The no ingress load-balance profile and default ingress load-balance profile commands restore the default load balance profile for the configuration mode interface by removing the corresponding ingress load-balance profile command from running-config.

 

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

 

Command Syntax

ingress load-balance profile profile_name

no ingress load-balance profile

default ingress load-balance profile

 

Parameters

profile_name      Name of profile assigned to interface.

 
Example
This command applies the LB-1 load balance profile to port channel interface 100.
switch(config)# interface port-channel 100
switch(config-if-Po100)# show active
interface Port-Channel100

switch(config-if-Po100)# ingress load-balance profile LB-1
switch(config-if-Po100)#
interface Port-Channel100
   ingress load-balance profile LB-1

switch(config-if-Po100)#

interface port-channel

The interface port-channel command places the switch in port-channel interface configuration mode for modifying parameters of specified link aggregation (LAG) interfaces. When entering configuration mode to modify existing port channel interfaces, the command can specify multiple interfaces.

The command creates a port channel interface if the specified interface does not exist prior to issuing the command. When creating an interface, the command can only specify a single interface.

The no interface port-channel and default interface port-channel commands delete the specified LAG interfaces from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

interface port-channel p_range

no interface port-channel p_range

default interface port-channel p_range

 

Parameter

p_range  Port channel interfaces (number, range, or comma-delimited list of numbers and ranges).

Port channel numbers range from 1 to 2000.

 

Guidelines

When configuring a port channel, you do not need to issue the interface port-channel command before assigning a port to the port channel (see the channel-groupcommand). The port channel number is implicitly created when a port is added to the specified port channel with the channel-group number command.

To display ports that are members of a port channel, enter show port-channel. To view information about hardware limitations for a port channel, enter show port-channel limits.

All active ports in a port channel must be compatible. Compatibility comprises many factors and is specific to a given platform. For example, compatibility may require identical operating parameters such as speed and/or Maximum Transmission Unit (MTU). Compatibility may only be possible between specific ports because of internal organization of the switch.

You can configure a port channel with a set of ports such that more than one subset of the member ports are mutually compatible. Port channels in EOS are designed to activate the compatible subset of ports with the largest aggregate capacity. A subset with two 40 Gbps ports (aggregate capacity 80 Gbps) has preference to a subset with five active 10 Gbps ports (aggregate capacity 50 Gbps).

 
Example
This example creates interface port-channel 3:
switch(config)# interface port-channel 3
switch(config-if-Po3)#

lacp port-priority

The lacp port-priority command sets the aggregating port priority for the configuration mode interface. Priority is supported on port channels with LACP-enabled physical interfaces. LACP port priority determines the port that is active in a LAG in fallback mode. Numerically lower values have higher priority.

Each port in an aggregation is assigned a 32-bit port identifier by prepending the port priority (16 bits) to the port number (16 bits). Port priority determines the ports that are placed in standby mode when hardware limitations prevent a single aggregation of all compatible ports.

Priority numbers range from 0 to 65535. The default is 32768. Interfaces with higher priority numbers are placed in standby mode before interfaces with lower priority numbers.

The no lacp port-priority and default lacp port-priority commands restore the default port-priority to the configuration mode interface by removing the corresponding lacp port-priority command from running-config.

 

Command Mode

Interface-Ethernet Configuration

 

Command Syntax

lacp port-priority priority_value

no lacp port-priority

default lacp port-priority

 

Parameters

priority_level Port priority. Values range from 0 to 65535. Default is 32768

 
Example
These commands assign the port priority of 4096 to interface ethernet 8.
switch(config)# interface ethernet 8
switch(config-if-Et8)# lacp port-priority 4096
switch(config-if-Et8)# show active
interface Ethernet8
   lacp port-priority 4096
switch(config-if-Et8)#

lacp system-priority

The lacp system-priority command configures the switch’s LACP system priority. Values range between 0 and 65535. Default value is 32768.

Each switch is assigned a globally unique 64-bit system identifier by prepending the system priority (16 bits) to the MAC address of one of its physical ports (48 bits). Peer devices use the system identifier when forming an aggregation to verify that all links are from the same switch. The system identifier is also used when dynamically changing aggregation capabilities resulting from LACP data; the system with the numerically lower system identifier can dynamically change advertised aggregation parameters.

The no lacp system-priority and default lacp system-priority commands restore the default system priority by removing the lacp system-priority command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

lacp system-priority priority_value

no lacp system-priority

default lacp system-priority

 

Parameters

priority_value System priority number. Values range from 0 to 65535. Default is 32768.

 
Example
This command assigns the system priority of 8192 to the switch.
switch(config)# lacp system-priority 8192
switch(config)#

lacp timer

The lacp timer command configures the LACP reception interval on the configuration mode interface. The LACP timeout specifies the reception rate of LACP packets at interfaces supporting LACP. Supported rates include:
  • normal: 30 seconds with synchronized interfaces; one second while interfaces are synchronizing.

     

  • fast: one second.

     

This command is supported on LACP-enabled interfaces. The default value is normal.

The no lacp timer and default lacp timer commands restore the default value of normal on the configuration mode interface by deleting the corresponding lacp timer command from running-config.

 

Command Mode

Interface-Ethernet Configuration

 

Command Syntax

lacp timer RATE_LEVEL

no lacp timer

default lacp timer

 

Parameters

RATE_LEVEL LACP reception interval. Options include:
  • fast One second.

     

  • normal 30 seconds for synchronized interfaces; 1 second while interfaces synchronize.

     

 
Example
This command sets the LACP timer to 1 second on ethernet interface 4.
switch(config-if-Et4)# lacp timer fast
switch(config-if-Et4)#

load-balance fm6000 profile

The load-balance fm6000 profile command places the switch in load-balance-profile configuration mode to configure a specified load balance profile. The command specifies the name of the profile that subsequent commands modify. It creates a profile if the profile it references does not exist.

Load balance profiles specify parameters used by hashing algorithms that distribute traffic across ports comprising a port channel or among component ECMP routes. The switch supports 16 load balance profiles, including the default profile. The default load balance profile is configured through port-channel load-balance fm6000 fields ip and port-channel load-balance fm6000 fields mac commands.

The load balance profile name is referenced when it is applied to an interface. The default profile is not associated with a name and is applied to an interface in the absence of a named profile assignment.

The no load-balance fm6000 profile and default load-balance fm6000 profile commands delete the specified load balance profile from running-config. Profiles that are assigned to an interface cannot be deleted. Attempts to delete an assigned profile generate a profile in use error messages.

The load-balance fm6000 profile command is accessible from load-balance-policies configuration mode. The load-balance-profile configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting the load-balance-policies configuration mode does not affect the configuration. The exit command returns the switch to the load-balance-policies configuration mode.

 

Command Mode

Load-balance-policies Configuration

 

Command Syntax

load-balance fm6000 profile profile_name

no load-balance fm6000 profile profile_name

default load-balance fm6000 profile profile_name

 

Parameters

profile_name      Name of the load-balance profile.

 

Commands Available in Load-balance-profile Configuration Mode
Related Commands
Example
These commands enters the load-balance-profile configuration mode, creates the LB-1 profile, and lists the default settings for the profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-1
switch(config-load-balance-profile-LB-1)# show active all
load-balance policies
   load-balance fm6000 profile LB-1
      port-channel hash-seed 0
      fields mac dst-mac src-mac eth-type vlan-priority vlan-id
      fields ip protocol dst-ip dst-port src-ip src-port dscp
      no distribution symmetric-hash
      no distribution random
switch(config-load-balance-profile-LB-1)#

load-balance policies

The load-balance policies command places the switch in load-balance-policies configuration mode. Load-balance-policies configuration mode provides commands for managing load-balance profiles. Load balance profiles specify the inputs used by the hashing algorithms that distribute traffic across ports comprising a port channel or among ECMP routes.

The no load-balance policies and default load-balance policies commands delete all load balance profiles from running-config. The command generates an error message when at least one profile is assigned to an interface.

Load-balance-policies configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting the load-balance-policies configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.

 

Command Mode

Global Configuration

 

Command Syntax

load-balance policies

no load-balance policies

default load-balance policies

 

Commands Available in Load-balance-policies Configuration Mode
  • load-balance fm6000 profile places the switch in load-balance-profile configuration mode.

     

  • show active displays contents of all load balance profiles.

     

Related Commands
Examples
  • This command places the switch in the load-balance-policies configuration mode.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)#

     

  • This command displays the contents of the three configured load balance profiles.
    switch(config-load-balance-policies)# show active
    
    load-balance policies
       load-balance fm6000 profile F-01
          port-channel hash-seed 22
          fields ip dscp
          distribution random port-channel
       !
       load-balance fm6000 profile F-02
          fields ip protocol dst-ip
          fields mac dst-mac eth-type
          distribution random ecmp port-channel
       !
       load-balance fm6000 profile F-03
    
    switch(config-load-balance-policies)#

load-balance sand profile (7500E/7500R)

The load-balance sand profile command configures a load-balance profile on a sand module switch. A default profile is designated as a global profile when no other profile is set as global profile. Note, a warning message is displayed when a profile is entered or deleted.

If no load-balance sand profile command is executed when the profile set is default then the following warning message is displayed:
! profile default is a reserved profile and cannot be deleted

 

Command Mode

Global Configuration

 

Command Syntax

load-balance sand profile profile_name

no load-balance sand profile profile_name

 

Parameter

profile_name Name of the profile assigned to the selected module.

 
Examples
  • These commands designate a default profile as a global profile on sand module platform switch. Note, a warning message is displayed when a profile is entered or deleted.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# load-balance sand profile default
     ! profile default is a reserved profile
    ! profile default is the current global profile

     

  • When no form of the command is executed it displays the following warning message.
    switch(config)# load-balance policies
    switch(config-load-balance-policies)# no load-balance sand profile default
    ! profile default is a reserved profile and cannot be deleted

monitor session destination

The monitor session destination configures Port Channel interfaces as a mirroring destination for both ingress and egress traffic.

The no | default versions of the command removes the configuration from the running-configuration.

Command Mode

Global Configuration

Command Syntax

monitor session session_name destination Port-Channel interface_number

Parameters

  • session session_name - Configure a name for the session.
  • destination - Specify the mirroring for Port Channel traffic as the destination.
  • Port-Channel interface_number - Specify the Port Channel to be the destination.

Example

Use the following command to configure Port Channel 1 as a mirroring destination:

switch(config)#monitor session 1 destination Port-Channel 1

monitor session source

The monitor session source configures Port Channel interfaces as a mirroring source for both ingress and egress traffic.

The no | default versions of the command removes the configuration from the running-configuration.

Command Mode

Global Configuration

Command Syntax

monitor session session_name source interface_number

Parameters

  • session session_name - Configure a name for the session.
  • source - Specify the mirroring for Port Channel traffic as the source.
  • interface_number - Specify the Ethernet interface to be the source of the ingress and egress traffic.

Example

Use the following command to configure a session, testmember with the Ethernet interface Et3/3/1:

switch(config)#monitor session testmember source Et3/3/1

port-channel hash-seed

The port-channel hash-seed command specifies the seed used by the hash algorithm defined by the configuration mode load balance profile when distributing the load across ports comprising a port channel. When a load balance profile is assigned to a port channel or Ethernet interface, its associated hash algorithm determines the distribution of packets that ingress the interface. Profile algorithms can load balance packets across port channel links or ECMP routes.

The hash seed that the algorithm uses to select port channel links or ECMP routes is configured by the ip load-sharing command.

The no port-channel hash-seed and default port-channel hash-seed commands restore the default hash seed value of 0 to the load balancing algorithm defined by the configuration mode profile by removing the corresponding port-channel hash-seed command from running-config.

 

Command Mode

Load-balance-profile Configuration

 

Command Syntax

port-channel hash-seed number

no port-channel hash-seed

default port-channel hash-seed

 

Parameters

number The hash seed. Value ranges from 0 to 39.

 

Related Commands

The load-balance fm6000 profile command places the switch in to the load-balance-profile configuration mode.

 
Example
These commands configure the port-channel hash seed of 22 for the hash algorithm defined by the LB-1 load balance profile.
switch(config)# load-balance policies
switch(config-load-balance-policies)# load-balance fm6000 profile LB-1
switch(config-load-balance-profile-LB-1)# port-channel hash-seed 22
switch(config-load-balance-profile-LB-1)# show active
load-balance policies
   load-balance fm6000 profile LB-1
      port-channel hash-seed 22
switch(config-load-balance-profile-LB-1)#

port-channel lacp fallback

The port-channel lacp fallback command enables the LACP fallback mode on the interface.

LACP fallback is unconfigured and disabled by default. An LACP interface without fallback enabled does not form a LAG until it receives PDUs from its peer.

LACP fallback can be configured on an interface in static or individual mode:
  • static mode      The port channel member with the lowest LACP port priority is active and maintains contact with the peer (sending and receiving data) while other port channel members remain in standby mode until a LACP PDU is received. All members continue to send (and can receive) LACP PDUs.

     

  • individual mode      All port channel members act as individual ports, reverting to their port-specific configuration while the channel is in fallback mode, and continue to send and receive data. All members continue to send LACP PDUs until a LACP PDU is received by one of the member ports.

     

The no port-channel lacp fallback and default port-channel lacp fallback commands disable LACP fallback mode on the configuration mode interface by removing the corresponding port-channel lacp fallback command from running-config.

 

Command Mode

Interface-Port-Channel Configuration

 

Command Syntax

port-channel lacp fallback [MODE]

no port-channel lacp fallback

default port-channel lacp fallback

 

Parameters

MODE LACP fallback mode. Options include:
  • no parameter Enables static LACP fallback mode.
    • static Enables static LACP fallback mode.
    • individual Enables individual LACP fallback mode.

       

Related Commands
  • The port-channel lacp fallback timeout command configures the fallback timeout period for a port channel interface. The default LACP fallback timeout period is 90 seconds.

     

  • The lacp port-priority command configures the port priority for an individual interface.

     

 
Examples
  • These commands enable LACP static fallback mode, then configure an LACP fallback timeout of 100 seconds on interface port-channel 13. If LACP negotiation fails, only the member port with the lowest LACP priority will remain active until an LACP PDU is received by one of the member ports.
    switch(config)# interface port-channel 13
    switch(config-if-Po13)# port-channel lacp fallback static
    switch(config-if-Po13)# port-channel lacp fallback timeout 100
    switch(config-if-Po13)# show active
    interface Port-Channel13
       port-channel lacp fallback static
       port-channel lacp fallback timeout 100
    switch(config-if-Po13)#

     

  • These commands enable LACP individual fallback mode, then configure an LACP fallback timeout of 50 seconds on interface port-channel 17. If LACP negotiation fails, all member ports will act as individual switch ports, using port-specific configuration, until a LACP PDU is received by one of the member ports.
    switch(config)# interface port-channel 17
    switch(config-if-Po17)# port-channel lacp fallback individual
    switch(config-if-Po17)# port-channel lacp fallback timeout 50
    switch(config-if-Po17)# show active
    interface Port-Channel17
       port-channel lacp fallback individual
       port-channel lacp fallback timeout 50
    switch(config-if-Po17)#

port-channel lacp fallback timeout

The port-channel lacp fallback timeout command specifies the fallback timeout period for the configuration mode interface.

Fallback timeout settings persist in running-config without taking effect for interfaces that are not configured into fallback mode. The default fallback timeout period is 90 seconds.

The no port-channel lacp fallback timeout and default port-channel lacp fallback timeout commands restore the default fallback timeout of 90 seconds for the configuration mode interface by removing the corresponding port-channel lacp fallback timeout command from running-config.

 

Command Mode

Interface-Port-Channel Configuration

 

Command Syntax

port-channel lacp fallback timeout period

no port-channel lacp fallback timeout

default port-channel lacp fallback timeout

 

Parameters

period Maximum interval between receipt of LACP PDU packets (seconds). Value ranges from 1 to 300 seconds. Default value is 90.

 

Related Commands

The port-channel lacp fallback command configures fallback mode for a port channel interface.

 

Guidelines

The fallback timeout period should not be shorter than the LACP reception interval (lacp timer). The default LACP reception interval is 30 seconds.

 
Example
This command enables LACP fallback mode, then configures an LACP fallback timeout of 100 seconds on interface port-channel 13.
switch(config)# interface port-channel 13
switch(config-if-Po13)# port-channel lacp fallback
switch(config-if-Po13)# port-channel lacp fallback timeout 100
switch(config-if-Po13)# show active
interface Port-Channel13
   port-channel lacp fallback
   port-channel lacp fallback timeout 100
switch(config-if-Po13)#

port-channel load-balance

The port-channel load-balance command specifies the seed in the hashing algorithm that balances the load across ports comprising a port channel. Available seed values vary by switch platform.

The no port-channel load-balance and default port-channel load-balance commands remove the port-channel load-balance command from running-config, restoring the default hash seed value of 0.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance platform { hash_seed | fields ip fields | hash hash_function }

no port-channel load-balance platform [ hash_seed ]

default port-channel load-balance platform [ hash_seed ]

 

Parameters

 

Note: Parameter options vary by switch model. Verify available options with the ? command.

 

  • platform ASIC switching device. Value depends on the switch model.
  • hash_seed The numerical seed for the hash function. Value range varies by switch platform:
    • arad 0 to 65535.
    • fm6000 0 to 39.
    • petraA Uses field inputs only.
    • trident 0 to 47.

       

    For trident platform switches, algorithms using hash seeds between 0 and 15 typically result in more effective distribution of data streams across the port channels.

  • fields Which fields will be used as inputs to the port channel hash.
    • gre Configure which GRE fields are inputs to the hash.
    • ip Configure which fields are inputs to the hash for IPv4 packets.
    • ipv6 Configure which fields are inputs to the hash for IPv6 packets.
    • mac Configure which MAC fields are inputs to the hash.
    • mac-in-mac Configure which MAC-in-MAC fields are inputs to the hash.
    • mpls Configure which MPLS fields are inputs to the hash.
    • destination-ip Use the Layer 3 IP destination address in the hash.
    • destination-port Use the Layer 4 TCP/UDP destination port in the hash.
    • dst-ip Use the destination IP address in the hash.
    • dst-mac Use the destination Payload MAC in the hash (or the destination MAC address in the MAC hash).
    • eth-type Use the Ethernet type in the MAC hash.
    • ip-in-ip Use the outer IP header in the hash for IPv4 over IPv4 GRE tunnel.
    • ip-in-ipv6 Use the outer IP header in the hash for IPv4 over IPv6 GRE tunnel.
    • ipv6-in-ip Use the outer IP header in the hash for IPv6 over IPv4 GRE tunnel.
    • ipv6-in-ipv6 Use the outer IP header in the hash for IPv6 over IPv6 GRE tunnel.
    • ip-tcp-udp-header Use the Layer 3 and Layer 4 hashes.
    • isid Use the MAC-in-MAC ISID in the hash.
    • label Use the MPLS label in the hash.
    • mac-header Use the MAC hash.
    • outer-mac Use the outer MAC of source and destination in the hash.
    • source-ip Use the Layer 3 IP source address in the hash.
    • src-ip Use the source IP address in the hash.
    • source-port Use l\Layer 4 TCP/UDP source port in the hash.
    • src-mac Use the source payload MAC in the hash (or the source MAC address in the MAC hash).

       

  • hash_function Specifies the hash polynomial function. Values range from 0-2.

     

 
Example
This command configures a hash seed of 10 on an FM6000 platform switch.
switch(config)# port-channel load-balance fm6000 10
switch(config)#

port-channel load-balance arad fields ip

The port-channel load-balance arad fields ip command specifies the data fields that the port channel load balance hash algorithm uses for distributing IP packets on Arad platform switches. The hashing algorithm fields used for IP packets differ from the fields used for non-IP packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance arad fields ip and default port-channel load-balance arad fields ip commands restore the default data fields for the IP packet load balancing algorithm by removing the port-channel load-balance arad A fields ip command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance arad fields ip IP_FIELD_NAME

no port-channel load-balance arad fields ip

default port-channel load-balance arad fields ip

 

Parameters

IP_FIELD_NAME      Fields the hashing algorithm uses for Layer 3 routing. Options include:
  • ip-tcp-udp-header  Algorithm uses source and destination IP address fields. Source and destination port fields are included for TCP and UDP packets.
    • mac-header  Algorithm uses entire MAC header.

      A command can only specify one option. The default setting is ip-tcp-udp-header.

       

Guidelines

The port channel hash algorithm for non-IP packets is not configurable and always includes the entire MAC header.

 

Related Command

The port-channel load-balance command configures the hash seed for the algorithm.

 

Example
These commands configure the switch’s port channel load balance hash algorithm for IP packets to use source and destination IP address (and port) fields.
switch(config)# port-channel load-balance fm6000 fields ip ip-tcp-udp-header
switch(config)#

port-channel load-balance fm6000 fields ip

The port-channel load-balance fm6000 fields ip command specifies the data fields that the port channel load balance hash algorithm uses for distributing IP packets on FM6000 platform switches. The hashing algorithm fields used for IP packets differ from the fields used for non-IP packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance fm6000 fields ip and default port-channel load-balance fm6000 fields ip commands restore the default data fields for the IP packet load balancing algorithm by removing the port-channel load-balance fm6000 fields ip command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance fm6000 fields ip IP_FIELD_NAME

no port-channel load-balance fm6000 fields ip

default port-channel load-balance fm6000 fields ip

 

Parameters

IP_FIELD_NAME       Specifies fields the hashing algorithm uses for layer 3 routing. Options include:
  • ip-tcp-udp-header  Algorithm uses source and destination IP address fields. Source and destination port fields are included for TCP and UDP packets.

     

A command can only specify one option. The default setting is ip-tcp-udp-header.

 

Related Commands
Example
These commands configure the switch’s port channel load balance for IP packets by source and destination IP address and port fields.
switch(config)# port-channel load-balance fm6000 fields ip ip-tcp-udp-header
switch(config)#

port-channel load-balance fm6000 fields mac

The port-channel load-balance fm6000 fields mac command specifies data fields that configure the port channel load balance hash algorithm for non-IP packets on FM6000 platform switches. The hashing algorithm fields used for balancing non-IP packets differ from the fields used for IP packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance fm6000 fields mac and default port-channel load-balance fm6000 fields mac commands restore the default data fields for the non-IP packet load balancing algorithm by removing the port-channel load-balance fm6000 fields mac command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance fm6000 fields mac MAC_FIELD_NAME

no port-channel load-balance fm6000 fields mac

default port-channel load-balance fm6000 fields mac

Parameters

 

MAC_FIELD_NAME Fields the hashing algorithm uses for Layer 2 routing. Options include:
  • dst-mac MAC destination field.
  • eth-type EtherType field.
  • src-mac MAC source field.
  • vlan-id VLAN ID field.
  • vlan-priority VLAN priority field.

     

Command may include from one to five fields, in any combination and listed in any order. The default setting is the selection of all fields.

Related Commands
Example
These commands configure the switch’s port channel load balance for non-IP packets by using the MAC destination and Ethernet type fields in the hashing algorithm.
switch(config)# port-channel load-balance fm6000 fields mac dst-mac eth-type 
switch(config)#

port-channel load-balance module

The port-channel load-balance module command assigns a named load-balancing profile to a linecard.

 

Note: Available on the 7500E platform.

 

The no port-channel load-balance module and default port-channel load-balance module commands unassigns the load balancing module, or restores the default data fields for the load balancing module.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance module LINECARD_RANGE sand profile PROFILE_NAME

no port-channel load-balance module LINECARD_RANGE sand profile PROFILE_NAME

default port-channel load-balance module LINECARD_RANGE sand profile PROFILE_NAME

 

Parameters
  • LINECARD_RANGE Linecard number range includes:
    • 3-10 Linecard number range.

       

  • PROFILE_NAME Load-balance profile name.

     

 
Examples
  • This command assigns a named load-balancing profile to a linecard.
    switch(config)# port-channel load-balance module 3-7 sand profile Linecard5
    switch(config)#

     

  • This command unassigns a named load-balancing profile to a linecard.
    switch(config)# no port-channel load-balance module 3-7 sand profile Linecard5
    switch(config)#

     

port-channel load-balance petraA fields ip

The port-channel load-balance petraA fields ip command specifies the data fields that the port channel load balance hash algorithm uses for distributing IP packets on Petra platform switches. The hashing algorithm fields used for IP packets differ from the fields used for non-IP packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance petraA fields ip and default port-channel load-balance petraA fields ip commands restore the default data fields for the IP packet load balancing algorithm by removing the port-channel load-balance petraA fields ip command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance petraA fields ip IP_FIELD_NAME

no port-channel load-balance petraA fields ip

default port-channel load-balance petraA fields ip

 

Parameters

IP_FIELD_NAME Fields the hashing algorithm uses for Layer 3 routing. Options include:
  • ip-tcp-udp-header Algorithm uses source and destination IP address fields. Source and destination port fields are included for TCP and UDP packets.
  • mac-header Algorithm uses entire MAC header.

     

A command can only specify one option. The default setting is ip-tcp-udp-header.

 

Guidelines

The port channel hash algorithm for non-IP packets is not configurable and always includes the entire MAC header.

 

Related Command

The port-channel load-balance command configures the hash seed for the algorithm.

 

Example
These commands configure the switch’s port channel load balance hash algorithm for IP packets to use source and destination IP address (and port) fields.
switch(config)# port-channel load-balance fm6000 fields ip ip-tcp-udp-header
switch(config)#

port-channel load-balance sand profile (7500E/7500R)

The port-channel load-balance sand profile command configures a global LAG hashing profile on the port channel interface. A default profile is set as a global profile when no other profile is set as global.

The no port-channel load-balance sand profile command removes the active profile from the port-channel load-balance command from running-config, restoring the default profile.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance sand profile profile_name

no port-channel load-balance sand profile profile_name

 

Parameter

profile_name Name of the profile assigned to the selected module.

 

Example
This command configures a global LAG hashing profile on 7500 series platform switch.
switch(config)# port-channel load-balance sand profile myGlobalProfile
switch(config)#

port-channel load-balance trident fields ip

The port-channel load-balance trident fields ip command specifies the data fields that the port channel load balance hash algorithm uses for distributing IP packets on Trident platform switches. The hashing algorithm fields used for IP packets differ from the fields used for non-IP packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance trident fields ip and default port-channel load-balance trident fields ip commands restore the default data fields for the IP packet load balancing algorithm by removing the port-channel load-balance trident fields ip command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance trident fields ip IP_FIELD_NAME

no port-channel load-balance trident fields ip

default port-channel load-balance trident fields ip

default port-channel load-balance trident fields ip ingress-interface disabled

 

Parameters
  • IP_FIELD_NAME Specifies fields the hashing algorithm uses for Layer 3 routing. Command may include from one to four of the following four options, in any combination and listed in any order.
    • destination-ip Algorithm uses destination IP address field.
    • source-ip  Algorithm uses source IP address field.
    • destination-port Agorithm uses destination TCP/UDP port field.
    • source-port Algorithm uses source TCP/UDP port field.
      • ip-tcp-udp-header  Algorithm uses source and destination IP address fields. Source and destination port fields are included for TCP and UDP packets.

         

        Note: This option cannot be used in combination with any other option.

         

    • mac-header  Algorithm uses fields specified by port-channel load-balance trident fields mac.

       

      Note: This option cannot be used in combination with any other option.

       

    • ingress-interface Disable from LAG hashing.

       

Default setting is ip-tcp-udp-header.

 

Related Commands

 

Examples
  • These commands configure the switch’s port channel load balance for IP packets by using the IPv6 destination field in the hashing algorithm.
    switch(config)# port-channel load-balance trident fields ip destination-ip
    switch(config)#

     

  • This command disables the ingress interface for IPv4 traffic.
    switch(config)# port-channel load-balance trident fields ip ingress-interface disabled
    switch(config)#

port-channel load-balance trident fields ipv6

The port-channel load-balance trident fields ipv6 command specifies the data fields that the port channel load balance hash algorithm uses for distributing IPv6 packets on Trident platform switches. The hashing algorithm fields used for IPv6 packets differ from the fields used for non-IPv6 packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance trident fields ipv6 and default port-channel load-balance trident fields ipv6 commands restore the default data fields for the IPv6 packet load balancing algorithm by removing the port-channel load-balance trident fields ipv6 command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance trident fields ipv6 IP_FIELD_NAME

no port-channel load-balance trident fields ipv6

default port-channel load-balance trident fields ipv6

 

Parameters
  • IP_FIELD_NAME Specifies fields the hashing algorithm uses for Layer 3 routing. Command may include from one to four of the following four options, in any combination and listed in any order.
    • destination-ip Algorithm uses destination IPv6 address field.
    • source-ip  Algorithm uses source IPv6 address field.
    • destination-port  Algorithm uses destination TCP/UDP port field.
    • source-port Algorithm uses source TCP/UDP port field.
      • ip-tcp-udp-header  Algorithm uses source and destination IPv6 address fields. Source and destination port fields are included for TCP and UDP packets.

         

        Note: This option can’t be used in combination with any other option.

         

      • mac-header  Algorithm uses fields specified by port-channel load-balance trident fields mac.

         

        Note: This option can’t be used in combination with any other option.

         

      • ingress-interface Disable from LAG hashing.

         

      Default setting is ip-tcp-udp-header

       

Related Commands
Examples
  • These commands configure the switch’s port channel load balance for IP packets by using the IPv6 source field in the hashing algorithm.
    switch(config)# port-channel load-balance trident fields ipv6 source-ip
    switch(config)#

     

  • This command disables the ingress interface for IPv6 traffic.
    switch(config)# port-channel load-balance trident fields ipv6 ingress-interface disabled
    switch(config)#

port-channel load-balance trident fields mac

The port-channel load-balance trident fields mac command specifies data fields that the port channel load balance hash algorithm uses for distributing non-IP packets on Trident platform switches. The hashing algorithm fields used for non-IP packets differ from the fields used for IP packets.

The switch calculates a hash value using the packet header fields to load balance packets across links in a port channel. The hash value determines the link through which the packet is transmitted. This method also ensures that all packets in a flow follow the same network path. Packet flow is modified by changing the inputs to the port channel hash algorithm.

In network topologies that include MLAGs, programming all switches to perform the same hash calculation increases the risk of hash polarization, which leads to uneven load distribution among LAG and MLAG member links in MLAG switches. This problem is avoided by performing different hash calculations between the MLAG switch, and a non-peer switch connected to it.

The no port-channel load-balance trident fields mac and default port-channel load-balance trident fields mac commands restore the default data fields for the non-IP packet load balancing algorithm by removing the port-channel load-balance trident fields mac command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel load-balance trident fields mac MAC_FIELD_NAME

no port-channel load-balance trident fields mac

default port-channel load-balance trident fields mac

default port-channel load-balance trident fields mac ingress-interface disabled

 

Parameters
  • MAC_FIELD_NAME Fields the hashing algorithm uses for Layer 2 routing. Options include:
    • dst-mac MAC destination field.
    • eth-type EtherType field.
    • src-mac MAC source field.
    • ingress-interface Disable from LAG hashing.

       

    Command may include from one to three fields, in any combination and listed in any order. The default setting is the selection of all fields.

     

Related Commands
Examples
  • These commands configure the switch’s port channel load balance for non-IP packets by using the MAC destination and Ethernet type fields in the hashing algorithm.
    switch(config)# port-channel load-balance trident fields mac dst-mac eth-type  
    switch(config)#

     

  • This command disables the ingress interface for IPv4 traffic.
    switch(config)# port-channel load-balance trident fields mac ingress-interface disabled
    switch(config)#

port-channel min-links

The port-channel min-links command specifies the minimum number of interfaces that the configuration mode LAG requires to become active. If there are fewer ports than specified by this command, the port channel interface does not become active. The default min-links value is 0.

The no port-channel min-links and default port-channel min-links commands restore the default min-links setting for the configuration mode LAG by removing the corresponding port-channel min-links command from the configuration.

 

Note: In static LAGs, the min-links value must be met for the LAG to be active. The LAG will not become active until it has at least the min-links number of functioning links in the channel group. If failed links cause the number to drop below the minimum, the LAG will go down and administrator action will be required to bring it back up. In dynamic LAGs, the LACP protocol must determine that at least min-links physical ports are aggregable (they are physically compatible and have the same keys both remotely and locally) before it begins negotiating to make any ports active members of the port-channel. However once negotiation begins, an error on the partner’s side or an error in programming of member interfaces can cause the LAG to become active with fewer than the minimum number of links. EOS evaluates min-links after min-links-review-timeout (linearly proportional to configured min-links) when LACP protocol collecting and/or distributing state changes. If the number of active member interfaces in a port-channel is less than configured min-links, it brings the corresponding port-channel Link Down and syslogs LAG-4-MINLINK_INTF_INSUFFICIENT message. If additional interfaces get programmed as collecting and distributing, EOS re-evaluates min-links on the port-channel. If sufficient number of interfaces are available to be a part of port-channel, then all interfaces of the corresponding port-channel are re-enabled for LACP negotiation and the port-channel becomes Link Up. LAG-4-MINLINK_INTF_NORMAL is syslogged after min-links-review-timeout if the min-links condition is satisfied; otherwise LAG-4-MINLINK_INTF_INSUFFICIENT is syslogged and the port-channel goes Link Down. If an interface remains in collecting state but not in distributing state for min-links-review-timeout, it is moved out of collecting state. It is periodically re-enabled after min-links-retry-timeout (which is 360s seconds) till it progresses to collecting and distributing. Meanwhile, if a port-channel becomes Link Up because sufficient number of interfaces progressed to collecting and distributing states, then this interface is enabled for LACP negotiation.

 

Command Mode

Interface-Port-Channel Configuration

 

Command Syntax

port-channel min-links quantity

no port-channel min-links

default port-channel min-links

 

Parameters

quantity Minimum number of interfaces. Value range varies by platform. Default value is 0.

 

Example
These commands set 4 as the minimum number of ports required for port channel 13 to become active.
switch(config)# interface port-channel 13
switch(config-if-Po13)# port-channel min-links 4
switch(config-if-Po13)# show active
interface Port-Channel13
   port-channel min-links 4
switch(config-if-Po13)#

port-channel min-links review interval

The port-channel min-links review interval command enables or disables timer based min-links review feature for all port-channels.

The no port-channel min-links review interval and default port-channel min-links review intervalcommands restore the default min-links-timeout-base to 180 seconds by removing the corresponding port-channel min-links review interval command from running-config.

 

Command Mode

Global Configuration

 

Command Syntax

port-channel min-links review interval timeout (seconds)

no port-channel min-links review interval

default port-channel min-links review interval

 

Guidelines

The min-links-timeout-base interval for port-channels can be set within the range of 0 to 600 seconds. When setting the review interval to zero, the command has the following effect:
  • Disables the timer-based min-links review feature for all port-channels.
    • For LACP port-channels, it prevents the port-channel from bringing link up (even after one or more member ports were negotiated to collect or distribute (rx or tx)) until there are sufficient member interfaces ready to join the port-channel. Meanwhile, the partner can enable the port-channel link with fewer than required member interfaces. This configuration does not impact port-channels without min-links configuration.

       

Related Command

port-channel min-links

 

Example
This command sets the port-channel min-links interval to 200 seconds.
switch(config)# port-channel min-links review interval 200

port-channel speed mixed

The port-channel speed mixed command configures a port channel with the ability to have active members of multiple speeds.

 

Note: Available on the 7020, 7280, 7500, and 7800 platforms. Minimum links is not available on mixed-speed port channels.

 

Command Mode

Interface-Port-Channel Configuration

 

Command Syntax

port-channel speed mixed

 

Related Commands

The interface port-channel command places the switch in the interface-port-channel configuration mode.

 

Example
These commands place the switch in the interface port-channel mode and configure the mixed speed port-channel.
switch(config)# interface port-channel 1
switch(config-if-Po1)# port-channel speed mixed

port-channel speed minimum

The port-channel speed minimum command specifies the cumulative minimum speed of all active members in order for a port channel to become active. If there is less than the specified by this command, the port channel interface does not become active.

 

Note: If both minimum speed and minimum links are configured, minimum speed will take precedence.

 

Command Mode

Interface-Port-Channel Configuration

 

Command Syntax

port-channel speed minimum speed-value

 

Parameter

speed-value Minimum speed value. The value ranges from 1 to 65535.

 

Related Command

The interface port-channel command places the switch in interface-port-channel configuration mode.

 

Example
These command sets 100 Gbps as the minimum speed needed for port channel 1 to become active.
switch(config)# interface port-channel 1
switch(config-if-Po1)# port-channel speed minimum 100 gbps

show lacp aggregates

The show lacp aggregates command displays aggregate IDs and the list of bundled ports for all specified port channels.

 

Command Mode

EXEC

 

Command Syntax

show lacp [PORT_LIST] aggregates [PORT_LEVEL] [INFO_LEVEL]

 

Note: PORT_LEVEL and INFO_LEVEL parameters can be placed in any order.

 

Parameters
  • PORT_LIST Port channels for which aggregate information is displayed. Options include:
    • <no parameter>      All configured port channels.
    • c_range Channel list (number, range, or comma-delimited list of numbers and ranges).

       

  • PORT_LEVEL Ports displayed, in terms of aggregation status. Options include:
    • no parameter      Ports bundled by LACP into the port channel.
    • all-ports All channel group ports, including channel group members not bundled into the port channel interface.

       

  • INFO_LEVEL Amount of information that is displayed. Options include:
    • no parameter      Aggregate ID and bundled ports for each channel.
    • brief      Aggregate ID and bundled ports for each channel.
    • detailed      Aggregate ID and bundled ports for each channel.

       

Example
This command lists aggregate information for all configured port channels.
switch> show lacp aggregates

Port Channel Port-Channel1:
 Aggregate ID: 
[(8000,00-1c-73-04-36-d7,0001,0000,0000),(8000,00-1c-73-09-a0-f3,0001,0000,0000)]
  Bundled Ports: Ethernet43 Ethernet44 Ethernet45 Ethernet46
Port Channel Port-Channel2:
 Aggregate ID: 
[(8000,00-1c-73-01-02-1e,0002,0000,0000),(8000,00-1c-73-04-36-d7,0002,0000,0000)]
  Bundled Ports: Ethernet47 Ethernet48
Port Channel Port-Channel3:
 Aggregate ID: 
[(8000,00-1c-73-04-36-d7,0003,0000,0000),(8000,00-1c-73-0c-02-7d,0001,0000,0000)]
  Bundled Ports: Ethernet3 Ethernet4
Port Channel Port-Channel4:
 Aggregate ID: 
[(0001,00-22-b0-57-23-be,0031,0000,0000),(8000,00-1c-73-04-36-d7,0004,0000,0000)]
  Bundled Ports: Ethernet1 Ethernet2
Port Channel Port-Channel5:
 Aggregate ID: 
[(0001,00-22-b0-5a-0c-51,0033,0000,0000),(8000,00-1c-73-04-36-d7,0005,0000,0000)]
  Bundled Ports: Ethernet41
switch>

show lacp counters

The show lacp counters command displays LACP traffic statistics.

 

Command Mode

EXEC

Command Syntax

show lacp [PORT_LIST] counters [PORT_LEVEL] [INFO_LEVEL]

 

Note: PORT_LEVEL and INFO_LEVEL parameters can be interchanged while running the command.

 

Parameters
  • PORT_LIST Ports for which port information is displayed. Options include:
    • no parameter      All configured port channels.
    • c_rangePorts in specified channel list (number, number range, or list of numbers and ranges).
    • interface      Ports on all interfaces.
    • interface ethernet e_num      Port on Ethernet interface specified by e_num.
    • interface port-channel p_num      Port on port channel interface specified by p_num.

       

  • PORT_LEVELPorts displayed, in terms of aggregation status. Options include:
    • no parameter      Only ports bundled by LACP into an aggregate.
    • all-ports      All ports, including LACP candidates that are not bundled.

       

  • INFO_LEVEL Amount of information that is displayed. Options include:
    • no parameter      Displays packet transmission (TX and RX) statistics.
    • brief      Displays packet transmission (TX and RX) statistics.
    • detailed      Displays packet transmission (TX and RX) statistics and actor-partner statistics.

       

Example
This command displays transmission statistics for all configured port channels.
switch> show lacp counters brief

                      LACPDUs         Markers   Marker Response
Port   Status        RX         TX   RX    TX   RX    TX   Illegal
------------------------------------------------------------------
Port Channel Port-Channel1:
Et43   Bundled   396979     396959    0     0    0     0    0
Et44   Bundled   396979     396959    0     0    0     0    0
Et45   Bundled   396979     396959    0     0    0     0    0
Et46   Bundled   396979     396959    0     0    0     0    0

Port Channel Port-Channel2:
Et47   Bundled   396836     396883    0     0    0     0    0
Et48   Bundled   396838     396883    0     0    0     0    0

switch>

show lacp interface

The show lacp interface command displays port status for all port channels that include the specified interfaces. Within the displays for each listed port channel, the output displays sys-id, partner port, state, actor port, and port priority for each interface in the channel.

 

Command Mode

EXEC

 

Command Syntax

show lacp interface [INTERFACE_PORT] [PORT_LEVEL] [INFO_LEVEL]

 

Note: INTERFACE_PORT is listed first when present. Other parameters can be listed in any order.

 

Parameters
  • INTERFACE_PORT Interfaces for which information is displayed. Options include:
    • no parameter      All interfaces in channel groups.
    • ethernet e_num      Ethernet interface specified by e_num.
    • port-channel p_num      Port channel interface specified by p_num.

       

  • PORT_LEVEL Ports displayed, in terms of aggregation status. Options include:
    • no parameter      Command lists data for ports bundled by LACP into the aggregate.
    • all-ports      Command lists data for all ports, including LACP candidates that are not bundled.

       

  • INFO_LEVEL Amount of information that is displayed. Options include:
    • no parameter      Displays same information as brief option.
    • brief      Displays LACP configuration data, including sys-id, actor, priorities, and keys.
    • detailed      Includes brief option information plus state machine data.

       

Example
This command displays LACP configuration information for all ethernet interfaces.
switch> show lacp interface
State: A = Active, P = Passive; S=ShortTimeout, L=LongTimeout;
       G = Aggregable, I = Individual; s+=InSync, s-=OutOfSync;
       C = Collecting, X = state machine expired,
       D = Distributing, d = default neighbor state

             |                       Partner                         Actor
Port Status  | Sys-id                 Port# State   OperKey PortPri  Port#
----------------------------------------------------------------------------
Port Channel Port-Channel1:
Et43 Bundled | 8000,00-1c-73-09-a0-f3    43 ALGs+CD  0x0001   32768   43
Et44 Bundled | 8000,00-1c-73-09-a0-f3    44 ALGs+CD  0x0001   32768   44
Et45 Bundled | 8000,00-1c-73-09-a0-f3    45 ALGs+CD  0x0001   32768   45
Et46 Bundled | 8000,00-1c-73-09-a0-f3    46 ALGs+CD  0x0001   32768   46
Port Channel Port-Channel2:
Et47 Bundled | 8000,00-1c-73-01-02-1e    23 ALGs+CD  0x0002   32768   47
Et48 Bundled | 8000,00-1c-73-01-02-1e    24 ALGs+CD  0x0002   32768   48

             |                 Actor
Port Status  |   State         OperKey    PortPriority
-------------------------------------------------------
Port Channel Port-Channel1:
Et43 Bundled |   ALGs+CD        0x0001           32768
Et44 Bundled |   ALGs+CD        0x0001           32768
Et45 Bundled |   ALGs+CD        0x0001           32768
Et46 Bundled |   ALGs+CD        0x0001           32768
Port Channel Port-Channel2:
Et47 Bundled |   ALGs+CD        0x0002           32768
Et48 Bundled |   ALGs+CD        0x0002           32768

switch>

show lacp internal

The show lacp internal command displays the local LACP state for all specified channels. Local state data includes the state machines and LACP protocol information.

 

Command Mode

EXEC

 

Command Syntax

show lacp [PORT_LIST] internal [PORT_LEVEL] [INFO_LEVEL]

 

Parameters
  • PORT_LIST Interface for which port information is displayed. Options include:
    • no parameter      All configured port channels.
    • c_rangePorts in specified channel list (number, number range, or list of numbers and ranges).
    • interface     Ports on all interfaces.
    • interface ethernet e_num      Ethernet interface specified by e_num.
    • interface port-channel p_num      Port channel interface specified by p_num.

       

  • PORT_LEVEL Ports displayed, in terms of aggregation status. Options include:
    • no parameter      Command lists data for ports bundled by LACP into an aggregate.
    • all-ports      Command lists data for all ports, including LACP candidates that are not bundled.

       

  • INFO_LEVEL Amount of information that is displayed. Options include:
    • no parameter      Displays same information as brief option.
    • brief      Displays LACP configuration data, including sys-id, actor, priorities, and keys.
    • detailed      Includes brief option information plus state machine data.

       

     

    Note: PORT_LEVEL and INFO_LEVEL parameters can be placed in any order.

     

 

Example
This command displays internal data for all configured port channels.
switch> show lacp internal

LACP System-identifier: 8000,00-1c-73-04-36-d7
State: A = Active, P = Passive; S=ShortTimeout, L=LongTimeout;
       G = Aggregable, I = Individual; s+=InSync, s-=OutOfSync;
       C = Collecting, X = state machine expired,
       D = Distributing, d = default neighbor state
             |Partner                                 Actor
Port Status  | Sys-id                 Port#  State    OperKey  PortPriority
----------------------------------------------------------------------------
Port Channel Port-Channel1:
Et43 Bundled | 8000,00-1c-73-09-a0-f3    43  ALGs+CD   0x0001   32768
Et44 Bundled | 8000,00-1c-73-09-a0-f3    44  ALGs+CD   0x0001   32768
Et45 Bundled | 8000,00-1c-73-09-a0-f3    45  ALGs+CD   0x0001   32768
Et46 Bundled | 8000,00-1c-73-09-a0-f3    46  ALGs+CD   0x0001   32768

show lacp peer

The show lacp peer command displays the LACP protocol state of the remote neighbor for all specified port channels.

 

Command Mode

EXEC

 

Command Syntax

show lacp [PORT_LIST] peer [PORT_LEVEL] [INFO_LEVEL]

 

Note: PORT_LEVEL and INFO_LEVEL parameters can be placed in any order.

 

Parameters
  • PORT_LISTInterface for which port information is displayed. Options include:
    • no parameter      Displays information for all configured port channels.
    • c_range Ports in specified channel list (number, number range, or list of numbers and ranges).
    • interface      Ports on all interfaces.
    • interface ethernet e_num      Ethernet interface specified by e_num.
    • interface port-channel p_num      Port channel interface specified by p_num.

       

  • PORT_LEVEL Ports displayed, in terms of aggregation status. Options include:
    • no parameter      Command lists data for ports bundled by LACP into an aggregate.
    • all-ports      Command lists data for all ports, including LACP candidates that are not bundled.

       

  • INFO_LEVEL Amount of information that is displayed. Options include:
    • no parameter      Displays same information as brief option.
    • brief      Displays LACP configuration data, including sys-id, actor, priorities, and keys.
    • detailed      Includes brief option information plus state machine data.

       

 

Example
This command displays the LACP protocol state of the remote neighbor for all port channels.
switch> show lacp peer
 
State: A = Active, P = Passive; S=ShortTimeout, L=LongTimeout;
       G = Aggregable, I = Individual; s+=InSync, s-=OutOfSync;
       C = Collecting, X = state machine expired,
       D = Distributing, d = default neighbor state
               |                          Partner
Port   Status  | Sys-id                  Port#   State     OperKey  PortPri
----------------------------------------------------------------------------
Port Channel Port-Channel1:
Et1    Bundled | 8000,00-1c-73-00-13-19      1   ALGs+CD    0x0001    32768
Et2    Bundled | 8000,00-1c-73-00-13-19      2   ALGs+CD    0x0001    32768
Port Channel Port-Channel2:
Et23   Bundled | 8000,00-1c-73-04-36-d7     47   ALGs+CD    0x0002    32768
Et24   Bundled | 8000,00-1c-73-04-36-d7     48   ALGs+CD    0x0002    32768
Port Channel Port-Channel4*:
Et3    Bundled | 8000,00-1c-73-0b-a8-0e     45   ALGs+CD    0x0001    32768
Et4    Bundled | 8000,00-1c-73-0b-a8-0e     46   ALGs+CD    0x0001    32768
Port Channel Port-Channel5*:
Et19   Bundled | 8000,00-1c-73-0c-30-09     49   ALGs+CD    0x0005    32768
Et20   Bundled | 8000,00-1c-73-0c-30-09     50   ALGs+CD    0x0005    32768
Port Channel Port-Channel6*:
Et6    Bundled | 8000,00-1c-73-01-07-b9     49   ALGs+CD    0x0001    32768
Port Channel Port-Channel7*:
Et5    Bundled | 8000,00-1c-73-0f-6b-22     51   ALGs+CD    0x0001    32768
Port Channel Port-Channel8*:
Et10   Bundled | 8000,00-1c-73-10-40-fa     51   ALGs+CD    0x0001    32768

* - Only local interfaces for MLAGs are displayed. Connect to the peer to
    see the state for peer interfaces.
switch>

show lacp sys-id

The show lacp sys-id command displays the System Identifier the switch uses when negotiating remote LACP implementations.

 

Command Mode

EXEC

 

Command Syntax

show lacp sys-id [INFO_LEVEL]

 

Parameters

INFO_LEVEL Amount of information that is displayed. Options include:
  • no parameter      Displays system identifier.
  • brief      Displays system identifier.
  • detailed      Displays system identifier and system priority, including the MAC address.

     

Examples
  • This command displays the system identifier.
    switch> show lacp sys-id brief
    8000,00-1c-73-04-36-d7

     

  • This command displays the system identifier and system priority.
    switch> show lacp sys-id detailed
    System Identifier used by LACP:
    System priority: 32768  Switch MAC Address: 00:1c:73:04:36:d7
      802.11.43 representation: 8000,00-1c-73-04-36-d7

show load-balance profile

The show load-balance profile command displays the contents of the specified load balance profiles. Load balance profiles specify parameters used by hashing algorithms that distribute traffic across ports comprising a port channel or among component ECMP routes.

 

Command Mode

EXEC

 

Command Syntax

show load-balance profile [PROFILES]

 

Parameters

PROFILES Load balance profiles for which command displays contents. Options include:
  • no parameter      Displays all load balance profiles.
  • profile_name      Displays specified profile.

     

Related Commands
Example
This command displays the contents of the LB-1 load balance profile.
switch> show load-balance profile LB-1

---------- LB-1 ----------

Source MAC address hashing               ON
Destination MAC address hashing          ON
Ethernet type hashing                    ON
VLAN ID hashing                          ON
IP protocol field hashing                ON
DSCP field hashing is                    ON
Symmetric hashing for non-IP packets     OFF
Symmetric hashing for IP packets         OFF
Random distribution for port-channel     ON
Random distribution for ecmp             ON

Profile LB-1 is applied on the following
    Port-Channel100

---------- myGlobalProfile (global) ----------
L3 hashing is ON
Symmetric hashing is OFF
Hashing mode is flow-based
Hash polynomial is 3
Hash seed is 0
Profile myGlobalProfile (global) is applied on the following
Linecard3
Linecard4
Linecard5
Linecard6

switch>

show port-channel

The show port-channel command displays information about members the specified port channels.

 

Command Mode

EXEC

 

Command Syntax

show port-channel [MEMBERS] [PORT_LIST] [INFO_LEVEL]

 

Parameters
  • MEMBERSList of port channels for which information is displayed. Options include:
    • no parameterAll configured port channels.
    • p_range Ports in specified channel list (number, number range, or list of numbers and ranges).

       

  • PORT_LEVELPorts displayed, in terms of aggregation status. Options include:
    • no parameterDisplays information on ports that are active members of the LAG.
    • active-portsDisplays information on ports that are active members of the LAG.
    • all-ports       Displays information on all ports (active or inactive) configured for LAG.

       

  • INFO_LEVELAmount of information that is displayed. Options include:
    • no parameterDisplays information at the brief level.
    • briefDisplays information at the brief level.
    • detailed Displays information at the detail level.

       

Display Values
  • Port Channel Type and name of the port channel.
  • Time became active Time when the port channel came up.
  • Protocol Protocol operating on the port channel.
  • Mode Status of the Ethernet interface on the port. The status value is Active or Inactive.
  • No active ports Number of active ports on the port channel.
  • Configured but inactive ports Ports configured but that are not actively up.
  • Reason unconfigured Reason why the port is not part of the LAG.

     

Guidelines

You can configure a port channel to contain many ports, but only a subset may be active at a time. All active ports in a port channel must be compatible. Compatibility includes many factors and is platform specific. For example, compatibility may require identical operating parameters such as speed and Maximum Transmission Unit (MTU). Compatibility may only be possible between specific ports because of the internal organization of the switch.

 

Examples
  • This command displays output from the show port-channel command.
    switch> show port-channel 3
    Port Channel Port-Channel3: 
      Active Ports: 
           Port                Time became active       Protocol    Mode    
        ----------------------------------------------------------------------- 
           Ethernet3           15:33:41                 LACP        Active 
           PeerEthernet3       15:33:41                 LACP        Active 
    

     

  • This command displays output from the show port-channel active-ports command.
    switch> show port-channel active-ports
    Port Channel Port-Channel3:
      No Active Ports
    Port Channel Port-Channel11:
      No Active Ports
    switch>

     

  • This command displays output from the show port-channel all-ports command.
    switch> show port-channel all-ports
    Port Channel Port-Channel3:
      No Active Ports
      Configured, but inactive ports:
          Port            Time became inactive    Reason unconfigured
        ----------------------------------------------------------------------------
          Ethernet3       Always                  not compatible with aggregate
    
    Port Channel Port-Channel11:
      No Active Ports
      Configured, but inactive ports:
          Port            Time became inactive    Reason unconfigured
        ----------------------------------------------------------------------------
          Ethernet25      Always                  not compatible with aggregate
          Ethernet26      Always                  not compatible with aggregate

     

  • This command displays details about the port-channel configuration:
    switch#show port-channel 50 detailed 
    Port Channel Port-Channel50 (Fallback State: Unconfigured): 
    Minimum links: unconfigured Minimum speed: unconfigured 
    Current weight/Max weight: 1/16 
    
    Active Ports: 
    Port                  Time Became Active        Protocol       Mode         Weight      State
    -------------------- ------------------------ -------------- ------------ ------------ ------
    Ethernet51            Wed 15:19:30              LACP           Active       1           Rx,Tx 
    PeerEthernet52        Wed 15:19:28              LACP           Active       0           Unknown

     

    This output displays the following information:
    • Port - the Active ports on an interface.
    • Time Became Active - The time when a port came up on the network.
    • Protocol - the network protocol associated with the port.
    • Mode - the current mode of the port as Active or Inactive.
    • Weight - The member port weight is directly proportional to other members speeds and determines the number of packets sent over the member port when it becomes active. For same speed port-channels, all members have a weight of one (1).
    • State - the state of the port as receiving (Rx) traffic, transmitting (Tx) traffic, or Unknown.

show port-channel dense

The show port-channel dense command displays the port-channels on the switch and lists their component interfaces, LACP status, and set flags.

 

Command Mode

EXEC

 

Command Syntax

show port-channel dense

 

Example
This command displays show port-channel dense output:
switch> show port-channel dense

    Flags
---------------------------------------------------------------------
a - LACP Active        p - LACP Passive
U - In Use             D - Down
+ - In-Sync            - - Out-of-Sync      i - incompatible with agg
P - bundled in Po      s - suspended        G - Aggregable
I - Individual         S - ShortTimeout     w - wait for agg

Number of channels in use: 2
Number of aggregators:2

   Port-Channel       Protocol    Ports
-------------------------------------------------------
   Po1(U)             LACP(a)      Et47(PG+) Et48(PG+)
   Po2(U)             LACP(a)      Et39(PG+) Et40(PG+)

show port-channel limits

The show port-channel limits command displays groups of ports that are compatible and may be joined into port channels. Each group of compatible ports is called a LAG group. For each LAG group, the command also displays Max interfaces and Max ports per interface.
  • Max interfaces defines the maximum number of active port channels that may be formed out of these ports.

     

  • Max ports per interface defines the maximum number of active ports allowed in a port channel from the compatibility group.

     

All active ports in a port channel must be compatible. Compatibility comprises many factors and is specific to a given platform. For example, compatibility may require identical operating parameters such as speed and/or Maximum Transmission Unit (MTU). Compatibility may only be possible between specific ports because of internal organization of the switch.

 

Command Mode

EXEC

 

Command Syntax

show port-channel limits

 

Example
This command displays show port-channel list output:
switch> show port-channel limits

LAG Group: focalpoint
--------------------------------------------------------------------------
  Max port-channels per group: 24, Max ports per port-channel: 16
  24 compatible ports: Ethernet1  Ethernet2  Ethernet3  Ethernet4
                       Ethernet5  Ethernet6  Ethernet7  Ethernet8
                       Ethernet9  Ethernet10 Ethernet11 Ethernet12
                       Ethernet13 Ethernet14 Ethernet15 Ethernet16
                       Ethernet17 Ethernet18 Ethernet19 Ethernet20
                       Ethernet21 Ethernet22 Ethernet23 Ethernet24
--------------------------------------------------------------------------

show port-channel load-balance fields

The show port-channel load-balance fields command displays the fields that the hashing algorithm uses to distribute traffic across the interfaces that comprise the port channels.

 

Command Mode

EXEC

 

Command Syntax

show port-channel load-balance HARDWARE fields

 

Parameters

HARDWARE ASIC switching device. Selection options depend on the switch model and include:
  • arad
  • fm6000
  • petraA
  • trident

     

Example
This command displays the hashing fields used for balancing port channel traffic.
switch> show port-channel load-balance fm6000 fields

Source MAC address hashing for non-IP packets is ON
Destination MAC address hashing for non-IP packets is ON
Ethernet type hashing for non-IP packets is ON
VLAN ID hashing for non-IP packets is ON
VLAN priority hashing for non-IP packets is ON
Source MAC address hashing for IP packets is ON
Destination MAC address hashing for IP packets is ON
Ethernet type hashing for IP packets is ON
VLAN ID hashing for IP packets is ON
VLAN priority hashing for IP packets is ON
IP source address hashing is ON
IP destination address hashing is ON
IP protocol field hashing is ON
TCP/UDP source port hashing is ON
TCP/UDP destination port hashing is ON

switch>

show port-channel load-balance

The show port-channel load-balance command displays the traffic distribution between the member ports of the specified port channels. The command displays distribution for unicast, multicast, and broadcast streams.

The distribution values displayed are based on the total interface counters which start from 0 at boot time or when the counters are cleared. For more current traffic distribution values, clear the interface counters of the member interfaces using the clear counters command.

 

Command Mode

EXEC

 

Command Syntax

show port-channel load-balance [MEMBERS]

 

Parameters

MEMBERS list of port channels for which information is displayed. Options include:
  • no parameter all configured port channels.
  • c_range ports in specified channel list (number, number range, or list of numbers and ranges).

     

Example

This command displays traffic distribution for all configured port channels.
switch> show port-channel load-balance
ChanId      Port Rx-Ucst Tx-Ucst Rx-Mcst Tx-Mcst Rx-Bcst Tx-Bcst
------ --------- ------- ------- ------- ------- ------- -------
     8      Et10 100.00% 100.00% 100.00% 100.00%   0.00% 100.00%
------ --------- ------- ------- ------- ------- ------- -------
     1       Et1  13.97%  42.37%  47.71%  30.94%   0.43%  99.84%
     1       Et2  86.03%  57.63%  52.29%  69.06%  99.57%   0.16%
------ --------- ------- ------- ------- ------- ------- -------
     2      Et23  48.27%  50.71%  26.79%  73.22%   0.00% 100.00%
     2      Et24  51.73%  49.29%  73.21%  26.78%   0.00%   0.00%
------ --------- ------- ------- ------- ------- ------- -------
     4       Et3  55.97%  63.29%  51.32%  73.49%   0.00%   0.00%
     4       Et4  44.03%  36.71%  48.68%  26.51%   0.00%   0.00%
------ --------- ------- ------- ------- ------- ------- -------
     5      Et19  39.64%  37.71%  50.00%  90.71%   0.00%   0.00%
     5      Et20  60.36%  62.29%  50.00%   9.29%   0.00% 100.00%
------ --------- ------- ------- ------- ------- ------- -------
     6       Et6 100.00% 100.00% 100.00% 100.00%   0.00% 100.00%
------ --------- ------- ------- ------- ------- ------- -------
     7       Et5 100.00%   0.00% 100.00% 100.00%   0.00%   0.00%
switch>

Multi-Chassis Link Aggregation

Arista switches support Multi-Chassis Link Aggregation (MLAG) to logically aggregate ports across two switches. For example, two 10-gigabit Ethernet ports, one each from two MLAG configured switches, can connect to two 10-gigabit ports on a host, switch, or network device to create a link that appears as a single 20-gigabit port. MLAG-configured ports provide Layer 2 multipathing, increased bandwidth, higher availability, and other improvements on traditional active-passive or Spanning Tree governed infrastructures.

MLAG Introduction

High availability data center topologies typically provide redundancy protection at the expense of over-subscription by connecting Top-Of-Rack (TOR) switches and servers to dual aggregation switches. In these topologies, Spanning Tree Protocol prevents network loops by blocking half of the links to the aggregation switches. This reduces the available bandwidth by 50%.

Deploying MLAG removes over-subscription by configuring an MLAG link between two aggregation switches to create a single logical switching instance that utilizes all connections to the switches. Interfaces on both devices participate in a distributed port channel, enabling all active paths to carry data traffic while maintaining the integrity of the Spanning Tree topology.

MLAG provides these benefits:
  • Aggregates multiple Ethernet ports across two switches.

     

  • Provides higher bandwidth links as network traffic increases.

     

  • Utilizes bandwidth more efficiently with fewer links blocked by STP.

     

  • Connects to other switches and servers by static LAG or LACP without other proprietary protocols.

     

  • Supports normal STP operation to prevent loops.

     

  • Supports active-active Layer-2 redundancy.

     

 

Note: For information on enabling Precision Timing Protocol (PTP) on an MLAG interface, see the Timing Protocols chapter.

 

 

Note: The global STP configuration is derived from the primary peer device while the secondary device parameters are ignored. When STP is disabled on the primary device, the secondary device will not contain any STP configuration information from the primary device. As a result, the secondary device will not be able to decide on the port roles or states, and will remain in the default state which is the discarding state. This is an expected behavior.

 

 

Note: It is highly recommended that both MLAG peer switches are identical platforms and run identical EOS images. Running different images/platform may result in a failure to form an association with the MLAG peer or see discrepancy in behavior.

 

MLAG Conceptual Overview

MLAG Operation Process

A Multi-chassis Link Aggregation Group (MLAG) is a pair of links that terminate on two cooperating switches and appear as an ordinary Link Aggregation Group (LAG). The cooperating switches are MLAG peer switches and communicate through an interface called a peer link. While the peer link’s primary purpose is exchanging MLAG control information between peer switches, it also carries data traffic from devices that are attached to only one MLAG peer and have no alternative path. An MLAG domain consists of the peer switches and the control links that connect the switches.

In the figure below, Switch A and Switch B are peer switches in the MLAG domain and connect to each other through the peer link. Each peer switch uses the peer address to form and maintain the peer link.

The MLAG domain ID is a text string configured in each peer switch. MLAG switches use this string to identify their peers. The MLAG System ID (MSI) is the MLAG domain’s MAC address. The MSI is automatically derived when the MLAG forms and does not match the bridge MAC address of either peer. Each peer uses the MSI in STP and LACP PDUs.

The topology shown below contains four MLAGs: one MLAG connects each device to the MLAG domain. Each peer switch connects to the four servers through MLAG link interfaces.

In a conventional topology, with dually-attaching devices to multiple switches for redundancy, Spanning Tree Protocol (STP) blocks half of the switch-device links. In the MLAG topology, STP does not block any portion because it views the MLAG Domain as a single switch and each MLAG as a single port. The MLAG protocol facilitates the balancing of device traffic between the peer switches.

Figure 1. MLAG Domain Topology

 

When MLAG is disabled, peer switches revert to their independent state. MLAG is disabled by any of the following:
  • MLAG configuration changes.
  • The TCP connection breaks.
  • The peer-link or local-interface goes down.
  • A switch does not receive a response to a keep alive message from its peer within a specified period.

     

MLAG Interoperability with Other Features

The following sections describe MLAG interaction with other switch features.

VLANs

VLAN parameters must be configured identically on each peer for the LAGs comprising the peer link and MLAGs. These parameters include the switchport access VLAN, switchport mode, trunk-allowed VLANs, the trunk native VLAN, and switchport trunk groups.

Configuration discrepancies may result in traffic loss in certain failure scenarios. Port-specific bridging configuration originates on the switch where the port is physically located.

LACP

Link Aggregation Control Protocol (LACP) should be used on all MLAG interfaces, including the peer-link. LACP control packets reference the MLAG system ID.

Static MAC Addresses

A static MAC address configured on an MLAG interface is automatically configured on the peer’s corresponding interface. Configuring static MAC addresses on both peers prevents undesired flooding if an MLAG peer relationship fails.

If the MLAG peering relationship is disabled, the static MAC previously learned from peer is removed.

Spanning Tree Protocol (STP)

When implementing MLAG in a spanning tree network, spanning tree must be configured globally and on port-channels configured with an MLAG ID. Port specific spanning tree configuration comes from the switch where the port physically resides. This includes spanning-tree PortFast BPDU Guard and BPDU filter.

Port Mirroring

A port channel which is a member of an MLAG must not be used as the destination port for a port mirroring (port monitoring) session.

IPv6 Flow Label Hashing

Arista switches use the hashing algorithm to load-balance traffic among LAG members and Layer 3 ECMP (equal cost multipath) paths. For IP and IPv6 traffic, the hashing algorithm includes (if so configured for LAG) the IP packet fields such as source and destination IP addresses as well as source and destination ports for UDP and TCP traffic.

To improve traffic distribution for IPv6 traffic, IPv6 Flow Label field has been added to the hashing algorithm for both LAG and ECMP.

 

Note: IPv6 Flow Label is included in the LAG hashing algorithm only when the MAC header hashing is not enabled for IPv6 traffic.

 

MLAG Maintenance

Ensuring Control Plane ACL Compatibility

The control plane Access Control List (ACL) on any interface participating in the MLAG must be configured to allow only the peer link neighbor to generate MLAG control traffic. The required rules are included in the default control plane ACL for Ethernet ports.

Any custom control plane ACL applied to a participating port must include these three rules:

permit tcp any any eq mlag ttl eq 255 
permit udp any any eq mlag ttl eq 255 
permit tcp any eq mlag any ttl eq 255

 

MLAG peers that function as routers must each have routing enabled.

MLAG Availability through a Single Functional Peer

MLAG high availability advantages are fully realized when all devices that connect to one MLAG switch also connect to the peer switch. A switch can continue supporting MLAG when its peer is offline if the STP agent is restartable. When one peer is offline, data traffic flows from the devices through the MLAG component link that connects to the functioning switch. When a switch is offline, its interfaces and ports do not appear in show mlag and show spanning tree protocol commands of the functioning peer.

To view the restartability status of the STP agent, use the detail option of theshow spanning-tree instancecommand:

switch-1# show spanning-tree instance detail | grep agent
Stp agent restartable                      :            True

 

STP agent restartability requires consistent configuration between the peers of STP, LACP, MLAG, and switchport parameters. Events triggering an STP state machine change may also briefly prevent the STP agent from being restartable.

Reload Delay

If an MLAG peer reboots, all ports except those in the peer-link port-channel remain in errdisabled state for a specified time, called the reload-delay period. This period allows all topology states to stabilize before the switch begins forwarding traffic. Each Arista switch defaults to the recommended reload-delay value, which varies by switch platform:
  • Fixed configuration switches: 300 seconds
  • Trident II modular switches: 1200 seconds
    • 7304
    • 7308
    • 7316
    • 7300X series

       

  • Sand platform fixed configuration switches: 600 seconds
    • 7280 series (except 7280CR2 and 7280SR2)
    • 7020 series

       

  • Sand platform modular switches: 1800 seconds
    • 7504
    • 7508
    • 7500E series
    • 7548S

       

  • Sand Jericho+ fixed configuration switches: 900 seconds
    • 7280CR2 series
    • 7280SR2 series

       

In those cases where network topology requires additional time to stabilize or where a shorter delay can be tolerated, the reload-delay period can be configured using the reload-delay mlag command.

Severing the physical connection (cable) that establishes the peer-link between MLAG peers may result in a split brain state where each peer independently enters spanning tree state to prevent topology loops. Sessions established through one interface of a dual attached device may fail if its path is disrupted by the STP reconvergence, possibly resulting in temporarily lost connectivity. Sessions can be reestablished if permitted by the resulting topology.

Upgrading MLAG Peers

MLAG ISSU (In-Service Software Upgrade) upgrades EOS software on one MLAG peer with minimal traffic disruptions on active MLAG interfaces and without changing the network topology.

Verifying Configuration Compatibility

A seamless EOS upgrade on an MLAG peer requires that the following features are configured consistently on each switch:
  • VLANs.
  • Switchport configuration on port channel interfaces that are configured with an MLAG ID.
  • STP configuration (global).

     

Version Compatibility

A switch running MLAG can be upgraded without disrupting MLAG traffic when the upgraded EOS version is compatible with the version on the peer switch. Refer to the Release Notes for a list of compatible EOS versions.

Reload Warning Conditions

Entering an EOS reload command while MLAG is active generates warning messages if conditions that can result in packet loss during the upgrade are present. All warnings should be resolved before confirming the reload request. The following table displays the reload conditions and a common resolution method for each condition.

Table 1. Reload Warning Resolutions
Reload Condition Resolution Method
Compatibility check Refer to the Release Notes to verify that the new version is compatible with the currently installed version.
Active-partial MLAG warning Bring up the remote port-channel. If the MLAG is not actively used, then this warning can be ignored.
STP is not restartable Wait for STP to be restartable: typically 30 seconds, up to 120 seconds for a newly started STP agent. Refer to MLAG Availability through a Single Functional Peer for information on checking restartability.
Reload delay too low Configure a reload delay value greater than or equal to the default. Recommend delay is 300 seconds for TOR switches, 900 seconds for modular switches, and 600 seconds for Sand platform fixed configuration switches (7020 and 7280 series (except 7280CR2 and 7280SR2)).
Peer has error-disabled interfaces Wait for reload-delay to expire on the peer.

 

Example
The following reload command generates MLAG warning conditions that should be addressed before confirming the proceed with reload prompt.
switch(config)# reload
If you are performing an upgrade, and the Release Notes for the
new version of EOS indicate that MLAG is not backwards-compatible 
with the currently installed version (4.9.2), the upgrade will 
result in packet loss.

The following MLAGs are not in Active mode. Traffic to or from these ports will 
be lost during the upgrade process.
                                                               local/remote 
  mlag      desc               state      local      remote          status 
--------- --------- ------------------- ---------- ----------- ------------ 
    14                active-partial       Po14        Po14         up/down 
    15                active-partial       Po15        Po15         up/down

Stp is not restartable. Topology changes will occur during the upgrade process.

The configured reload delay of 100 seconds is below the default
value of 300 seconds. A longer reload delay allows more time to
rollback an unsuccessful upgrade due to incompatibility.

The other MLAG peer has errdisabled interfaces. Traffic loss will occur during 
the upgrade process.

Proceed with reload? [confirm]

 

Performing an MLAG ISSU Upgrade

The following procedure performs an MLAG ISSU upgrade:

  1. Verify configuration consistency on each peer (Verifying Configuration Compatibility).
     
  2. Verify version compatibility between the new and existing images (Version Compatibility).
     
  3. Configure reload-delay mlag (MLAG Availability through a Single Functional Peer) if needed. Recommended delay period varies by switch type, and each switch defaults to its recommended delay period.
     
  4. Install the new image onto one of the peers:
    1. Upload the new image to the switch.
    2. Set the boot path to the new image.
    3. Enter the reload command.

     

  5. Resolve all reload warnings.
     
  6. Confirm the reload.
     
  7. Wait for MLAG peers to renegotiate to the active state and reload-delay expiry on rebooted peer; until reload-delay period has expired, ports on the rebooted peer (except the peer-link) will be in errdisabled state with err-disabled reason being mlag-issu.

    Avoid configuration changes on both peers until after this step.

     

  8. Repeat the upgrade process for the other peer.

    When upgrading modular switches with dual supervisors, upgrade the standby supervisors first, then upgrade the active supervisors.

     

Forced Periodic ARP and NDP Refresh on IPv4 and IPv6 Networks

Overview

In MLAG configurations where, each leaf connects to both spines (bowtie setups) and relies on Address Resolution Protocol (ARP) and Neighbor Discovery Protocol (NDP) refresh requests to keep VMACs in downstream MLAG switches up to date. Configure forced periodic ARP and NDP refresh requests to send ARP and NDR in periodic intervals independently of the confirmed time of ARP and NDR entries in the kernel. By default, when various processes confirm a neighbor entry using ARP synchronization between MLAG peers, the switch may not send an ARP refresh request for another duration of ARP aging timeout for IPv4 networks or NDP cache expiration time for IPv6 networks.

In topologies where the two upstream MLAG switches with VXLAN virtual MAC addresses, the VMAC can age out from the MAC tables of the downstream MLAG switches. Aging out can happen when the upstream switch sending APR or NDP requests through the downstream switch that owns the VMAC does not send an ARP or NDP request in that period because of ARP synchronization between the upstream MLAG peers. Adding this feature ensures that the upstream switches send ARP and NDP requests at the configured cache interval to prevent aging out of the VMAC on downstream switches.

Configuring MLAG

These sections describe the basic MLAG configuration steps:

Configuring the MLAG Peers

Connecting two switches as MLAG peers requires the establishment of the peer link and an SVI that defines local and peer IP addresses on each switch.

The peer link is composed of a LAG between the switches. When all devices that connect to the MLAG domain are dually connected to the switches through an MLAG, a peer link of two Ethernet interfaces is sufficient to handle MLAG control data and provide N+1 redundancy. When the domain connects to devices through only one MLAG peer, the peer link may require additional Ethernet interfaces to manage data traffic.

Disruptions to peer link connectivity due to forwarding agent restarts may cause an extended MLAG outage. Forwarding agent restart event include some configuration changes, such as port speed change or UFT mode change). The following precautions can reduce the risk of losing peer-link connectivity:
  • all switches: constructing peer-links from port-channels in preference to a single Ethernet interface.

     

  • modular systems: peer-link port-channel members should span multiple line cards.

     

  • multi-chip systems: peer-link port-channel member should span multiple chips.

     

Managing Switch Configuration Settings describes modular systems.

Configuring the Port Channels, VLAN Interfaces, and IP addresses

The peer link is a normal port channel. The local address is the SVI that maps to the peer link port channel. The port channel and SVI must be configured on each peer switch. The port channel should be an active LACP port. The local and peer addresses must be located on the same IP address subnet. Autostate should be disabled on the SVI configured as the local interface.

 

Examples
  • These commands create an active mode LACP port channel interface from two Ethernet interfaces and configure it as part of a trunk group on each switch.

    The switchport mode trunk command permits all VLANs on the interface by default, so all VLANs are permitted on port channel 10 in the following example. The configuration of a trunk group for a VLAN restricts only that specific VLAN to the associated ports: VLAN 4094 is only permitted on port channel 10, and not on any other ports on the switch. It is important to remember that all VLANs must be permitted between the peers on the peer link for correct operation.

     

    Switch 1

    switch1# config
    switch1(config)# vlan 4094
    switch1(config-vlan-4094)# trunk group m1peer
    switch1# config
    switch1(config)# interface ethernet 1-2
    switch1(config-if-et1-2)# channel-group 10 mode active
    switch1(config-if-et1-2)# interface port-channel 10
    switch1(config-if-po10)# switchport mode trunk
    switch1(config-if-po10)# switchport trunk group m1peer
    switch1(config-if-po10)# exit
    switch1(config)#

     

    Switch 2

    switch2# config
    switch2(config)# vlan 4094
    switch2(config-vlan-4094)# trunk group m1peer
    switch2(config-vlan-4094)# exit
    switch2(config)# interface ethernet 1-2
    switch2(config-if-et1-2)# channel-group 10 mode active
    switch2(config-if-et1-2)# interface port-channel 10
    switch2(config-if-po10)# switchport mode trunk
    switch2(config-if-po10)# switchport trunk group m1peer
    switch2(config-if-po10)# exit
    switch2(config)#

     

  • These commands create an SVI for the local interface and associate it to the trunk group assigned to the peer link port channel.

    The SVI creates a Layer 3 endpoint in the switch and enables MLAG processes to communicate via TCP. The IP address can be any unicast address that does not conflict with other SVIs. STP is disabled for the peer link vlan 4094 to prevent any potential STP disruption of inter peer communications. Recall that the VLAN has been restricted to port-channel 10 by the earlier trunk group configuration thus preventing potential Layer 2 loop conditions within vlan 4094.

     

    Switch 1

    switch1# config
    switch1(config)# interface vlan 4094
    switch1(config-if-vl4094)# ip address 10.0.0.1/30
    switch1(config-if-vl4094)# no autostate
    switch1(config-if-vl4094)# exit
    switch1(config)# no spanning-tree vlan-id 4094
    switch1(config)#

     

    Switch 2

    switch2# config
    switch2(config)# interface vlan 4094 
    switch2(config-if-vl4094)# ip address 10.0.0.2/30
    switch2(config-if-vl4094)# no autostate
    switch2(config-if-vl4094)# exit
    switch2(config)# no spanning-tree vlan-id 4094
    switch2(config)#

Configuring Peer Parameters

Peer connection parameters configure the connection between the MLAG peer switches. This section describes the following peer configuration parameters.
MLAG Configuration Mode

 

Peer connection parameters are configured in MLAG-configuration mode. The mlag configuration (global configuration) command places the switch in MLAG configuration mode.

 

Example

This command places the switch in MLAG configuration mode.

switch(config)# mlag configuration
switch(config-mlag)#

 

Local VLAN Interface

 

The local interface specifies the SVI upon which the switch sends MLAG control traffic. The local IP address is specified within the definition of the VLAN associated with the local interface. The Peer Address configures the control traffic destination on the peer switch.

The local-interface command specifies a VLAN interface as the peer link SVI.

 

Example

This command configures vlan 4094 as the local interface.

switch(config-mlag)# local-interface vlan 4094
switch(config-mlag)#
Peer Address

 

The peer address is the destination address on the peer switch for MLAG control traffic. If the peer IP address is unreachable, MLAG peering fails and both peer switches revert to their independent state.

The peer-address command specifies the peer address.

 

Example

This command configures a peer address of 10.0.0.2.

switch(config-mlag)# peer-address 10.0.0.2
switch(config-mlag)#

 

Domain ID

 

The MLAG domain ID is a unique identifier for an MLAG domain. The MLAG domain ID must be the identical on each switch to facilitate MLAG communication.

The domain-id command configures the MLAG domain ID.

 

Example

This command configures mlagDomain as the domain ID:

switch(config-mlag)# domain-id mlagDomain
switch(config-mlag)#

 

Heartbeat Interval and Timeout

 

The heartbeat interval specifies the period between the transmission of successive keepalive messages. Each MLAG switch transmits keepalive messages and monitors message reception from its peer. The heartbeat timeout is reset when the switch receives a keepalive message. If the heartbeat timeout expires, the switch disables MLAG under the premise that the peer switch is not functioning.

The heartbeat-interval (MLAG) command configures the heartbeat interval between 1 and 30 seconds, with a default value of 4 seconds. The heartbeat timeout expiry is 30 seconds.

 

Note: On 7500 and 7500E Series Switches, Arista recommends setting the heartbeat interval to 10 seconds.

 

 

Example

This command configures the heartbeat interval as 2500 milliseconds (2.5 seconds).

switch(config-mlag)# heartbeat-interval 2500
switch(config-mlag)#

 

Reload Delay Period

 

The reload delay period specifies the interval that non-peer links are disabled after an MLAG peer reboots. This interval allows non-peer links to learn multicast and OSPF states and synchronize ARP caches before the ports start handling traffic. Each Arista switch defaults to the recommended reload-delay value, which varies by switch platform.
  • Fixed configuration switches: 300 seconds (five minutes).

     

  • Trident II platform modular switches: 1200 seconds (twenty minutes).

     

  • Sand platform fixed configuration switches (7020 and 7280 series (except 7280CR2 and 7280SR2)): 600 seconds (ten minutes).

     

  • Sand platform modular switches: 1800 seconds (thirty minutes).

     

In those cases where network topology requires additional time to stabilize or where a shorter delay can be tolerated, the reload-delay period can be configured using the reload-delay mlag command.

 

Example

This command configures the reload delay interval as 2.5 minutes (150 seconds).

switch(config-mlag)# reload-delay 150
switch(config-mlag)#

 

Shutdown

 

The shutdown (MLAG) command disables MLAG operations without disrupting the MLAG configuration. The no mlag configuration command (global configuration mode) disables MLAG and removes the MLAG configuration. The no shutdown command resumes MLAG activity.

 

Examples
  • This command disables MLAG activity on the switch.
    switch(config-mlag)# shutdown
    switch(config-mlag)#

     

  • This command resumes MLAG activity on the switch.
    switch(config-mlag)# no shutdown
    switch(config-mlag)#

     

Configuring MLAG Peer Gateway

In an MLAG setup, routing on a MLAG peer switch is possible using its own bridge system MAC, VARP MAC, or VRRP MAC. On a peer receiving an IP packet with destination MAC set to one of these MACs, a packet gets routed if its hardware has enough information to route the packet. Configuring sending traffic to a cached MAC involves routing the session table and MLAG peer traffic if packets are received with the MAC peer.

 

Examples
  • This command enables the MLAG peer gateway.
    switch(config)# ip virtual-router mac-address mlag-peer
    switch1(config)#

     

  • This command disables the MLAG peer gateway.
    switch(config)# no ip virtual-router mac-address mlag-peer
    switch1(config)#

     

Configuring Ingress Replication to LAGs

Hardware support for ingress replication to LAGs is enabled by default when the user configures ingress replication. When multicast traffic is sent over the LAG, the hardware uses its built-in algorithm, based on the L2/L3/L4 headers, to load balance traffic over ports in the LAG. When a port goes down in a LAG, the hardware quickly hashes the multicast traffic over the remaining ports in the LAG, resulting in fewer drops than software based LAG support.

 

Examples
  • This command enables ingress replication.
    switch(config)# platform sand multicast replication default ingress
    switch(config)#

     

  • This command configures the maximum members (within a range of 1 through 64) for ingress only replication in a multicast group.
    switch(config)# platform sand multicast replication ingress maximum 32
    switch(config)#

     

Configuring MLAG Services

An MLAG is a pair of links that originate on a network attached device and terminate on the two MLAG peer switches. The MLAG switches coordinate traffic to the device through a common mlag (port-channel interface configuration) command on the interfaces that connect to the device.

The MLAG ID differs from the MLAG domain ID. The MLAG domain ID is assigned globally per switch in MLAG configuration mode, and the same MLAG domain ID must be on both switches.

Port channels configured as an MLAG must have identical port channel numbers. Although the MLAG ID is a distinct parameter from the port channel number, best practices recommend assigning the MLAG ID to match the port channel number.

 

Note: Arista recommends configuring the downstream switch or router connected to the MLAG peers to negotiate a LAG using LACP rather than configuring static LAGs. (On Arista switches, LACP is enabled using the command channel-group mode active. See Port Channels and LACP.) Using LAGs negotiated by LACP can help avoid problems caused by miscabling because LACP PDUs include the system ID and LACP key, which identify the switch and the LAG it belongs to. If MLAG miscabling happens using a LACP LAG, some ports become inactive in the LAG which prevents it from bridging traffic erroneously. More importantly, when the MLAG state is primary on one switch and inactive on another, the peer switches are acting as two independent L2 switches rather than as one logical L2 switch. In this scenario, the downstream switch will have its LAG (logical L2 port) connected to two distinct L2 switches, which can result in spanning tree problems on the downstream switch because it will receive BPDUs with different system IDs on the same LAG. If spanning tree is not running, an L2 loop will be created between MLAG peer switches and the downstream device. Allowing LACP to negotiate the downstream LAG avoids this problem because only ports connected to a given peer become active in the LAG, and the other set of ports cannot bridge traffic.

The example below does not follow this convention to emphasize the distinct parameters. The example in MLAG Implementation Example follows the best practices convention.

 

Examples

  • These switch1 commands bundle Ethernet interfaces 3 and 4 in port channel 20, then associate that port channel with mlag 12.
    switch1(config)# interface ethernet 3-4
    switch1(config-if-et3-4)# channel-group 20 mode active
    switch1(config-if-et3-4)# interface port-channel 20
    switch1(config-if-po20)# mlag 12
    switch1(config-if-po20)# exit
    switch1(config)#

     

  • These switch2 commands bundle Ethernet interfaces 9 and 10 in port channel 20, then associate that port channel with mlag 12.
    switch2(config)# interface ethernet 9-10
    switch2(config-if-et9-10)# channel-group 20 mode active
    switch2(config-if-et9-10)# interface port-channel 20
    switch2(config-if-po20)# mlag 12
    switch2(config-if-po20)# exit
    switch2(config)#

     

  • These commands configure the port channels that attach to the MLAG on network attached device:
    NAD(config)# interface ethernet 1-4
    NAD(config-if-Et1-4)# channel-group 1 mode active
    NAD(config-if-Et1-4)# exit
    NAD(config)#

     

The following figure displays the result of the interface MLAG configuration.

Figure 2. MLAG Interface Configuration

 

EVPN - MLAG Single-homed Hosts

Add a local VTEP to each MLAG peer for the control plane to advertise singly connected hosts directly behind a specific local VTEP-MLAG peer. Outgoing EVPN route advertisements contain nexthop and router MAC extended community when multi-VTEP MLAG mode is enabled. The following table summarizes the information. For symmetric IRB support, MLAG shared router MAC must be enabled.

Table 2. Route Advertisement
Routes Single-homed Host Multi-homed Host
MAC/IP routes (Type-2) Local VTEP IP / Bridge MAC MLAG VTEP IP / Shared MLAG Router MAC
IMET routes (Type-3) MLAG VTEP IP
IP Prefix routes (Type-5) Local VTEP IP / Bridge MAC

 

In multi-VTEP MLAG mode, IP prefix routes are advertised independently by each MLAG peer with its own local VTEP IP as nexthop, even when both peers are connected to that route. Additionally, egress VXLAN packets use the appropriate source IP address to match what is advertised by the EVPN control plane.

Displaying EVPN with MLAG Single-home Hosts

The following displays the nexthop address of locally generated EVPN Type-2 and Type-3 routes. The real IP address helps identify the VTEP in use. The nexthop of locally generated EVPN Type-5 routes are displayed as "-". The shared MLAG VTEP IP is 1.1.1.1 and the local VTEP IPs of the two MLAG peers are 1.0.1.1 and 1.0.2.2.

switch# show bgp evpn
BGP routing table information for VRF default
Router identifier 0.0.0.1, local AS number 300
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E - ECMP head, e - ECMP
                    S - Stale, c - Contributing to ECMP, b - backup
                    % - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop

Network	Next Hop		Metric	LocPref	Weight	Path
* >	RD: 1.0.1.1:200 mac-ip 52de.3c26.a0b0 10.2.0.2
                1.0.1.1		-		-	    0		i
* >	RD: 1.0.1.1:100 mac-ip 822c.0630.7ef4 10.1.0.2
                1.1.1.1 		-		-	   0		 i
	RD: 1.0.2.2:100 mac-ip 822c.0630.7ef4 10.1.0.2
                1.1.1.1 		-		100	 0		 i
* >	RD: 1.0.2.2:200 mac-ip 8650.1ecc.3595 10.2.0.3
                1.0.2.2 		-		100	  0		i
* >	RD: 1.0.1.1:100 imet 1.1.1.1
                1.1.1.1 		-		-	    0		i
* >	RD: 1.0.1.1:200 imet 1.1.1.1
                1.1.1.1 		-		-	     0	      i
* >	RD: 31000:300 ip-prefix 10.1.0.0/16
                -	 		-		-	    0		i
* 	RD: 31000:300 ip-prefix 10.1.0.0/16
                1.0.2.2	 	-		100         0		i

 

Configuration Considerations

  • The MLAG VTEP IP advertises BUM traffic. VXLAN flooded packets may be seen on the peer-link.

     

  • The singly connected interfaces or non-MLAG interfaces must be placed in an exclusive VLAN with an MLAG interface as a member.

     

  • Enable the MLAG shared router MAC to support symmetric IRB.

     

  • For an EVPN Type-5 setup, the VRF to VNI mapping must be configured on both VTEPs of the MLAG pair.

     

  • For an EVPN Type-5 setup as well as EVPN symmetric IRB setup, the VRF to VNI mapping must be configured identically across all the VTEPs in the network. The same VRF must be mapped to the same value of VNI on all the VTEPs that participate in the EVPN network.

     

Configuring MLAG Layer 2 Subinterfaces

To configure an MLAG L2 subinterface, first configure an MLAG interface, and then add an L2 subinterface to the interface on both peers. Once configured, an MLAG subinterface automatically inherits the MLAG ID of the parent interface to generate a unique MLAG ID.

For example, if configuring Port-Channel10 as MLAG 11, then the subinterface has the MLAG ID 11.1 as an implicit configuration.

When configuring an L2 subinterface, the parent interface must be a routed port. This does not comply with MLAG protocols as the MLAG interface must not be a routed port. An interface with the parameters, mlag 10 and no switchport, becomes ignored as an MLAG interface until you create L2 subinterfaces on that interface.

 

Example Configuration

The following commands add an MLAG L2 subinterface to switch1 and switch2:

switch1# conf
switch1(config)# interface ethernet 3-4
switch1(config-if-et3-4)# channel-group 10 mode active
switch1(config-if-et3-4)# interface port-channel 10
switch1(config-if-po10)# mlag 10
switch1(config-if-po10)# no switchport
switch1(config-if-po10)# interface port-channel 10.1
switch1(config-if-po10.1)# encapsulation dot1q vlan 10
switch1(config-if-po10.1)# vlan id 100
switch1(config-if-po10.1)# exit
switch1(config)#

 

 

switch2# conf
switch2(config)# interface ethernet 9-10
switch2(config-if-et9-10)# channel-group 10 mode active
switch2(config-if-et9-10)# interface port-channel 10
switch2(config-if-po10)# mlag 10
switch2(config-if-po10)# no switchport
switch2(config-if-po10)# interface port-channel 10.1
switch2(config-if-po10.1)# encapsulation dot1q vlan 10
switch2(config-if-po10.1)# vlan id 100
switch2(config-if-po10.1)# exit
switch2(config)#

 

To display information about MLAG L2 subinterfaces configured on a switch, use the show mlag subinterfaces command:

switch# show mlag subinterfaces
MLAG       Desc        Local Sub-Interface    Local Status
---------- ---------- ---------------------  -------------
10.1                           Po10.1             up
10.2                           Po10.2             up
10.3                           Po10.3             up
10.4                           Po10.4             up

 

If you have an MLAG interface with a routed port, but no subinterfaces configured, you may see output similar to the following:

switch(config)# show mlag interfaces
            
mlag       desc                 state       local       remote          status
---------- ---------- --------------------- ----------- ------------ ------------
10                             active-full       Po10         Po10           up/up
11                       disabled-ignored      Po11            -               -
12                             active-full       Po12         Po12           up/up

 

MLAG interface 11 has a routed port but no subinterfaces configured and returns the state disabled-ignored.

 

Configuring Forced Periodic ARP and NDP Refresh

To enable Forced Periodic ARP Refresh on an IPv4 network, use the following command:

switch(config-if-Et1)# arp aging refresh always

 

To enable Forced Periodic NDP Refresh on an IPv6 network, use the following command:

switch(config-if-Et1)# ipv6 nd cache refresh always

 

To disable the feature, use the following command with no or default prefix:

switch(config-if-Et1)# no arp aging refresh always

 

 

switch(config-if-Et1)# no ipv6 nd cache refresh always

 

MLAG Implementation Example

This example creates an MLAG Domain, then configures MLAG connections between the peer switches and four Network Attached Devices (NADs). The MLAG switches connect through a LAG and communicate with the NADs through MLAGs. Although the NADs can be any device that supports LACP LAGs, the devices in this example are Arista switches.

Figure 3. MLAG Implementation Example

 

Topology

Figure 3 displays the MLAG topology. Switch 1 and Switch 2 are MLAG peers that logically represent a single Layer 2 switch. The peer link between the switches contains the following interfaces:
  • Switch 1: ethernet 47, ethernet 48

     

  • Switch 2: ethernet 23, ethernet 24

     

The example configures MLAGs from the MLAG Domain to four network attached devices (NAD-1, NAD-2, NAD-3, NAD-4).

Configuring the Peer Switch Connections

To configure the switches in the described topology, perform the tasks in these sections:

Configuring the Peer Switch Port Channels

These commands create the port channels the switches use to establish the peer link.

These commands create port channels on Switch1
switch1(config)# interface ethernet 47-48
switch1(config-if-et47-48)# channel-group 101 mode active
switch1(config-if-et47-48)# interface port-channel 101
switch1(config-if-po101)# switchport mode trunk
switch1(config-if-po101)# switchport trunk group peertrunk
switch1(config-if-po101)# exit
switch1(config)#

 

These commands create port channels on Switch2
switch2(config)# interface ethernet 23-24
switch2(config-if-et23-24)# channel-group 201 mode active
switch2(config-if-et23-24)# interface port-channel 201
switch2(config-if-po201)# switchport mode trunk
switch2(config-if-po201)# switchport trunk group peertrunk
switch2(config-if-po201)# exit
switch2(config)#

 

Configuring the Peer Switch SVIs

For each peer switch, these commands create an SVI and associate it to the trunk group assigned to the peer link port channel. STP is disabled on the VLAN.

These commands configure the SVI on Switch1
switch1(config)# vlan 4094
switch1(config-vlan-4094)# trunk group peertrunk
switch1(config-vlan-4094)# interface vlan 4094
switch1(config-if-vl4094)# ip address 172.17.0.1/30
switch1(config-if-vl4094)# no autostate
switch1(config-if-vl4094)# exit
switch1(config)# no spanning-tree vlan-id 4094
switch1(config)#

 

These commands configure the SVI on Switch2
switch2(config)# vlan 4094
switch2(config-vlan-4094)# trunk group trunkpeer
switch2(config-vlan-4094)# interface vlan 4094
switch2(config-if-vl4094)# ip address 172.17.0.2/30
switch2(config-if-vl4094)# no autostate
switch2(config-if-vl4094)# exit
switch2(config)# no spanning-tree vlan-id 4094
switch2(config)#

 

Configuring the Peer Links

These commands create the peer links on each MLAG switch.

These commands create peer links on Switch1
switch1(config)# mlag configuration            
switch1(config-mlag)# local-interface vlan 4094          
switch1(config-mlag)# peer-address 172.17.0.2      
switch1(config-mlag)# peer-link port-channel 101            
switch1(config-mlag)# domain-id mlag_01               
switch1(config-mlag)# heartbeat-interval 2500            
switch1(config-mlag)# reload-delay 150             
switch1(config-mlag)# exit            
switch2(config)#

 

These commands create peer links on Switch2
switch2(config)# mlag configuration       
switch2(config-mlag)# local-interface vlan 4094           
switch2(config-mlag)# peer-address 172.17.0.1           
switch2(config-mlag)# peer-link port-channel 201                 
switch2(config-mlag)# domain-id mlag_01            
switch2(config-mlag)# heartbeat-interval 2500          
switch2(config-mlag)# reload-delay 150       
switch2(config-mlag)# exit            
switch2(config)#

 

Configuring Peer Switch MLAGs

These commands create the MLAGs that connect the MLAG domain to the network attached devices.

These commands configure MLAG 1 on Switch1

switch1(config)# interface ethernet 17-18
switch1(config-if-et17-18)# channel-group 1 mode active
switch1(config-if-et17-18)# interface port-channel 1
switch1(config-if-po1)# mlag 1
switch1(config-if-po1)# exit
switch1(config)#

 

These commands configure MLAG 1 on Switch2

switch2(config)# interface ethernet 1-2
switch2(config-if-et1-2)# channel-group 1 mode active
switch2(config-if-et1-2)# interface port-channel 1
switch2(config-if-po1)# mlag 1
switch2(config-if-po1)# exit
switch2(config)#

 

These commands configure MLAG 2 on Switch1

switch1(config)# interface ethernet 19-20
switch1(config-if-et19-20)# channel-group 2 mode active
switch1(config-if-et19-20)# interface port-channel 2
switch1(config-if-po2)# mlag 2
switch1(config-if-po2)# exit
switch1(config)#

 

These commands configure MLAG 2 on Switch2

switch2(config)# interface ethernet 3-4
switch2(config-if-et3-4)# channel-group 2 mode active
switch2(config-if-et3-4)# interface port-channel 2
switch2(config-if-po2)# mlag 2
switch2(config-if-po2)# exit
switch2(config)#

 

These commands configure MLAG 3 on Switch1

switch1(config)#  interface ethernet 23
switch1(config-if-et23)# channel-group 3 mode active
switch1(config-if-et23)# interface port-channel 3
switch1(config-if-po3)# mlag 3
switch1(config-if-po3)# exit
switch1(config)#

 

These commands configure MLAG 3 on Switch2

switch2(config)# interface ethernet 7
switch2(config-if-et7)# channel-group 3 mode active
switch2(config-if-et7)# interface port-channel 3
switch2(config-if-po3)# mlag 3
switch2(config-if-po3)# exit
switch2(config)#

 

These commands configure MLAG 4 on Switch1

switch1(config)# interface ethernet 25
switch1(config-if-et25)# channel-group 4 mode active
switch1(config-if-et25)# interface port-channel 4
switch1(config-if-po4)# mlag 4
switch1(config-if-po4)# exit
switch1(config)#

 

These commands configure MLAG 4 on Switch2

switch2(config)# interface ethernet 9
switch2(config-if-et9)# channel-group 4 mode active
switch2(config-if-et9)# interface port-channel 4
switch2(config-if-po4)# mlag 4
switch2(config-if-po4)# exit
switch2(config)#

 

Configuring the Network Attached Devices

These commands create the LAGs on the Network Attached Devices that connect to the MLAG domain.

These commands configure the port channels on NAD-1

NAD-1(config)# interface ethernet 7-10
NAD-1(config-if-Et7-10)# channel-group 1 mode active
NAD-1(config-if-Et7-10)# exit
NAD-1(config)#

 

These commands configure the port channels on NAD-2

NAD-2(config)# interface ethernet 25-28
NAD-2(config-if-Et25-28)# channel-group 7 mode active
NAD-2(config-if-Et25-28)# exit
NAD-2(config)#

 

These commands configure the port channels on NAD-3

NAD-3(config)# interface ethernet 3-4
NAD-3(config-if-Et3-4)# channel-group 5 mode active
NAD-3(config-if-Et3-4)# exit
NAD-3(config)#

 

These commands configure the port channels on NAD-4

NAD-4(config)# interface ethernet 1-2
NAD-4(config-if-Et1-2)# channel-group 2 mode active
NAD-4(config-if-Et1-2)# exit
NAD-4(config)#

 

Verification

Verify the Peer Switch Connection

To display the MLAG configuration and the MLAG status on switch 1, use the show mlag command:

 

switch1# show mlag    
MLAG Configuration:
domain-id         :            mlag_01
local-interface   :           Vlan4094
peer-address      :         172.17.0.2
peer-link         :    Port-Channel101

MLAG Status:
state             :             Active
peer-link status  :                 Up
local-int status  :                 Up
system-id         :  02:1c:FF:00:15:38

MLAG Ports:
Disabled          :   0
Configured        :   0
Inactive          :   0
Active-partial    :   0
Active-full       :   4

 

To display the MLAG configuration and the MLAG status on switch 2, use the show mlag command:

switch2# show mlag
MLAG Configuration:
domain-id         :            mlag_01
local-interface   :           Vlan4094
peer-address      :         172.17.0.1
peer-link         :    Port-Channel102

MLAG Status:
state             :             Active
peer-link status  :                 Up
local-int status  :                 Up
system-id         :  02:1c:FF:00:15:41

MLAG Ports:
Disabled          :   0
Configured        :   0
Inactive          :   0
Active-partial    :   0
Active-full       :   4

 

Verify the MLAGs

The show mlag interfaces command displays MLAG connections between the MLAG switches and the Network Attached Devices.
  • This show mlag interfaces command displays MLAG connections between the MLAG peer switch 1 and the network attached devices:
    switch1# show mlag interfaces
                                                                   local/remote
      mlag     desc                   state     local     remote         status
    ----------------------------------------------------------------------------
         1     sw1.po1          active-full       Po1        Po1          up/up
         2     sw1.po2          active-full       Po2        Po2          up/up
         3     sw1.po3          active-full       Po3        Po3          up/up
         4     sw1.po4          active-full       Po4        Po4          up/up

     

  • The following show mlag interfaces command, with the detail option, displays MLAG connections between the MLAG peer switch 1 and the network attached devices.
    switch2#show mlag interfaces detail
                                   local/remote
    mlag       state local remote   oper   config          last change  changes
    ----------------------------------------------------------------------------
       1 active-full   Po1    Po1  up/up  ena/ena  6 days, 2:08:28 ago        5
       2 active-full   Po2    Po2  up/up  ena/ena  6 days, 2:08:30 ago        5
       3 active-full   Po3    Po3  up/up  ena/ena  6 days, 2:08:33 ago        5
       4 active-full   Po4    Po4  up/up  ena/ena  6 days, 2:08:41 ago        5
    switch2#

     

Verify Spanning Tree Protocol (STP)

STP functions can be displayed from each peer switch. MLAG interfaces are displayed as a single entry. Configured interfaces on each switch that are not included in an MLAG are displayed. Local interfaces have the normal notation; remote interfaces are preceded by P or Peer.

VLAN Output 1: Assume VLAN 3903 includes MLAG 1
switch1# show spanning-tree vlan-id 3903
Spanning tree instance for vlan 3903
VL3903
  Spanning tree enabled protocol rapid-pvst
  Root ID    Priority    36671
             Address     001c.730c.3009
             Cost        1999 (Ext) 0 (Int)
             Port        105 (Port-Channel5)
             Hello Time  2.000 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    36671  (priority 32768 sys-id-ext 3903)
             Address     021c.7300.1319
             Hello Time  2.000 sec  Max Age 20 sec  Forward Delay 15 sec

Interface        Role       State      Cost      Prio.Nbr Type
---------------- ---------- ---------- --------- -------- --------------------
Po1              root       forwarding 1999      128.105  P2p
switch1#

 

The output displays mlag 1 under its local interface name (Po1). A peer interface is not displayed because spanning tree considers the local and remote Port Channels as a single MLAG interface.

VLAN Output 2: Assume VLAN 3908 does not include any MLAGs
switch1# show spanning-tree vlan-id 3908
Spanning tree instance for vlan 3908
VL3908
  Spanning tree enabled protocol rapid-pvst
  Root ID    Priority    36676
             Address     021c.7300.1319
             This bridge is the root

  Bridge ID  Priority    36676  (priority 32768 sys-id-ext 3908)
             Address     021c.7300.1319
             Hello Time  2.000 sec  Max Age 20 sec  Forward Delay 15 sec

Interface        Role       State      Cost      Prio.Nbr Type
---------------- ---------- ---------- --------- -------- ---------------
Et17             designated forwarding 2000      128.217  P2p
Et18             designated forwarding 2000      128.218  P2p
PEt17            designated forwarding 2000      128.17   P2p
PEt18            designated forwarding 2000      128.18   P2p

 

The output displays all interfaces from both switches. Each interface is explicitly displayed because they are individual units that STP must consider when selecting ports to block.

  • Et17 and Et18 are located on the switch where the show spanning-tree command is issued.
  • PEt17 and PEt18 are located on the remote switch from where the command was issued

An identical command issued on the peer switch displays similar information.

Verify the MLAG does not create topology loops (show spanning-tree blocked)
switch1# show spanning-tree blocked
Name       Blocked Interfaces List
------------------------------------------------------

Number of blocked ports (segments) in the system : 0
switch1#

 

Verify the MLAG Port Channel

Issue the command show port-channel for channels 1-4 from switch 1:

switch# show port-channel 1-4
Port Channel Port-Channel1:
  Active Ports: Ethernet17     Ethernet18     PeerEthernet1 PeerEthernet2
Port Channel Port-Channel2:
  Active Ports: Ethernet19     Ethernet20     Ethernet21     Ethernet22
                PeerEthernet3 PeerEthernet4 PeerEthernet5 PeerEthernet6
Port Channel Port-Channel3:
  Active Ports: Ethernet23     Ethernet24     PeerEthernet7 PeerEthernet8
Port Channel Port-Channel4:
  Active Ports: Ethernet25     Ethernet26     PeerEthernet9 PeerEthernet10

 

Issue the command show port-channel load-balance fields detailed command for channel 1 from switch 2:

switch2# show port-channel 1 detailed
Port Channel Port-Channel1:
  Active Ports:
       Port                Time became active       Protocol    Mode
    -----------------------------------------------------------------------
       Ethernet17          7/7/11 15:27:36          LACP        Active
       Ethernet18          7/7/11 15:27:36          LACP        Active
       PeerEthernet1       7/7/11 15:27:36          LACP        Active
       PeerEthernet2       7/7/11 15:27:36          LACP        Active

 

Verify the VLAN Membership

The show vlancommand displays VLAN member ports, including MLAG ports and ports on each peer not bundled in an MLAG.

Switch1# show vlan 3903, 3908
VLAN  Name                             Status    Ports
----- -------------------------------- --------- -------------------------------
3903  ar.mg.rn.172.17.254.16/29        active    Cpu, Po1
3908  po.ra.ar.mg.172.17.254.64/29     active    Cpu, Et17, Et18, PEt17, PEt18

 

MLAG Commands

arp aging refresh always

The arp aging refresh always command enables the switch to send forced periodic ARP requests for an MLAG configuration in an IPv4 network. This may be necessary to prevent the VMAC from aging out on downstream switches. Using the no or default disables the feature.

 

Command Mode

Interface Configuration Mode

 

Command Syntax

arp aging refresh always

no arp aging refresh always

default arp aging refresh always

 

Example

Use the following command to enable Forced Periodic ARP requests on the switch:

switch(config-if-Et1)#arp aging refresh always

domain-id

The domain-id command specifies a name for the Multi-chassis Link AGgregation (MLAG) domain.

The no domain-id and default domain-id commands remove the MLAG domain name by deleting the domain-id statement from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

domain-id identifier

no domain-id

default domain-id

 

Parameter

identifier     alphanumeric string that names the MLAG domain.

 

Example

This command names the MLAG domain mlag1.

switch(config)# mlag
switch(config-mlag)# domain-id mlag1
switch(config-mlag)#

dual-primary detection delay

Use the dual-primary detection delay command to configure a dual primary detection delay with an optional action to errdisable all interfaces on secondary MLAG peer after a dual primary condition is detected.

 

Command Mode

MLAG configuration mode

 

Command Syntax

dual-primary detection delay seconds [action erridisable all-interfaces]

no dual-primary detection delay seconds [action erridisable all-interfaces]

default dual-primary detection delay seconds [action erridisable all-interfaces]

 

Parameters
  • seconds Dual primary detection delay in seconds.
  • actionSpecifies the action when dual-primary is detected.
  • erridisableErrdisable interfaces.
  • all-interfaces Disables all Ethernet interfaces except the peer-link.

     

Examples
  • In this example, the command errdisables all physical interfaces on secondary MLAG peer when dual primary condition is detected.
    switch(config-mlag)# dual-primary detection delay 5 action errdisable all-interfaces

    Both MLAG peers must have equivalent configurations.

     

  • The following command removes the Dual Primary Detection feature. You must unconfigure both MLAG peers.
    switch(config-mlag)# no dual-primary detection

dual-primary recovery delay

Use the dual-primary recovery delay command to configure dual-primary detection recovery-delay for MLAG interfaces and non-MLAG interfaces. Negating the configurations or configuring default values makes both recovery delay values reset back to 0. The non-MLAG delay must always be less than the MLAG delay so you have more time for L3 convergence before enabling MLAG interfaces.

 

Command Mode

MLAG configuration mode

 

Command Syntax

dual-primary recovery delay mlag seconds non-mlag seconds

no dual-primary recovery delay mlag seconds non-mlag seconds

default dual-primary recovery delay mlag seconds non-mlag seconds

 

Parameters
  • mlag seconds Delay in seconds after dual-primary detection resolves until non peer-link ports that are part of an MLAG are enabled. Range 0 - 1000 seconds. A suggested value for MLAG is 60 seconds. These values can be adjusted depending on the network scale.

     

  • non-mlag seconds Delay in seconds after dual-primary detection resolves until ports that are not part of an MLAG are enabled. Range 0 - 1000 seconds. A suggested value for non-MLAG is 0 seconds. These values can be adjusted depending on the network scale.

     

Example

switch(config)# mlag
switch(config-mlag)# dual-primary recovery delay mlag 60 non-mlag 0

heartbeat-interval (MLAG)

The heartbeat-interval command configures the interval at which heartbeat messages are issued in a Multi-chassis Link AGgregation (MLAG) configuration.

The no heartbeat-interval and default heartbeat-interval commands revert the heartbeat interval to the default setting by removing the heartbeat-interval command from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

heartbeat-interval period

no heartbeat-interval

default heartbeat-interval

 

Parameters

period     Interval duration in milliseconds. Value ranges from 1000 through 30000 milliseconds. Default interval is 4000 milliseconds.

 

Guidelines

Heartbeat messages flow independently in both directions between the MLAG peers. If a peer stops receiving heartbeat messages within the expected time frame (30 seconds), the other peer can assume it no longer functions and without intervention or repair, the MLAG becomes disabled. Both switches revert to their independent state.

 

Note: On 7500 and 7500E Series Switches, Arista recommends setting the heartbeat interval to 10 seconds.

 

 

Example

This command configures the heartbeat interval to 15000 milliseconds:
switch(config)# mlag
switch(config-mlag)# heartbeat-interval 15000
switch(config-mlag)#

ipv6 nd cache refresh always

The ipv6 nd cache refresh always command enables the switch to send forced periodic ARP requests for an MLAG configuration in an IPv6 network. This may be necessary to prevent the VMAC from aging out on downstream switches. Using the no or default disables the feature.

 

Command Mode

Interface Configuration Mode

 

Command Syntax

ipv6 nd cache refresh always

no ipv6 nd cache refresh always

default ipv6 nd cache refresh always

 

Example

Use the following command to enable Forced Periodic ARP requests on the switch:

switch(config-if-Et1)# ipv6 nd cache refresh alwayss

local-interface

The local-interface command assigns a VLAN interface for use in Multi-chassis Link AGgregation (MLAG) configurations. The VLAN interface is used for both directions of communication between the MLAG peers.

The no local-interface and default local-interface commands delete the VLAN interface assignment by removing the local-interface command from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

local-interface vlan vlan_number

no local-interface

default local-interface

 

Parameter

vlan_number     VLAN number, in the range from 1 through 4094.

 

Guidelines

When configuring the local interface, the VLAN interface must exist already. To configure a VLAN interface, issue the command interface vlan.

 

Example

This command assigns VLAN 4094 as the local interface.

switch(config)# mlag
switch(config-mlag)# local-interface vlan 4094
switch(config-mlag)#

mlag (port-channel interface configuration)

The mlag command assigns an MLAG ID to a port-channel. MLAG peer switches form an MLAG when each switch configures the same MLAG ID to a port-channel interface. Only one MLAG ID can be assigned to an interface. An individual MLAG number cannot be assigned to more than one interface.

The no mlag and default mlag commands remove the MLAG ID assignment from the configuration mode interface by deleting the corresponding mlag command from running-config.

 

Command Mode

Interface-Port Channel Configuration

 

Command Syntax

mlag number

no mlag

default mlag

 

Parameter

number     Number used as MLAG ID. Value ranges from 1 to 2000.

 

Example

These commands configures a port channel and assigns it mlag 4.

switch(config)# interface ethernet 5-10
switch(config-if-Et5-10)# channel-group 1 mode active
switch(config-if-Et5-10)# interface port-channel 4
switch(config-if-Po4)# switchport trunk group group4
switch(config-if-Po4)# mlag 4
switch(config-if-Po4)# exit
switch(config)#

peer-address

The peer-address command specifies the peer IPv4 address for a Multi-chassis Link AGgregation (MLAG) domain. MLAG control traffic, including keepalive messages, is sent to the peer IPv4 address. If the peer IPv4 address is unreachable, then MLAG peering fails and both peer switches revert to their independent state.

The no peer-address and default peer-address commands remove the MLAG peer’s IPv4 address assignment by deleting the peer-address command from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

peer-address ipv4_addr

no peer-address

default peer-address

 

Parameter

ipv4_addr     MLAG peer IPv4 address.

 

Example

These commands configure the MLAG peer address.

switch(config)# mlag
switch(config-mlag)# peer-address 10.0.0.2
switch(config-mlag)#

peer-address heartbeat

The peer-address heartbeat command causes the MLAG agent to start using Peer-IP address in the given VRF for UDP-based heartbeat control messages.

To enable MLAG dual primary detection feature, the command must be configured on both MLAG peers in the MLAG configuration mode.

 

Note:The command supports both IPv4 and IPv6 addresses.

 

Command Mode

MLAG configuration mode

Command Syntax

peer-address heartbeat [Peer-IPv4 | Peer-IPv6] [vrf vrf_name]

no peer-address heartbeat [Peer-IPv4 | Peer-IPv6] [vrf vrf_name]

default peer-address heartbeat [Peer-IPv4 | Peer-IPv6] [vrf vrf_name]

 

Parameters
  • Peer-IP The Management IP address of the MLAG peer reachable in the VRF VRF-NAME (or default VRF if there is no VRF configured).
  • vrf vrf_name Named VRF.

     

Examples
  • switch(config)# mlag
    switch(config-mlag)# peer-address heartbeat 172.30.118.190

     

  • This example removes the feature.
    switch(config-mlag)# no peer-address heartbeat

peer-link

The peer-link command specifies the interface that connects Multi-chassis Link AGgregation (MLAG) peers. To form an MLAG, two switches are connected through an interface called a peer link. The peer link carries control and data traffic between the two switches. Control traffic includes MLAG-related advertisements and keepalive messages. This information keeps the two switches working as one.

The no peer-link and default peer-link command remove the peer link by deleting the peer-link command from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

peer-link INT_NAME

no peer-link

default peer-link

 

Parameters

INT_NAME denotes the interface type and number of the interface. Values include:

  • ethernet e_num     Ethernet interface range specified by e_num.
  • port-channel p_num     Channel group interface range specified by p_num.

     

Example

These commands creates a peer link.

switch(config)# mlag configuration
switch(config-mlag)# peer-link port-channel 10
switch(config-mlag)

mlag configuration (global configuration)

The mlag configuration command enters MLAG configuration mode to configure Multi-chassis Link AGgregation (MLAG) features. MLAG configuration mode is not a group change mode; running-config is changed immediately after commands are executed. The exit command does not affect the configuration.

The no mlag configuration and default mlag configuration commands remove all MLAG configuration commands from running-config.

The exit command returns the switch to global configuration mode.

 

Command Mode

Global Configuration

 

Command Syntax

mlag configuration

no mlag configuration

default mlag configuration

mlag and mlag configuration are identical commands.

 

Guidelines

An MLAG is formed by connecting two switches through an interface called a peer link. The peer link carries control and data traffic between the switches, including advertisements and keepalive messages. This information coordinates the switches. Functioning peers are in the active state.

Each peer switch uses IP-level connectivity between their local addresses and the MLAG peer IP address to form and maintain the peer link.

 

Commands Available in MLAG Configuration Mode

 

Example

These commands enter MLAG configuration mode and configure MLAG parameters:
switch(config)# mlag
switch(config-mlag)# local-interface vlan 4094
switch(config-mlag)# peer-address 10.0.0.2
switch(config-mlag)# peer-link port-channel 10
switch(config-mlag)# domain-id mlagDomain
switch(config-mlag)# heartbeat-interval 2500
switch(config-mlag)# reload-delay 2000
switch(config-mlag)# exit
switch(config)#

reload-delay mlag

The reload-delay mlag command configures the reload delay period for MLAG links. The command also specifies the reload delay period for non-MLAG links when the reload-delay non-mlag command is not configured.

Each Arista switch defaults to the recommended reload-delay value, which varies by switch platform:

  • Fixed configuration switches: 300 seconds
  • Trident II modular switches: 1200 seconds
    • 7304
    • 7308
    • 7316
    • 7300X series

       

  • Sand platform fixed configuration switches: 600 seconds
    • 7280 series (except 7280CR2 and 7280SR2)
    • 7020 series

       

  • Sand platform modular switches: 1800 seconds
    • 7504
    • 7508
    • 7500E series
    • 7548S

       

  • Sand Jericho+ fixed configuration switches: 900 seconds
    • 7280CR2 series
    • 7280SR2 series

       

The no reload-delay mlag and default reload-delay mlag commands restore the default value by deleting the reload-delay mlag statement from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

reload-delay [mlag] PERIOD

no reload-delay [mlag]

default reload-delay [mlag]

 

Parameters

  • PERIOD     Period that non-peer links are disabled after an MLAG peer reboots. Options include:
    • infinity     link is not enabled after reboot.
    • 0 to 86400     disabled link interval (seconds). Default varies by switch platform as described above.

       

Guidelines

The reload-delay and reload-delay mlag commands are equivalent.

 

Example

These commands configure the reload-delay interval to 15 minutes.

switch(config)# mlag configuration
switch(config-mlag)# reload-delay mlag 900
switch(config-mlag)#

reload-delay mode

The reload-delay mode command specifies the state of LACP LAG ports during the MLAG reload delay period. By default, MLAG ports remain in the errdisabled state during reload delay. This command configures MLAG ports to come up to standby mode before the expiration of the reload delay period.

The no reload-delay mode and default reload-delay mode commands restore the default behavior of MLAG ports by deleting the reload-delay mode statement from running-config. The default behavior is for the MLAG ports to remain in the errdisabled state until the expiration of the reload delay period

 

Command Mode

MLAG Configuration

 

Command Syntax

reload-delay mode lacp standby

no reload-delay mode

default reload-delay mode

 

Related Commands

reload-delay mlag configures the MLAG reload delay period.

 

Example

These commands configure the MLAG port to come up to standby state before the end of the reload delay period.

switch(config)# mlag configuration
switch(config-mlag)# reload-delay mode lacp standby
switch(config-mlag)#

reload-delay non-mlag

The reload-delay non-mlag command specifies the period that non-MLAG links are disabled after an MLAG peer reboots. This interval allows non peer links to learn multicast and OSPF states before the ports start handling traffic. The recommended minimum value required to ensure the forwarding hardware is initialized with the topology state depends on the switch platform:
  • Fixed configuration switches: 300 seconds (five minutes.)

     

  • Sand platform fixed configuration switches (7020 and 7280 series (except 7280CR2 and 7280SR2)): 600 seconds (ten minutes.)

     

  • Modular switches: 1200 seconds (twenty minutes.)

     

When the reload-delay non-mlag command is not configured, the reload-delay mlag command specifies the reload delay time for non-MLAG and MLAG links.

The no reload-delay non-mlag and default reload-delay non-mlag command restores the default behavior by deleting the reload-delay non-mlag statement from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

reload-delay non-mlag PERIOD

no reload-delay non-mlag

default reload-delay non-mlag

 

Parameters

PERIOD     Period that non-MLAG links are disabled after an MLAG peer reboots. Options include:
  • infinity     links are not enabled after reboot.

     

  • 0 to 86400     disabled link interval (seconds). Values range from 0 to 86400 (24 hours).

     

Example

These commands configure the reload-delay interval of non-MLAG links to 20 minutes.

switch(config)# mlag configuration
switch(config-mlag)# reload-delay non-mlag 1200
switch(config-mlag)#

show mlag interfaces members

The show mlag interfaces members command displays information about the Multi-chassis Link AGgregation (MLAG) members on bridged Ethernet interfaces.

 

Command Mode

EXEC

 

Command Syntax

show mlag interfaces members

 

Example

This command displays the MLAG interface members.

switch# show mlag interface members
Mlag4 is Port-Channel4
  Active Ports: Ethernet3 PeerEthernet3
Mlag5 is Port-Channel5
  Active Ports: Ethernet14
Mlag7 is Port-Channel7
  Active Ports: Ethernet5 PeerEthernet5
Mlag8 is Port-Channel8
  Active Ports: Ethernet10 PeerEthernet10
Mlag9 is Port-Channel9
  Active Ports: Ethernet15 Ethernet21 PeerEthernet19 PeerEthernet20
Mlag10 is Port-Channel10
  Active Ports: Ethernet19 Ethernet20 PeerEthernet21 PeerEthernet22
switch#

show mlag interfaces states

The show mlag interfaces states command displays information about the Multi-chassis Link AGgregation (MLAG) states on bridged Ethernet interfaces.

 

Command Mode

EXEC

 

Command Syntax

show mlag interfaces [MLAGS] states [ STATE_NAMES][INFO_LEVEL]

 

Parameters
  • MLAGS     MLAG channels for which command displays data. Options include:
    • no parameter     command displays data for all MLAGs.
    • mlag_id     specifies MLAG for which command displays data. Value ranges from 1 to 2000.

       

  • STATE_NAMES     MLAG channels for which command displays data. Parameter may specify more than one name, which can be listed in any order. Valid state names include:
    • active-full     includes active-full interfaces.
    • active-partial     includes active-partial interfaces.
    • configured     includes configured interfaces.
    • disabled     includes disabled interfaces.
    • inactive     includes inactive interfaces.

       

  • INFO_LEVEL     specifies information displayed by command. Options include:
    • no parameter     command displays basic MLAG interface parameters.
    • detail     command displays detailed MLAG interface state parameters.

       

Example

This command displays the MLAG interface states that are active-full.

switch# show mlag interfaces states active-full
                                                                   local/remote
  mlag     desc                       state     local     remote         status
-------- -------------------- --------------- --------- ---------- ------------
     4     b.po1                active-full       Po4        Po4          up/up
     7     ar.mg.au.po1         active-full       Po7        Po7          up/up
     8     co.po1               active-full       Po8        Po8          up/up
     9     k.po5                active-full       Po9        Po9          up/up
    10     ar.mg.pt.ir.po10     active-full      Po10       Po10          up/up
switch#

show mlag interfaces

The show mlag interfaces command displays information about the Multi-chassis Link AGgregation (MLAG) configuration on bridged Ethernet interfaces.

 

Command Mode

EXEC

 

Command Syntax

show mlag interfaces [MLAGS][INFO_LEVEL]

 

Parameters
  • MLAGS     MLAG channels for which command displays data. Options include:
    • no parameter     command displays data for all MLAGs.
    • mlag_id     specifies MLAG for which command displays data. Value ranges from 1 to 2000.

       

  • INFO_LEVEL     specifies information displayed by command. Options include:
    • no parameter     command displays basic MLAG interface parameters.
    • detail     command displays detailed MLAG interface parameters.

       

Example

This command displays output from the show mlag interfaces detail command:

switch> show mlag interfaces detail
                                local/remote
mlag       state local remote   oper   config          last change  changes
----------------------------------------------------------------------------
   4 active-full   Po4    Po4  up/up  ena/ena  6 days, 1:19:26 ago        5
   5 active-full   Po5    Po5  up/up  ena/ena  6 days, 1:19:24 ago        5
   6 active-full   Po6    Po6  up/up  ena/ena  6 days, 1:19:23 ago        5
   7 active-full   Po7    Po7  up/up  ena/ena  6 days, 1:19:23 ago        5

show mlag issu warnings

The show mlag issu warnings command displays a warning message regarding the backward-compatibility of this feature before you upgrade.

 

Command Mode

EXEC

 

Command Syntax

show mlag issu warnings

 

Example

This command displays the MLAG backward-compatibility warning message. Refer to the MLAG ISSU Compatibility Matrix for details about upgrading the configuration.

switch# show mlag issu warnings
Please use the MLAG ISSU Compatibility Check tool at https://www.arista.com/en/support/mlag-portal to verify ISSU compatibility.
If you are performing an upgrade, and the Release Notes for the new version of EOS indicate that MLAG is not backwards-compatible 
with the currently installed version (4.28.8.1M), the upgrade will result in packet loss.

Stp is not restartable. Topology changes will occur during the upgrade
process.

switch#

 

show mlag subinterfaces

The show mlag subinterfaces command displays information about MLAG Layer 2 subinterfaces configured on a switch.

 

Command Mode

EXEC

 

Command Syntax

show mlag subinterfaces

 

Parameters

1_2048 - Specify the MLAG interface ID.

 

Example

To display information about MLAG L2 subinterfaces configured on a switch, use the show mlag subinterfaces command:

switch# show mlag subinterfaces
MLAG       Desc        Local Sub-Interface    Local Status
---------- ---------- ---------------------  -------------
10.1                           Po20.1             up
10.2                           Po20.2             up
10.3                           Po20.3             up
11.1                           Po11.1             up

 

show mlag

The show mlag command displays information about the Multi-chassis Link AGgregation (MLAG) configuration on bridged Ethernet interfaces.

 

Command Mode

EXEC

 

Command Syntax

show mlag [INFO_LEVEL]

 

Parameters

INFO_LEVEL     specifies information displayed by command. Options include:
  • no parameter     command displays MLAG configuration, status, and ports.
  • detail     command displays MLAG configuration, status, ports, and detailed status.

     

Example

This command displays output from the show mlag command:

switch> show mlag
MLAG Configuration:
domain-id         :         ar.mg.mlag
local-interface   :           Vlan3901
peer-address      :       172.17.254.2
peer-link         :      Port-Channel1

MLAG Status:
state             :             Active
peer-link status  :                 Up
local-int status  :                 Up
system-id         :  02:1c:73:00:13:19

MLAG Ports:
Disabled          :   0
Configured        :   0
Inactive          :   0
Active-partial    :   0
Active-full       :   5
switch>

shutdown (MLAG)

The shutdown command disables MLAG on the switch without modifying the MLAG configuration.

The no shutdown and default shutdown commands re-enable MLAG by removing the shutdown command from running-config.

 

Command Mode

MLAG Configuration

 

Command Syntax

shutdown

no shutdown

default shutdown

 

Example

These commands disable MLAG on the switch.

switch(config)# mlag configuration
switch(config-mlag)# shutdown
switch(config-mlag)#

Data Transfer

Arista switches support the transfer of packets (network layer) and frames (data link layer). This chapter describes concepts and processes that are referenced by routing and switching protocols that Arista switches support.

Data Transfer Introduction

Arista switches transfer data through switching, routing, and Layer 3 switching. This chapter provides an introduction to these transfer methods.

Data structures and processes that support data transfer methods and referenced in specific protocol chapters are also described, including:
  • routed ports
  • switched ports
  • MAC address table
  • port mirroring
  • storm control
  • loopback interfaces
  • route redistribution
  • null0 interfaces
  • MTUs

Data Transfer Methods

This section describes these data transfer methods:

Switching and Bridging

Switching and bridging operations transmit data link layer frames between devices within a single subnet. Each port is assigned a 48 bit Media Access Control (MAC) address. Frames arriving at a hub are bridged, or sent to all other ports on the subnet. Switches can associate ports with their MAC addresses, obviating the need to flood the subnet when sending a frame.

Subnets in the switch are defined by VLANs. A Virtual Local Area Network (VLAN) is a group of devices that are configured to communicate as if they are attached to the same network regardless of their physical location. VLANs describes VLANS.

Four MAC address types identify the scope of LAN interfaces that an address represents:
  • unicast: represents a single interface.

  • broadcast: represents all interfaces.

  • multicast: represents a subset of all interfaces.

  • reserved: assigned to nodes that have no configured MAC address.

The Individual/Group (I/G) bit distinguishes unicast MAC addresses from multicast addresses. As shown in Figure 1 , the I/G bit is the least significant bit of the most significant byte in a MAC address.

MAC Address Format

Figure 1. MAC Address Format
  • Unicast address: the I/G bit is 0: 1234.1111.1111 is a unicast MAC address (the most significant byte is an even number).
    • Reserved address: all bits set to 0 (0000.0000.0000).

  • Multicast address: the I/G bit is 1: 1134.1111.1111 is a multicast MAC address (the most significant byte is an odd number).

  • Broadcast address: all bits set to 1 (FFFF.FFFF.FFFF).

Examples
  • The following are unicast MAC addresses:
    0200.0000.0000
    1400.0000.0000

  • The following are multicast MAC addresses:
    0300.0000.0000
    2500.0000.0000

The following sections describe MAC address functions and data structures:

Routing

Routing transmits network layer packets over connected independent subnets. Each subnet is assigned an IP address range and each device on the subnet is assigned an IP address from that range. Connected subnets have IP address ranges that do not overlap. A router connects multiple subnets. Routers forward inbound packets to the subnet whose address range includes the packets’ destination address.

IPv4 and IPv6 are internet layer protocols that facilitate packet-switched networking, including transmissions across multiple networks.

These chapters describe available IP features:

Static Routing

Static routes are entered through the CLI and are typically used when dynamic protocols are unable to establish routes to a specified destination prefix. Static routes are also useful when dynamic routing protocols are not available or appropriate.

Creating a static route associates a destination IP address with a local interface. The routing table refers to these routes as connected routes that are available for redistribution into routing domains defined by dynamic routing protocols.

These sections describe static route configuration commands:

Dynamic Routing

Dynamic routes are established by dynamic routing protocols. These protocols also maintain the routing table and modify routes to adjust for topology or traffic changes. Routing protocols assist the switch in communicating with other devices to exchange network information, maintaining routing tables, and establishing data paths.

Layer 3 Switching

Layer 3 switches establish data paths through routing processes (Layer 3) and transfer data as a switch (Layer 2) through speed-optimized hardware. Layer 3 switches use a control plane (routing) and data plane (switching) to manage these processes.

Control plane

The control plane builds and maintains the IP routing table, which identifies IP packet routes in terms of destination addresses. The routing table defines a route by its next hop address and the egress interface that accesses the next hop.

The control plane derives routing information from three sources:
  • Status of physical and virtual interfaces on the switch.
  • Static routes entered through the CLI.
  • Routes established through dynamic routing protocols.
Applying an ACL to the Control Plane

The control plane supports routing and management functions, handling packets that are addressed to the switch without regard to any switch interface.

To apply an IP ACL to the control plane, enter ip access-group (Control Plane mode) in control-plane mode. The system control-plane command places the switch in control-plane mode.

ACLs and Route Mapsdescribes access control lists.

Example
These commands place the switch in control-plane mode and assigns CP-Test1 to the control plane.
switch(config)# system control-plane
switch(config-system-cp)# ip access-group CP-Test1 in
switch(config-system-cp)#

Data plane

The data plane routes IP packets based on information derived by the control plane. Each packet’s path includes Layer 2 addresses that reach its next hop destination. The data plane also performs other operations required by IP routing, such as recalculating IP header checksums and decrementing the Time-To-Live (TTL) field.

Arista data planes support these packet forwarding modes:
  • Store and forward: the switch accumulates entire packets before forwarding them.
  • Cut through: the switch begins forwarding frames before their reception is complete.

Cut through mode reduces switch latency at the risk of decreased reliability. Packet transmissions can begin immediately after the destination address is processed. Corrupted frames may be forwarded because packet transmissions begin before CRC bytes are received.

Packet forwarding mode availability varies by switch platform:
  • Arad: store and forward mode only.
  • FM6000: both modes are available.
  • Petra: store and forward mode only.
  • Trident: both modes are available.
  • Trident II: both modes are available.

The data plane is also referred to as the forwarding plane.

Data Plane Forwarding Mode Configuration

The switch forwarding-mode command specifies the forwarding mode of the switch's data plane. This command is available on Trident, Trident II, and FM6000 platform switches. The forwarding mode is store-and-forward on Arad and Petra platform switches.

Examples
  • This command changes the forwarding mode to store-and-forward.
    switch(config)# switch forwarding-mode store-and-forward
    switch(config)#
  • The show switch forwarding-mode command displays the switch’s forwarding mode.
    switch(config)# show switch forwarding-mode
    Current switching mode:    store and forward
    Available switching modes: cut through, store and forward

MAC Address Table

The switch maintains a MAC address table for switching frames efficiently between ports. The MAC address table contains static and dynamic MAC addresses.
  • Static MAC addresses are entered into the table through a CLI command.

  • Dynamic MAC addresses are entered into the table when the switch receives a frame whose source address is not listed in the MAC address table. The switch builds the table dynamically by referencing the source address of frames it receives.

MAC Address Table Configuration

These sections describe MAC address table configuration tasks.

Static MAC Address Table Entries

The MAC address table accepts static MAC addresses, including multicast entries. Each table entry references a MAC address, a VLAN, and a list of Layer 2 (Ethernet or port channel) ports. The table supports three entry types: unicast drop, unicast, and multicast.
  • A drop entry does not include a port.

  • A unicast entry includes one port.

  • A multicast entry includes at least one port.

Packets with a MAC address (source or destination) and VLAN specified by a drop entry are dropped. Drop entries are valid for only unicast MAC addresses.

The mac address-table static command adds a static entry to the MAC address table.

Examples
  • This command adds a static entry for unicast MAC address 0012.3694.03ec to the MAC address table.
    switch(config)# mac address-table static 0012.3694.03ec vlan 3 interface Ethernet 
    7
    switch(config)# show mac address-table static
              Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports      Moves   Last Move
    ----    -----------       ----        -----      -----   ---------
       3    0012.3694.03ec    STATIC      Et7
    Total Mac Addresses for this criterion: 1
    
              Multicast Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
    Total Mac Addresses for this criterion: 0
    
    switch(config)#

  • This command adds the static entry for the multicast MAC address 0112.3057.8423 to the MAC address table.
    switch(config)# mac address-table static 0112.3057.8423 vlan 4 interface 
    port-channel 10 port-channel 12
    switch(config)# show mac address-table
              Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports      Moves   Last Move
    ----    -----------       ----        -----      -----   ---------
    Total Mac Addresses for this criterion: 0
    
              Multicast Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
       4    0112.3057.8423    STATIC      Po10 Po12
    Total Mac Addresses for this criterion: 1
    switch(config)#

Dynamic MAC Address Table Entries

Learning Mode

The switch maintains a MAC address table for switching frames efficiently between VLAN ports. When the switch receives a frame, it associates the MAC address of the transmitting interface with the recipient VLAN and port. When MAC address learning is enabled for the recipient port, the entry is added to the MAC address table. When MAC address learning is not enabled, the entry is not added to the table.

The switchport mac address learning command enables MAC address learning for the configuration mode interface. MAC address learning is enabled by default on all Ethernet and port channel interfaces.

Example

These commands disables MAC address learning for interface ethernet 8, then displays the active configuration for the interface.

switch(config)# interface ethernet 8
switch(config-if-Et8)# no switchport mac address learning
switch(config-if-Et8)# show active
interface Ethernet8
no switchport mac address learning
switch(config-if-Et8)#

Aging Time

Aging time defines the period an entry is in the table, as measured from the most recent reception of a frame on the entry’s VLAN from the specified MAC address. The switch removes entries when their presence in the MAC address table exceeds the aging time.

Aging time ranges from 10 to 1000000 seconds with a default of 300 seconds (five minutes).

Example

This command sets the MAC address table aging time to two minutes (120 seconds).

switch(config)# mac address-table aging-time 120
switch(config)#

The mac address-table aging-time command configures the aging time for MAC address table dynamic entries. Aging time defines the period an entry is in the table, as measured from the most recent reception of a frame on the entry’s VLAN from the specified MAC address. The switch removes entries when their presence in the MAC address table exceeds the aging time.

Mac Moves

Secure MAC addresses is allowed to move when they appear on another interface, when configured. By default, secure MAC addresses does not move.

switch(config)# default switchport port-security mac address moveable
switch(config)#

Persistent Port Security

When the persistent PortSec-Protect is enabled, secure MAC addresses persist across device reboots and interface flaps. These MAC addresses can still be aged or moved when configured using the commands mac address-table aging-time and default switchport port-security mac address moveable. Persistent port security is enabled by default, and can be disabled.

switch(config)# default switchport port-security persistence disabled

Example

show port-security command displays the settings for the new global port security configurations, including MAC aging, MAC moves, and persistent port security.

switch(config)# show port-security
Secure address moves: disabled
Secure address aging: disabled
Secure address reboot persistence: enabled
Secure address link down persistence: enabled
Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                (Count)       (Count)          (Count)
----------------------------------------------------------------------------
----------------------------------------------------------------------------
Total Addresses in System: 0

Clearing Dynamic Addresses

The clear mac address-table dynamic command removes specified dynamic entries from the MAC address table. Entries are identified by their VLAN and Layer 2 (Ethernet or port channel) interface.

Example

This command clears all dynamic mac address table entries for port channel 5 on VLAN 34.

switch(config)# clear mac address-table dynamic vlan 34 interface port-channel 5
switch(config)

Displaying the MAC Address Table

The show mac address-table command displays the specified MAC address table entries.

Example

This command displays the MAC address table.

switch# show mac address-table
          Mac Address Table
------------------------------------------------------------------
Vlan    Mac Address       Type        Ports      Moves   Last Move
----    -----------       ----        -----      -----   ---------
 101    001c.8224.36d7    DYNAMIC     Po2        1       9 days, 15:57:28 ago
 102    001c.8220.1319    STATIC      Po1
 102    001c.8229.a0f3    DYNAMIC     Po1        1       0:05:05 ago
 661    001c.8220.1319    STATIC      Po1
 661    001c.822f.6b22    DYNAMIC     Po7        1       0:20:10 ago
3000    001c.8220.1319    STATIC      Po1
3000    0050.56a8.0016    DYNAMIC     Po1        1       0:07:38 ago
3909    001c.8220.1319    STATIC      Po1
3909    001c.822f.6a80    DYNAMIC     Po1        1       0:07:08 ago
3911    001c.8220.1319    STATIC      Po1
3911    001c.8220.40fa    DYNAMIC     Po8        1       1:19:58 ago
3912    001c.822b.033e    DYNAMIC     Et11       1       9 days, 15:57:23 ago
3913    001c.8220.1319    STATIC      Po1
3913    001c.822b.033e    DYNAMIC     Po1        1       0:04:35 ago
3984    001c.8220.178f    DYNAMIC     Et8        1       4 days, 15:07:29 ago
3992    001c.8220.1319    STATIC      Po1
3992    001c.8221.07b9    DYNAMIC     Po6        1       4 days, 15:13:15 ago
Total Mac Addresses for this criterion: 24

          Multicast Mac Address Table
------------------------------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       ----        -----
Total Mac Addresses for this criterion: 0

Beginning with EOS Release 4.26.0F, PortSec-Protect enforces a limit on the number of MAC addresses, that can be learn. For example, PortSec-Protect is configured with a maximum of 1, show mac address-table shows a single address installed.

switch# show mac address-table
          Mac Address Table
------------------------------------------------------------------
Vlan    Mac Address       Type        Ports      Moves   Last Move
----    -----------       ----        -----      -----   ---------
 101    001c.8224.36d7    DYNAMIC     Po2        1       9 days, 15:57:28 ago
Total Mac Addresses for this criterion: 1

MAC Address Learning Per-VLAN

MAC address learning per-VLAN enables or disables MAC address learning per-VLAN instead of per-port. When MAC address learning is enabled for the recipient port, the entry is added to the MAC address table. When MAC address learning is disabled, the entry is not added to the table.

MAC Address Learning Configuration

The mac address learning command enables MAC address learning on a VLAN interface. By default, MAC address learning on a VLAN is enabled.

The switch maintains a MAC address table for switching frames between VLAN ports. When the switch receives a frame, it associates the MAC address of the transmitting interface with the recipient VLAN and port. When MAC address learning is enabled for the recipient port, the entry is added to the MAC address table. When MAC address learning is not enabled, the entry is not added to the table.

To disable MAC learning on a particular VLAN, use no mac address learning command on a VLAN configuration.

Examples
  • These commands enable MAC address learning on vlan 10 configuration.
    switch(config)# vlan 10
    switch(config-vlan-10)# mac address learning

  • These commands disable MAC address learning on vlan 10 configuration.
    switch(config)# vlan 10
    switch(config-vlan-10)# no mac address learning

Configuring Ports

Port Mirroring

Port mirroring, also known as port monitoring, is the duplication of traffic from a collection of source ports to a destination port. A mirror session correlates a set of source ports to a destination port.

Valid mirror sources are Ethernet or port channel interfaces, including port channels which are part of an MLAG. Mirror destination ports are usually Ethernet interfaces; port channel destination ports are also supported on some platforms.

Note: On platforms which support the use of port channels as mirror destinations, a port channel must not be used as a mirror destination if it is a member of an MLAG.

Layer 2 control protocols do not run on destination ports. An interface cannot be in more than one mirror session and cannot simultaneously be a source and destination. By default, mirror sessions duplicate ingress and egress traffic but are configurable to mirror traffic from only one direction.
  • Ingress Mirroring: Packets received by a source port are duplicated, including all valid data frames and L2 control PDUs. Ports mirror data before forwarding logic is applied. Packets subsequently dropped because of forwarding decisions are mirrored.

  • Egress Mirroring: Packets transmitted by a source port are duplicated, with these exceptions:
    • Flooded/Multicast Packets: Packets sent to multiple mirror ports generate one copy, except in multi-chip devices when the mirror source and destination ports are on different chips; in this case, an extra copy is generated.
    • Dropped Packets: Packets dropped by forwarding decisions (such as output STP state checks) on egress sources are not duplicated. Packets dropped because of congestion may be duplicated.

  • Filtered Mirroring: Specific packets are selected for mirroring based on PERMIT and DENY configurations.

  • Mirroring to GRE Tunnel: Mirrored packets are encapsulated with GRE protocols for transiting Layer 3 network.

VLAN tags on duplicate packets from an egress source are identical to tags on inbound source packets.

When a packet’s path through the switch includes multiple mirror source ports in different mirror sessions, the traffic is duplicated once and sent to the destination of the highest numbered session.

Port Mirroring Capacity

Port mirroring capacity varies by platform. This section describes session limits for each platform.

FM6000 Platform Switches
  • Maximum Number of Sessions: 4.

  • Session Sources: Ethernet interfaces (any number), Port channel interfaces (any number).

  • Session Destinations: Ethernet interfaces (any number), Port channel interfaces (any number), CPU.

  • Egress IP ACL on destination port is not supported.

Sessions can mirror Rx, Tx, or both ways without impacting the number of available sessions.

Enabling each of the following features reduces the number of available sessions by one: ACL Logging, MLAG Peer Link, sFlow, VTEP Learning (VXLAN), LANZ Sampling

Arad Platform Switches
  • Maximum Number of Sessions: 14.

  • Session Sources: Ethernet interfaces (any number), Port channel interfaces (any number).

  • Session Destinations: Ethernet interfaces (one).

  • Egress IP ACL on destination port is not supported.

Sessions can mirror Rx, Tx, or both ways without impacting number of available sessions.

Although the number of configured source interfaces is unlimited, the number of interfaces that can be effectively mirrored is restricted by the destination port speed.

Petra Platform Switches
  • Maximum Number of Sessions: 16.

  • Session Sources: Ethernet interfaces (eight for Rx or Tx sessions; four for both ways).

  • Session Destinations: Ethernet interfaces (eight for Rx or Tx sessions; four for both ways).

  • Egress IP ACL on destination port is not supported.

    Sessions can mirror Rx, Tx, or both ways without impacting number of available sessions.

Trident Platform Switches
  • Maximum Number of Sessions: 4.

  • Session Sources: Ethernet interfaces (any number), Port channel interfaces (any number).

  • Session Destinations: Ethernet interfaces (one).

  • Egress IP ACL on destination port is supported.

    Mirroring Rx or Tx requires one session. Mirroring both ways requires two sessions.

Trident II Platform Switches
  • Maximum Number of Sessions: 4.

  • Session Sources: Ethernet interfaces (any number), Port channel interfaces (any number).

  • Session Destinations: Ethernet interfaces (one).

  • Egress IP ACL on Destination Port is supported.

    Mirroring Rx or Tx requires one session. Mirroring both ways requires two sessions.

Configuring Mirror Ports

Mirror sessions associate a set of source ports to a destination port using the monitor session source and monitor session destination commands. An interface cannot be used in more than one mirror session and cannot be simultaneously a source and a destination. By default, mirror sessions duplicate ingress and egress traffic but are configurable to mirror traffic from one direction. On Trident and Trident II platform switches (DCS-7050, DCS-7050X, DCS-7250X, and DCS-7300X series), all frames mirrored on egress are prefixed with an 802.1Q VLAN tag, even when the egress port is configured as an access port. If the capture device cannot process VLAN tags properly, mirroring should be configured exclusively for ingress traffic by specifying rx in the monitor session source command.

Filtering on TX traffic in a mirror session is not supported.

Example

These commands configure interface ethernet 7 as the source port and Ethernet interface 8 as the destination port for the redirect_1 mirroring session. The session mirrors ingress and egress traffic.

switch(config)# monitor session redirect_1 source ethernet 7
switch(config)# monitor session redirect_1 destination ethernet 8

The show monitor session command displays the configuration of the specified port mirroring session.

Example

This command shows the configuration of the redirect_1 mirroring session.

switch(config)# show monitor session

Session redirect_1
------------------------

Source Ports

  Both:        Et7

Destination Port: Et8

switch(config)#

The monitor session ip access-group command configures an ACL to filter the traffic being mirrored to the destination port.

Example

These commands create an ACL and apply it to filter the traffic mirrored to the destination port by session redirect_1.

switch(config)# ip access-list allow-host
switch(config-acl-allow-host)# 10 permit ip host 192.168.11.24 host 10.0.215.23
switch(config-acl-allow-host)# 20 deny ip any any
switch(config-acl-allow-host)# exit
switch(config)# monitor session redirect_1 ip access-group allow-host
switch(config)#

Configuring Filtered Mirroring

Filtered mirroring allows for configuring IPv4, IPv6, and MAC access lists and then updating a monitor session with corresponding configuration changes. EOS mirrors the packets that match permit statements. EOS does not select those packets for mirroring that match deny statements.

Note: EOS supports all standard IPv4, IPv6, and MAC qualifiers.

On Strata series platforms, packets from a single monitor source can be mirrored in multiple sessions that use the same access-list. You can attach multiple monitor sources with various access-lists to a monitor session. Each monitor session should contain one access-list type only. Hence, IPv4, IPv6, and MAC access-lists from the same monitor source must appear in different monitor sessions.

When multiple IPv6 monitor sessions share the same monitor source, only one of the monitor sessions remains active and others are automatically inactivated. When the active monitor session is removed from the monitor source, the system automatically activates the inactive monitor sessions.

Packets matching both IP and MAC access lists behave differently on various platforms.

Table 1. Behavior of Filtered Mirroring in Different Platforms
Platform Series Behavior of Filtered Mirroring
DCS-7050/7050X, DCS-7250X, and DCS-7300X When entry packets match both IPv4 and MAC access-lists, mirrored copies are created for both IPv4 and MAC access-lists; and forwarded to configured destinations.
DCS-7280SE and DCS-7500E When entry packets match both IPv4 and MAC access-lists, a mirrored copy is created only for IPv4 access-list. The behavior of filtered mirroring varies in the following ways when a packet matches an entry in both access-list types:

• Mirroring is permitted when a packet contradicts with permit and deny configurations.

• Mirroring is denied when an entry packet matches deny configurations in both.

• IP access-list is prioritized over MAC access-list when an entry packet matches permit configurations in both.

Note: User-Defined Field (UDF) qualifiers in filtered mirroring access-lists allow matching packets using arbitrary user-defined patterns.

Use the system profile command to enable the Mirroring ACL profile that supports matching on IPv6, MAC and UDFs.

The following table provides the matching types supported in default and Mirroring ACL profiles.

Table 2. Supported Matching Types
Profiles IPv4 IPv6 MAC UDF
Default Yes No No No
Mirroring ACL Yes Yes Yes Yes

Note: MAC mirroring-ACLs do not accept routed IPv4/IPv6 packets and bridged IPv6 packets.

Examples
  • These commands create an IPv4 access-list and then attach the access-list to monitor sessions.
    switch(config)# ip access-list acl1
    switch(config-acl-acl1)# 10 permit tcp any any rst
    switch(config-acl-acl1)# 20 permit tcp any any syn
    switch(config-acl-acl1)# 30 permit tcp any any ack
    
    switch(config)# monitor session 1 source Ethernet1 rx ip access-group acl1
    switch(config)# monitor session 1 source Ethernet2 rx ip access-group acl1
    switch(config)# monitor session 1 destination <destination>

  • These commands create an IPv6 access-list and then attach the access-list to monitor sessions.
    Arista(config)# ipv6 access-list acl2
    Arista(config-ipv6-acl-acl2)# 10 permit ipv6 any any
    
    Arista(config)#monitor session 2 source Ethernet4 rx ipv6 access-group acl2
    Arista(config)#monitor session 2 destination Ethernet5

  • These commands configure the same monitor source in multiple monitor sessions.
    switch(config)# monitor session 1 source Ethernet1 rx ip access-group acl1
    switch(config)# monitor session 1 destination <destination 1>
    
    switch(config)# monitor session 2 source Ethernet1 rx ip access-group acl2
    switch(config)# monitor session 2 destination <destination 2>

  • This command configures access-list priorities for dictating the matching order across multiple access-lists that are attached to the same monitor source.
    switch(config)# monitor session 1 source Ethernet1 rx ip access-group acl1 priority 1
    switch(config)# monitor session 1 destination <destination 1>
    
    switch(config)# monitor session 2 source Ethernet1 rx ip access-group acl2 priority 2
    switch(config)# monitor session 2 destination <destination 2>

  • This command enables the Mirroring ACL profile.
    switch(config)# hardware tcam
    switch(config-hw-tcam)# system profile mirroring-acl
    switch(config-hw-tcam)# show hardware tcam profile
                         Configuration        Status
    FixedSystem          mirroring-acl        mirroring-acl
    switch(config-hw-tcam)#

Filtered Mirroring to CPU

Filtered mirroring to CPU adds a special destination to port mirroring that allows mirrored traffic to be sent to the switch supervisor. The traffic can then be monitored and analyzed locally without the need of a remote port analyzer. Filtered mirroring to CPU can also be used for debugging and troubleshooting configured to mirror RX traffic, TX traffic or both, with up to 14 mirroring profiles used simultaneously. In addition, mirroring to CPU uses control plane protection to limit the rate of the traffic sent to the CPU.

Examples
  • These commands configure the source for normal mirroring and the destination to CPU.
    switch(config)# monitor session mySession source ethernet 3/1 both
    switch(config)# monitor session mySession destination cpu
    switch(config)#

  • These commands configure reserved bandwidth and shape rate of mirrored traffic.
    switch(config)# policy-map type copp copp-system-policy
    switch(config-pmap-control-plane-copp-system-policy)# class copp-system-mirroring
    switch(config-pmap-c-copp-system-policy-copp-system-mirroring)# bandwidth kbps 2000
    switch(config-pmap-c-copp-system-policy-copp-system-mirroring)# shape kbps 4000
    switch(config-pmap-c-copp-system-policy-copp-system-mirroring)#

  • These commands show the current status of mirroring to CPU from the CLI, and display the control plane protection configuration for mirroring to CPU.
    switch(config)# show monitor session
    
                            Session mySession
    
                            ------------------------
    
                            Source Ports:
    
                              Both : Et3/1
    
                            Destination Ports:
    
                              Cpu : active (mirror0)
    switch(config)#

  • These commands show the current status of mirroring to CPU from the CLI, and display the control plane protection configuration for mirroring to CPU.
    switch(config)# show policy-map type copp copp-system-policy class cop-system-mirroring
    
                              Class-map: copp-system-mirroring (match-any)
    
                                 shape : None
    
                                 bandwidth : None
    switch(config)#

Configuring Filtered Mirroring to GRE Tunnel

The monitor session source and monitor session destination commands configure source and destination ports to the specified port mirroring session in a GRE tunnel.

On DCS-7010T, DCS-7050/7050X, DCS-7060X, DCS-7250X, DCS-7260X, DCS-7300X, a special GRE tunnel destination is supported to mirror ingress packets that are dropped during ASIC forwarding. This GRE destination is referred as the “forwarding-drop” destination, and the corresponding session is called as the “forwarding-drop” session.

Note: Forwarding-drop sessions are the sessions corresponding to forwarding-drop destinations.

Note: From Release EOS 4.25.2F onwards platforms DCS-7050X, DCS-7060X, DCS-7250X, DCS-7260X, CCS-720X started supporting the tx keyword, which specifies that outgoing packets should be mirrored.

Examples
  • These commands configure ingress filtered mirroring to a GRE tunnel.
    switch(config)# monitor session abc source Ethernet1 rx ip access-group acl1
    switch(config)# monitor session abc destination tunnel mode gre source 1.1.1.1 
    destination 2.2.2.2 ttl 128 dscp 0 protocol 0x88be

  • These commands configure egress filtered mirroring to a GRE tunnel.
    switch(config)# monitor session abc source Ethernet1 tx ip access-group acl1
    switch(config)# monitor session abc destination tunnel mode gre source 2.2.2.2
    destination 2.2.2.2 ttl 128 dscp 0 protocol 0x88be

  • This command configures forwarding-drop sessions.
    switch(config)# monitor session 1 forwarding-drop destination tunnel mode gre source 1.1.1.1 destination 2.2.2.2

  • A forwarding-drop session is configured by using the forwarding-drop keyword when configuring the GRE destination:
    switch(config)# monitor session 1 source <source>
    switch(config)# monitor session 1 forwarding-drop destination tunnel mode gre 
                                     source <sourceIp>
                                     destination <destIp>
                                     [ ttl <value> ] 
                                     [ dscp <value> ]
                                     [ protocol <value> ]
                                     [ vrf <value> ]

  • A mirroring to GRE destination can be configured as follows:

    switch(config)# monitor session 1 source <source> rx | tx
    switch(config)# monitor session 1 destination tunnel mode gre 
                                     source <sourceIp>
                                     destination <destIp>
                                     [ ttl <value> ] 
                                     [ dscp <value> ]
                                     [ protocol <value> ]
                                     [ vrf <value> ]

    The rx keyword specifies that incoming packets should be mirrored.

Security ACL Filtered Mirroring

Security ACL Filtered Mirroring is configured using port security ACLs.

Configuring Security ACL Filtered Mirroring

The following configures interface ethernet 8 as the destination port for the redirect_1 mirroring session, and interface ethernet 9 as the destination port for the redirect_2 mirroring session. A source port is not needed to create a mirror session. Other destination options for monitor sessions such as GRE or CPU are also configurable.

switch (config)# monitor session redirect_1 destination ethernet 8
switch (config)# monitor session redirect_2 destination ethernet 9

Examples

Egress IPv4 ACL

The following commands create an IPv4 access-list, and then attach the access-list to interface ethernet 7 in the out direction with the following rules.
  • matching Rule 10 will be mirrored to interface ethernet 8.
  • matching Rule 20 will not be mirrored.
  • matching Rule 30 will be mirrored to interface ethernet 9.
  • matching Rule 40 will be dropped and not mirrored.
Specifying a mirror session in a deny rule for egress ACL has no effect.
switch(config)# ip access-list acl1
switch(config-acl-acl1)# 10 permit ip host 10.0.0.4 any mirror session redirect_1
switch(config-acl-acl1)# 20 permit ip host 10.0.0.5 any 
switch(config-acl-acl1)# 30 permit ip host 10.0.0.6 any mirror session redirect_2
switch(config-acl-acl1)# 40 deny ip any any

switch(config)# interface ethernet 7
switch(config-if-Et7)# ip access-group acl1 out

Note: Security ACL Filtered Mirroring has higher priority over standard Port Mirroring.

Using the same configuration as above with interface ethernet 7 as the source port of redirect_1, the following configuration displays the impact on packets egressing from interface ethernet 7.

switch(config)# monitor session redirect_1 source ethernet 7
  • matching Rule 10 and Rule 20 will be mirrored to interface ethernet 8.
  • matching Rule 30 will be mirrored to interface ethernet 9.
  • matching Rule 40 will be dropped and not mirrored.

Egress IPv6 ACL

The following commands create an IPv6 access-list, and then attach the access-list to interface ethernet 7 in the egress direction.
switch(config)# ipv6 access-list acl1
switch(config-ipv6-acl-acl1)# 10 permit ipv6 host 10:10:10:10:10:10:10:1 any mirror session redirect1
switch(config-ipv6-acl-acl1)# 20 permit ipv6 host 10:10:10:10:10:10:10:5 any 
switch(config-ipv6-acl-acl1)# 30 permit ipv6 host 10:10:10:10:10:10:10:6 any mirror session redirect2
switch(config-ipv6-acl-acl1)# 40 deny ipv6 any any

switch(config)# interface ethernet 7
switch(config-if-Et7)# ipv6 access-group acl1 out

Note: The mirroring behavior of egress IPv6 ACL is identical to egress IPv4 ACL. The egress IPv6 ACL is supported only on R3 Series and forward.

Egress MAC ACL

The following commands create a MAC access-list, and then attach the access-list to interface ethernet 7 in the out direction. The mirroring behavior of egress MAC ACL is identical to egress IPv4 ACL.
switch(config)# mac access-list acl1
switch(config-mac-acl-acl1)# 10 permit 0000.1111.4444 0000.0000.0000 any mirror session redirect_1
switch(config-mac-acl-acl1)# 20 permit 0000.1111.5555 0000.0000.0000 any 
switch(config-mac-acl-acl1)# 30 permit 0000.1111.6666 0000.0000.0000 any mirror session redirect_2
switch(config-mac-acl-acl1)# 40 deny any any

switch(config)# interface ethernet 7
switch(config-if-Et7)# mac access-group acl1 out

Ingress IPv4 ACL

The following commands create an IPv4 access-list, and then attach the access-list to interface ethernet 7 in the in direction with the following rules.
  • matching Rule 10 and Rule 20 will be mirrored to interface ethernet 8.
  • matching Rule 30 will be mirrored to interface ethernet 9 since Security ACL Filtered Mirroring has higher priority.
  • matching Rule 40 will be dropped and mirrored to interface ethernet 8.
switch(config)# ip access-list acl2
switch(config-acl-acl2)# 10 permit ip host 10.0.0.4 any mirror session redirect_1
switch(config-acl-acl2)# 20 permit ip host 10.0.0.5 any 
switch(config-acl-acl2)# 30 permit ip host 10.0.0.6 any mirror session redirect_2
switch(config-acl-acl2)# 40 deny ip host 10.0.0.7 any mirror session redirect_1
 
switch(config)# interface ethernet 7
switch(config-if-Et7)# ip access-group acl2 in
 
switch(config)# monitor session redirect_1 source ethernet 7

Note: Unlike egress ACL, mirror session specified in a deny rule for ingress ACL will take effect.

The mirroring behavior of ingress IPv6 and MAC ACLs are identical to ingress IPv4 ACL.

Limitations
  • The feature is not supported in AlgoMatch mode.
  • Egress Security ACL Filtered Mirroring works on IPv4 - permit rules, and MAC - permit rules.
  • By default, egress MAC ACL is disabled. Egress MAC ACL is required to be enabled.
  • By default, bridged traffic is not subject to Egress IP ACLs, therefore, the bridged packets will not be mirrored.
  • RACL and subinterface ACL are not supported for filtering mirroring.
  • If a packet is dropped by an ingress ACL and the destination is GRE, the metadata of the GRE packet cannot be computed as expected.

Storm Control

A traffic storm is a flood of packets entering a network, resulting in excessive traffic and degraded performance. Storm control prevents network disruptions by limiting traffic beyond specified thresholds on individual physical LAN interfaces.

Storm control monitors inbound traffic levels over one-second intervals and compares the traffic level with a specified benchmark.

Storm control has three modes:
  • Storm control broadcast: When inbound broadcast traffic exceeds the specified threshold within a one-second control interval, broadcast traffic is dropped until the end of the interval.

  • Storm control multicast: When inbound multicast traffic exceeds the specified threshold within a one-second control interval, multicast traffic is dropped until the end of the interval.

  • Storm control unknown-unicast: When inbound unknown unicast traffic exceeds the specified threshold within a one-second control interval, unknown unicast traffic is dropped until the end of the interval.

Broadcast, multicast, and unkown-unicast storm control are independent features and can be enabled simultaneously.

Storm Control Configuration

The storm-control command configures and enables broadcast or multicast storm control on the configuration mode interface. The command provides three mode options:
  • storm-control broadcast     broadcast inbound packet control.
  • storm-control multicast     multicast inbound packet control.
  • storm-control unknown-unicast     unknown unicast inbound packet control.

An interface configuration can contain three storm-control statements, one with each mode setting.

When storm control is enabled, the switch monitors inbound traffic levels over one second intervals and compares the traffic level with a specified threshold. The threshold is either a percentage of the total available port bandwidth or the number of packets per second (pps) and is configurable on each interface for each transmission mode.

Examples

  • These commands enable multicast storm control on Ethernet interfaces 2 through 4 and set a threshold of 65%. During each one second interval, the interface drops inbound multicast traffic in excess of 65% of capacity.
    switch(config)# interface ethernet 2/3/4
    switch(config-if-Et4/4/4)# storm-control multicast level 65
    switch(config-if-Et4/4/4)#

  • These commands clear multicast storm control on Ethernet interfaces 2 through 4.
    switch(config)# interface ethernet 2/3/4
    switch(config-if-Et2/3/4)# no storm-control multicast
    switch(config-if-Et2/3/4)#

  • These commands enable broadcast storm control on Ethernet interfaces 2 through 4 and set broadcast traffic to 50%. During each one second interval, the interface drops inbound multicast traffic in excess of 50% of capacity.
    switch(config)# interface ethernet 2/3/4
    switch(config-if-Et2/3/4)# storm-control broadcast level 50
    switch(config-if-Et2/3/4)#
  • These commands enable unknown-unicast storm control on Ethernet interfaces 2 through 4 and set a threshold of 5000000 packets per second (PPS).
    switch(config)# interface ethernet 2/3/4
    switch(config-if-Et2/3/4)# storm-control unknown-unicast level pps 5000000
    switch(config-if-Et2/3/4)#

    Note: User cannot configure a PPS setting and a percentage setting on the same interface for the same mode at the same time. They are mutually exclusive.

  • These commands clear broadcast storm control on Ethernet interfaces 2 through 4.
    switch(config)# interface ethernet 2/3/4
    switch(config-if-Et2/3/4)# no storm-control broadcast
    switch(config-if-Et2/3/4)#

The show storm-control command displays the storm-control level and interface inbound packet capacity for the specified interface.

Examples

  • This command displays the storm control configuration for Ethernet ports 2 through 4.
    switch(config-if-Et2/3/4)# show storm-control
    Port    Type            Level   Units Rate(Mbps) Status   Reason
    ------- --------------- ------- ----- ---------- ------   ------
    Et2/3/4 unknown-unicast 5000000 pps            0 active
            multicast       65.0    %           5500 active
            broadcast       50.0    %           5000 active
    switch(config-if-Et2/3/4)#

Switched and Routed Ports

A switched port is an Ethernet or port channel interface that is configured as a Layer 2 interface. Switched ports bridge frames and are assigned to at least one VLAN. Switched ports are not associated with any IP addresses. By default, Ethernet and port channel interfaces are in switched port mode.

A routed port is an Ethernet or port channel interface that is configured as a Layer 3 interface. Routed ports do not bridge frames and are not members of any VLANs. Routed ports can have IP addresses assigned to them and packets are routed directly to and from the port.

Configuring an interface as a routed port is similar to creating a VLAN with spanning-tree disabled, making the port the only member of that VLAN and configuring the IP address on the switch virtual interface (SVI) associated with the VLAN.

All IP-level interface configuration commands, except autostate and ip virtual-router, can be used to configure a routed interface. If the interface is reverted to switched port mode, running-config maintains IP level interface configuration statements. These changes become active again if the interface is configured back to routed port mode.

A LAG that is created with the channel-group command inherits the mode of the member port. A LAG created from a routed port becomes a routed LAG. IP-level configuration is not propagated to the LAG from its component members.

The broadcast queue towards the CPU is shared among all interfaces of the forwarding chip. Broadcast storm on a single port adversely impacts other interfaces of the same chip by potentially dropping even low rate broadcast frames. Routed port storm control attempts to mitigate this effect by performing storm control on the broadcast frames for routed ports.

Routed Port Configuration

The switching-routing configuration of Ethernet and port channel interfaces is specified by the switchport and no switchport commands. These commands only toggle the interface between switched and routed modes. They have no effect on other configuration states.

The no switchport command places the configuration mode interface in routed port mode. Routed ports behave as Layer 3 interfaces. They do not bridge packets and are not VLAN members. An IP address can be assigned to a routed port for the direct routing of packets to and from the interface.

When an interface is configured as a routed port, the switch transparently allocates an internal VLAN whose only member is the routed interface. Internal VLANs are created in the range from 1006 to 4094. VLANs that are allocated internally for a routed interface cannot be directly created or configured. Allocating Internal VLANs describes VLAN allocation configuration procedures.

Example

This command places interface ethernet 5 in routed port mode.

switch(config)# interface ethernet 5
switch(config-if-Et5)# no switchport

Switched Port Configuration

The switchport command places the configuration mode interface in switched port (Layer 2) mode. Switched ports are configurable as members of one or more VLANs through other switchport commands. Switched ports ignore all IP level configuration commands, including IP address assignments. By default, Ethernet and port channel interfaces are switched ports.

Example

This command places interface ethernet 5 in switched port mode.

switch(config)# interface ethernet 5
switch(config-if-Et5)# switchport

The switchport default mode routed command places the configuration mode interface for a switch with all ports in switched port (Layer 3) routed mode, changing the switch with all ports from switchport default mode access.

Examples

  • This command places a switch with all ports in routed mode.
    switch(config)# switchport default mode routed 

  • This command places a switch with all ports in access mode.
    switch(config)# switchport default mode access

Loopback Interfaces

A loopback interface is a virtual network interface implemented in software that is not tied to a specific hardware interface. Loopback interface configuration mode is used for creating loopback interfaces and modifying their operating parameters.

Internet protocols reserve specific addresses for loopback network segments:
  • IPv4 designates 127/8 as loopback subnet, which includes 127.0.0.0 through 127.255.255.255.

  • IPv6 designates ::1/128 as the loopback address, which includes 0:0:0:0:0:0:0:1 (also written as ::1).

Arista switches support the configuration of 1001 loopback interfaces, numbered from 0 to 1000.

Loopback Interface Configuration

Loopback ports are instantiated by entering loopback interface configuration mode for the desired loopback interface number. Loopback interface configuration mode also provides access to loopback configuration commands. Previously instantiated ports are edited by entering loopback interface configuration mode for the specified interface.

The interface loopback command places the switch in loopback interface configuration mode for the specified interface, creating the specified loopback interface if it does not exist. Configuration mode can also be entered for a range of loopback interfaces, but they must all have been previously created

Example

These commands instantiate interface loopback 2 and assign it IP address 10.1.1.42/24.

switch(config)# interface loopback 2
switch(config-if-Lo2)# ip address 10.1.1.42
switch(config-if-Lo2)# show active
interface Loopback2
   ip address 10.1.1.42/24
switch(config-if-Lo2)#

MAC Security

MAC security restricts input to a switched port by limiting the number of MAC addresses that can access the port. Ports with MAC security enabled restrict traffic to a limited number of hosts, as determined by their MAC addresses. When the limit is exceeded, the port becomes errdisabled.

Port Security Configuration

MAC address security is enabled by switchport port-security . The default MAC address limit on an interface where port security is enabled is one; to change that default limit, use the switchport port-security mac-address maximum command.

Example

These commands enable MAC security on interface ethernet 7, set the maximum number of assigned MAC addresses to 2, assign two static MAC addresses to the interface, and clear the dynamic MAC addresses for the interface.

switch(config)# interface ethernet 7
switch(config-if-Et7)# switchport port-security
switch(config-if-Et7)# switchport port-security mac-address maximum 2
switch(config-if-Et7)# exit
switch(config)# mac address-table static 0034.24c2.8f11 vlan 10 interface ethernet 7
switch(config)# mac address-table static 4464.842d.17ce vlan 10 interface ethernet 7
switch(config)# clear mac address-table dynamic interface ethernet 7
switch(config)# show port-security
Secure Port      MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                    (Count)        (Count)      (Count)
----------------------------------------------------------------------------
     Et7              2             2            0            Shutdown
----------------------------------------------------------------------------
Total Addresses in System: 1
switch(config)# show port-security mac-address
          Secure Mac Address Table
---------------------------------------------------------------
Vlan    Mac Address       Type                     Ports   Remaining Age
                                                              (mins)
----    -----------       ----                     -----   -------------
  10    0034.24c2.8f11    SecureConfigured         Et7     N/A
  10    4464.842d.17ce    SecureConfigured         Et7     N/A
------------------------------------------------------------------------
Total Mac Addresses for this criterion: 2
switch(config)#

MAC Security LLDP Bypass

When MAC address security configuration is applied on the interface, it encrypts and decrypts all the other protocols PDU and other data packets. LLDP bypass allows LLDP packets to be sent or received from the port even when the port is not authorized.

The following configuration allows LLDP packets to be received or sent from an interface where the MAC security profile is applied.
switch(config)# mac security
switch(config-mac-security)# profile test
switch(config-mac-security-profile-test)# l2-protocol lldp bypass unauthorized

unauthorized allows the LLDP packet to be received and sent out when MKA session between the MACsec peers is yet to come up.

Show Command

The following command shows LLDP packets is bypassed for encryption or decryption.
switch(config)# show mac security interface ethernet 4/4/1 detail 
Interface: Ethernet4/4/1 
Profile: profile1 
SCI: d4:af:f7:2e:67:b0::786 
SSCI: 00000002 
Controlled port: True 
Key server priority: 1 
Session rekey period: 30 
Traffic: Protected 
Bypassed protocols: LLDP 
Key in use: c0645d4332ba2e1d4d5fb17f:129 
Latest key: None 
Old key: c0645d4332ba2e1d4d5fb17f:129(RT)

Null0 Interface

The null0 interface is a virtual interface that drops all inbound packets. A null0 route is a network route whose destination is null0 interface. Inbound packets to a null0 interface are not forwarded to any valid address. Many interface configuration commands provide null0 as an interface option.

Maximum Transmission Units (MTU)

The MTU of a communications protocol refers to the size in bytes of the largest frame (Ethernet) or packet (IP) that can be sent on the network.

Different protocols support a variety of MTU sizes. Most IP over Ethernet implementations use the Ethernet V2 frame format, which specifies an MTU of 1500 bytes. Jumbo frames are Ethernet frames containing more than 1500 bytes.

Switching interface MTU size

On Arista devices, layer two interfaces (either trunk or access ports) are set with a default ethernet MTU of 9236 bytes. This value cannot be changed and is derived as follows: 9214 + 6 (source MAC ) + 6 (dst MAC) + 4 (VLAN tag) + 2 (ether type) + 4 (crc) totals 9236 bytes.

The output of show interfaces command for a layer two interface displays the following:

Trunk
Ethernet1 is up, line protocol is up (connected)
 Hardware is Ethernet, address is 001c.731c.5073 (bia 001c.731c.5073)
Ethernet MTU 9214 bytes , BW 1000000 kbit

Access
Ethernet3 is up, line protocol is up (connected)
 Hardware is Ethernet, address is 001c.731c.5075 (bia 001c.731c.5075)
 Ethernet MTU 9214 bytes , BW 1000000 kbit

Routing Interface MTU Size

The MTU size on Layer 3 interfaces varies between a minimum of 68 to the maximum 9214 bytes. The default size is 1500 bytes. The show interface output for a Layer 3 interface displays the following:

VLAN Routed Interface
Vlan100 is up, line protocol is up (connected)
 Hardware is Vlan, address is 001c.731c.5072 (bia 001c.731c.5072)
 Internet address is 10.1.1.2/24
 Broadcast address is 255.255.255.255
 Address determined by manual configuration
 IP MTU 9214 bytes

Physical Routed Interface
Ethernet4 is down, line protocol is down (connect)
 Hardware is Ethernet, address is 001c.731c.5072
 Internet address is 10.10.10.10/24
 Broadcast address is 255.255.255.255
 Address determined by manual configuration
 IP MTU 9214 bytes

A routed interface fragments packets that exceed the configured IP MTU on the interface. For example, if a 2000 byte packet is received on routed interface 1 and is forwarded from routed interface 2 then routed interface 2 fragments the packet into a 1500 byte packet plus an additional packet containing the remaining data. This fragmentation should be avoided by configuring a consistent IP MTU across all systems within the operational domain.

The IP MTU set on a routed interface is valid for both IPv4 and IPv6 packets.

MTU Configuration

The mtu command configures the IPv4 and IPv6 Maximum Transmission Unit (MTU) size for the configuration mode interface. An interface's MTU value is displayed with the show interface command. The command is valid for all routable interfaces.

Examples
  • This command sets the MTU size of 1492 bytes on VLAN interface 20
    switch(config-if-Vl20)# mtu 1492
    switch(config-if-Vl20)#

  • This command displays status for a routed interface.
    switch(config-if-Et3)# show interface e3
    Ethernet3 is up, line protocol is up (connected)
      Hardware is Ethernet, address is 001c.731c.5072
      Internet address is 10.1.1.2/24
      Broadcast address is 255.255.255.255
      Address determined by manual configuration
      IP MTU 1500 bytes , BW 1000000 kbit
      Full-duplex, 1Gb/s, auto negotiation: on, uni-link: unknown
      Up 22 days, 7 hours, 47 minutes, 58 seconds
    switch(config)#

  • Using ping on a Linux host, you can test the maximum transmission through the interface.
  • [user@linux ~]$ ping -M do -s 1472 10.1.1.2
    PING 10.1.1.2 (10.1.1.2) 1472(1500) bytes of data.
    1480 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=0.206 ms
    1480 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.191 ms
    --- 10.1.1.2 ping statistics ---
    2 packets transmitted, 2 received, 0% packet loss, time 999ms
    rtt min/avg/max/mdev = 0.191/0.198/0.206/0.015 ms

The size 1472 has 8 bytes of ICMP information added and 20 bytes of IP headers added, generating a total packet size of 1500 bytes.
  • The option -M do specifies that fragmentation is prohibited for this test.
  • The option -s specifies the size of the packet being generated.
  • A capture of the frame displays total length of 1514 bytes on the wire which includes the Ethernet headers and type field.

Monitoring Links

Object Tracking

Object tracking makes it possible for the switch to take action in response to changes in specific switch properties by creating an object to track those properties. When the tracked property changes, the object then changes state, allowing configured agents to react accordingly.

Object Tracking Configuration

The track command creates an object that changes state to reflect changes in a specific switch property. Agents configured to track that object are then able to react to the change.

Example

These commands create an object that tracks the line protocol state on interface ethernet 8, then configures interface ethernet 5 to disable VRRP when that tracked object changes state to down.

switch(config)# track ETH8 interface ethernet 8 line-protocol
switch(config)# interface ethernet 5
switch(config-if-Et5)# vrrp 1 tracked-object ETH8 shutdown
switch(config-if-Et5)#

These commands use object tracking:
  • link tracking group
  • vrrp tracked-object

Errdisabled Ports

The switch places an Ethernet or management interface in error-disabled state when it detects an error on the interface. Error-disabled is an operational state that is similar to link-down state. Conditions that error-disable an interface include:
  • bpduguard
  • link-flap
  • no-internal-vlan
  • portchannelguard
  • portsec
  • tapagg
  • uplink-failure-detection
  • xcvr_unsupported

Most conditions are programmed by the configuration of other features, such as Spanning Tree protocol (bpduguard). Link flap error-disabling is configured through errdisable commands or link flap monitor commands (Link Flap Monitoring).

Error-disabled interfaces are recovered either through manual or automated methods.

To manually recover an interface, enter its configuration mode and execute shutdown and no shutdown commands.

Example

These commands manually recover interface ethernet 30 from the errdisable state.

switch(config)# interface ethernet 30
switch(config-if-Et30)# shutdown
switch(config-if-Et30)# no shutdown
switch(config-if-Et30)#

Automated recovery of Ethernet interfaces that are error-disabled by a specified condition is enabled by errdisable recovery cause . The errdisable recovery interval specifies the period that an interface remains disabled until it is enabled and begins operating normally. When the disabling condition persists, recovered interfaces eventually return to the error-disabled state.

Example

These commands configure automated recovery for all interfaces that are error-disabled from link flap and bpduguard conditions. Automated recovery begins five minutes after the port is disabled.

switch(config)# errdisable recovery cause link-flap
switch(config)# errdisable recovery cause bpduguard
switch(config)# errdisable recovery interval 300
switch(config)#

Error Disable Detect Cause for ACL

The no errdisable detect cause acl command configures routed ports, subinterfaces, and physical ports to not get into the errdisabled state on ACL failure, the default behavior. To reestablish the default behavior, use the errdisable detect cause acl command.

The following displays the output when errdisabling is enabled for ACLs.

switch(config)# show errdisable detect
   Errdisable Reason           Detection Status
------------------------------ ----------------
   acl                         Enabled

The following displays the output when errdisabling is disabled for ACLs.

switch(config)# show errdisable detect
   Errdisable Reason           Detection Status
------------------------------ ----------------
   acl                         Disabled

Configuring Error Disable Recovery Interval for each Cause

The duration after which an interface tries to recover from being error disabled is programmable for each trigger which causes the interface to be error disabled using the errdisable recovery cause NAME_OF_CAUSE interval DURATION command. The command applies only to interfaces that are enabled for error recovery after being error disabled.

Examples
  • This command configures interfaces to recover in 30 seconds when the cause is bpduguard.

    switch(config)# errdisable recovery cause bpduguard interval 30

  • Either of these commands revert the interval to the global value when the cause is bpduguard.

    switch(config)# no errdisable recovery cause bpduguard interval

    switch(config)# default errdisable recovery cause bpduguard interval

  • This command displays the status of the interfaces.

    switch# show errdisable recovery
    Errdisable Reason              Timer Status   Timer Interval
    ------------------------------ ----------------- --------------
       bpduguard                      Disabled                   30
       hitless-reload-down            Disabled                  300
       lacp-no-portid                 Disabled                  N/A
       lacp-rate-limit                Disabled                  300
       license-enforce                Disabled                  N/A
       link-flap                      Disabled                  300
       no-internal-vlan               Disabled                  300
       uplink-failure-detection       Disabled                  300

Link Flap Monitoring

Link flap frequency is the quantity of link flaps (connection state changes) over a specified period. Excessive link flaps result in network stability issues, including spanning tree and routing recalculations. Link flaps are often caused by Layer 1 issues, such as a bad cable or duplex mismatch. Link flap monitoring specifies link flap thresholds and disables a port when a threshold is exceeded.

Link flap monitoring can be enabled on all interfaces through errdisable link flap commands or on individual interfaces with the link flap monitor.

Global Link Flap Monitor

Global link flap detection is configured through two global configuration mode commands:

Link-flap detection is enabled by default.

Example

These commands sets the link flap error criteria of 15 connection state changes over a 30 second period, then enables error detection on all interfaces.

switch(config)# errdisable flap-setting cause link-flap max-flaps 15 time 30
switch(config)# errdisable detect cause link-change
switch(config)#

Interface Link Flap Monitor

An interface is monitored for link flap errors with link flap profiles. A link flap profile specifies conditions that define a link-flap error. Profiles are assigned to Ethernet interfaces. Multiple profiles can be assigned to an interface to monitor a set of error conditions.

The global link flap monitor is used by interfaces that are not individually monitored for link flap errors.

Configuring Link Flap Profiles
Link flap profiles are configuration statements that define a link flap error in terms of these criteria:
  • flaps     Threshold number of interface state changes.

  • period     Interval when link flaps accumulate to trigger an error condition.

  • violations     Number of link flap errors (threshold exceeded over specified period).

  • intervals     Quantity of periods.

The monitor link-flap policy command places the switch in link-flap configuration mode for configuring link flap profiles and compiling a default-profile set. The profile max-flaps (Link Flap Configuration) command configures link flap profiles.

The default-profile set is a list of link-flap profiles that define error-disable criteria for interfaces where link flap monitoring is enabled but link-flap profiles are not assigned. The default-profile set may contain zero, one, or multiple profiles. When the default-profile set is empty, errdisable flap-setting cause link-flap specifies default error-disable criteria. When the default-profile set contains multiple profiles, the criteria is satisfied when conditions match any profile.

Example

These commands enter link flap configuration mode and create four link flap profiles.

switch(config)# monitor link-flap policy
switch(config-link-flap)# profile LF01 max-flaps 15 time 60
switch(config-link-flap)# profile LF02 max-flaps 10 time 30 violations 5 intervals 10
switch(config-link-flap)# profile LF03 max-flaps 20 time 75 violations 2 intervals 6
switch(config-link-flap)# profile LF04 max-flaps 30 time 100 violations 4 intervals 7
switch(config-link-flap)# show active
monitor link-flap policy
   profile LF01 max-flaps 15 time 60 violations 1 intervals 1
   profile LF02 max-flaps 10 time 30 violations 5 intervals 10
   profile LF02 max-flaps 20 time 75 violations 2 intervals 6
   profile LF02 max-flaps 30 time 100 violations 4 intervals 7
switch(config-link-flap)#

The default-profiles command specifies the set of link-flap profiles that define error-disable criteria for interfaces where link flap monitoring is enabled without a link flap profile assignment. Entering a default-profile command replaces the current default-profile statement in running-config.

The default-profile set may contain zero, one, or multiple profiles. When the default-profile set is empty, errdisable flap-setting cause link-flap specifies default error-disable criteria. When the default-profile set contains multiple profiles, error-disable criteria is satisfied when conditions match any profile. Multiple profiles are assigned to the default-profile set through a single default-profiles command.

Example

This command assigns configures LF01 and LF02 as the default-profile set.

switch(config)# monitor link-flap policy
switch(config-link-flap)# default-profiles LF01 LF02
switch(config-link-flap)# show active
monitor link-flap policy
   profile LF01 max-flaps 15 time 60 violations 1 intervals 1
   profile LF02 max-flaps 10 time 30 violations 5 intervals 10
   profile LF02 max-flaps 20 time 75 violations 2 intervals 6
   profile LF02 max-flaps 30 time 100 violations 4 intervals 7
   default-profiles LF01 LF02
switch(config-link-flap)#

Interface Link Flap Profile Assignments

Link flap monitoring is enabled on individual Ethernet interfaces and can optionally specify one or more profiles to define link-flap error-disabling criteria. When link flap monitoring is enabled on an interface, the link-flap conditions determine when the interface is error-disabled. Multiple profiles can be assigned to an interface to monitor a set of error conditions; a port is disabled when conditions match any of the profiles assigned to an interface.

The monitor link-flap profiles command controls link-flap monitoring on a configuration mode interface. The command provides these link flap detection options:
  • monitor link-flap (no profiles listed): Interface detects link flaps using default-profile set criteria.

  • monitor link-flap (at least one profile listed): Interface detects link flaps using listed profile criteria.

  • default monitor link-flap: The interface uses global link flap monitor commands (Global Link Flap Monitor).

  • no monitor link-flap: The interface does not detect link flaps.

Examples
  • This command assigns LF03 and LF04 link flap profiles to interface ethernet 33.
    switch(config)# interface ethernet 33
    switch(config-if-Et33)# monitor link-flap profiles LF03 LF04
    switch(config-if-Et33)# show active
    interface Ethernet33
       monitor link-flap profiles LF04 LF03
    switch(config-if-Et33)#

  • This command disables link-flap monitoring on interface ethernet 34.
    switch(config)# interface ethernet 34
    switch(config-if-Et34)# no monitor link-flap
    switch(config-if-Et34)# show active
    interface Ethernet34
       no monitor link-flap
    switch(config-if-Et34)#

  • This command assigns the default-profile set to interface ethernet 35.
    switch(config)# interface ethernet 35
    switch(config-if-Et35)# monitor link-flap
    switch(config-if-Et35)# show active
    interface Ethernet35
       monitor link-flap
    switch(config-if-Et35)#

  • This command configures interface ethernet 36 to use the global link flap monitoring commands.
    switch(config)# interface ethernet 36
    switch(config-if-Et36)# default monitor link-flap
    switch(config-if-Et36)# show active
    interface Ethernet36
    switch(config-if-Et36)#

Fabric Link Monitoring

Fabric link monitoring enables EOS to monitor low error rate errors on all fabric links for long durations, and automatically isolates fabric links on consistent error detection over an extended time interval. Isolated fabric links are restored when the error rate drops below a configured threshold.

The error rate over each configurable polling interval is derived by comparing the number of cells with CRC errors against the total number of received cells. Links are automatically isolated when the error rate is above the configured threshold for the configured consecutive number of polling intervals.

On an isolated fabric link, control cells (but not data cells) are sent. Once the error rate drops below a set threshold for the configured consecutive number of polling intervals, EOS revives the fabric link to continue sending data traffic.

Configuring Fabric Link Monitoring

Configuration mode commands globally enable and disable fabric link monitoring and syslog messages for the settings described below.

The no platform sand monitor command disables fabric link monitoring.

Generate Serdes Error Syslog

The platform sand monitor serdes error log command generates syslog fabric link monitoring for serdes error logging.

Example

This command enables the serdes error log for fabric link monitoring.

switch(config)# platform sand monitor serdes error log
switch(config)#

The following syslog messages are not enabled by default. Fabric link monitoring syslog is enabled by configuring the platform sand monitor serdes error log command.

Examples
  • The following Syslog message is generated when a fabric link for serdes is automatically withdrawn:
    %SAND-4-SERDES_WITHDRAWN_FROM_FABRIC: Serdes withdrawn from the switch fabric.

  • Here is another instance where a Syslog message is generated when a fabric link is automatically withdrawn:
    %SAND-4-SERDES_WITHDRAWN_FROM_FABRIC: Serdes Arad10/5-FabricSerdes-11 withdrawn from the switch fabric.

  • The following Syslog message is generated when a fabric link is restored:
    %SAND-4-SERDES_RESTORED_TO_FABRIC: Serdes restored to the switch fabric. 

  • Here is another instance where a Syslog message is generated when a fabric link is restored:
    %SAND-4-SERDES_RESTORED_TO_FABRIC: Serdes Arad10/5-FabricSerdes-11 restored to the switch fabric.

Generate Serdes Error Threshold

The platform sand monitor serdes error threshold command generates a fabric link monitoring serdes error threshold.

Example

This command monitors serdes error thresholds over the specified number of received cells, resulting in the isolation of a fabric link between 200 and 30000 received cells.

switch(config)# platform sand monitor serdes error threshold 200 30000
switch(config)#

Enable Serdes Poll Period

The platform sand monitor serdes poll period command sets the serdes poll period.

Example

This command changes the serdes polling period for fabric link monitoring to 6 seconds.

switch(config)# platform sand monitor serdes poll period 6
switch(config)#

Monitor Serdes Poll Threshold Isolation

The platform sand monitor serdes poll threshold isolation command sets and enables fabric link monitoring for serdes poll threshold isolation.

Example

This command changes the number of consecutive polls in which the threshold needs to be detected to isolate a link. In this case the number is 5 consecutive polls.

switch(config)# platform sand monitor serdes poll threshold isolation 5
switch(config)#

Monitor Serdes Poll Threshold Recovery

The platform sand monitor serdes poll threshold recovery command sets and enables fabric link monitoring for serdes poll threshold recovery.

Example

This command changes the number of consecutive serdes polls used for threshold recovery to 6 seconds.

switch(config)# platform sand monitor serdes poll threshold recovery 6
switch(config)#

Show Fabric Monitoring Health

The show fabric monitoring health command displays the fabric monitoring connected state status with isolated links.

Example

When fabric links are isolated, their connected state status is shown with isolated links.

switch(config)# show platform sand health
Fabric serdes isolated by fabric monitoring: (36 total)

Arad5/0 serdes [0-1, 10-19, 2, 20-29, 3, 30-35, 4-9]

Top fabric serdes list by number of times isolated by monitoring:
Arad5/0 serdes 0: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 1: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 10: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 11: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 12: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 13: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 14: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 15: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 16: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 17: 1 (last occurred: 0:01:04 ago)

switch(config)#

Rapid Automated Indication of Link-Loss

Rapid Automated Indication of Link-Loss (RAIL) is a software feature that reduces the wait time of applications on hosts that are blocked due to a failed link. When a link goes down because of link-flapping or the unavailability of a directly connected server, the switch drops all traffic to servers whose next-hop destination was learned on the port connected to the link. Applications that drive the traffic (clients on source hosts) are blocked because of the dropped edge-switch traffic. Connection timeout varies by application and is usually measured in seconds or minutes.

RAIL is functional on a switch if it is routing-enabled and available for servers that set the switch as the default router.

RAIL Method

When a link monitored by RAIL goes down, the switch performs these steps for servers that the switch proxies:

  1. IP addresses of servers on the failed link are extracted from ARP cache. The interface that accesses the server is determined by searching for the MAC address in the hardware MAC address tables.

  2. Upon link shutdown, a dynamic MAC entry is added in the MAC address table for each server that was learned on the failed interface. Each new entry lists its interface as CPU.

The figure below titled RAIL Scenarios depicts three switch-server scenarios: link is up, link is down with RAIL disabled, and link is down with RAIL enabled. A failed link with RAIL enabled results in these behaviors:
  1. All ingress packets whose destination MAC address matches an address added to the MAC address table are sent to the CPU.

  2. For packets scheduled to be forwarded to the source address, the switch sends one of the following, based on the type of received segment:
    • TCP: TCP RST segment to the source IP address and port.
    • UDP: ICMP unreachable segment to the source IP address and port.

  3. The client closes the socket associated with the transmitted segment and notifies the application. The application reacts immediately instead of maintaining the block until connection timeout expiry.
    Figure 2. RAIL Scenarios

RAIL Implementation

RAIL defines a state machine that manages the RAIL activity level relative to a specified server. The state machine consists of four states:
  • Up: Transitions to this state from Inactive when ARP and MAC entries are added for the server.

  • Proxying: Transitions to this state from Up when Link Down is detected and RAIL proxying is enabled. The switch is a proxy for messages to the server.

  • Down: Transitions to this state from Up when Link Down is detected and RAIL proxying is not enabled. Messages from the client remain unanswered and the application recovers only after timeout expiry.

  • Inactive: Transitions to this state upon any of the following conditions:
    • Server’s MAC address or ARP entry is deleted (from any state).
    • Proxy timeout expiry (from Proxying state).
    • Link down timeout expiry (from Down state).

RAIL Configuration

Server-failure configuration mode commands globally enable RAIL and configure RAIL parameters. RAIL is functional on individual interfaces only when it is globally enabled and enabled on the interface. RAIL monitors an interface for link errors when RAIL is globally enabled and enabled on the interface.

Entering Server-failure Configuration Mode

The monitor server-failure command places the switch in server-failure configuration mode. The exit command returns the switch to global configuration mode. Server-failure mode is not a group change mode; running-config is changed when commands are entered and not affected by exiting the mode.

The no monitor server-failure deletes all server-failure mode commands from running-config.

Examples
  • These commands place the switch in the server-failure configuration mode.
    switch(config)# monitor server-failure
    switch(config-server-failure)#

  • This command deletes all server-failure configuration mode commands from running-config.
    switch(config)# no monitor server-failure
    switch(config)#

Enabling RAIL on the Switch

RAIL is disabled by default and is enabled by no shutdown (server-failure configuration mode). The shutdown command disables RAIL without removing RAIL commands from running-config.

Examples
  • These commands enable RAIL globally.
    switch(config)# monitor server
    switch(config-server-failure)# no shutdown
    switch(config-server-failure)# show active
    monitor server-failure
       no shutdown
    switch(config-server-failure)#

  • This command disables RAIL globally.
    switch(config-server-failure)# shutdown
    switch(config-server-failure)#

Enabling Proxy Mode

The proxy (server-failure configuration mode) command sets the RAIL proxy setting to enabled and specifies the interval that RAIL responds to messages sent to servers on failed links. The proxy timeout is measured individually for each server whose link has failed. The switch enters RAIL proxy state only when the proxy setting is enabled.

When RAIL is enabled but the proxy setting is disabled, the switch maintains a list of unavailable servers without responding to messages sent to the servers. The RAIL proxy setting is disabled by default. When RAIL proxy is enabled, the default period is three minutes.

The no proxy and default proxy commands return the RAIL proxy setting to disabled. The no proxy lifetime and default proxy lifetime commands set the proxy timeout to its default of three minutes if the RAIL proxy setting is enabled. The lifetime commands have no effect if RAIL proxy is disabled.

Examples
  • These commands enable the RAIL proxy and sets the proxy timeout period of 10 minutes.
    switch(config)# monitor server
    switch(config-server-failure)# proxy lifetime 10
    switch(config-server-failure)# show active
    monitor server-failure
       proxy lifetime 10
    switch(config-server-failure)#

  • This command sets the proxy timeout period to its default value of 3 minutes.
    switch(config-server-failure)# no proxy lifetime
    switch(config-server-failure)# show active
    monitor server-failure
       proxy
    switch(config-server-failure)#

  • This command disables the RAIL proxy.
    switch(config-server-failure)# no proxy
    switch(config-server-failure)# show active
    switch(config-server-failure)#

Selecting Networks to Monitor

The network (server-failure configuration mode) command specifies the IPv4 network space that Rapid Automated Indication of Link-Loss (RAIL) monitors for failed links to connected servers. Running-config can contain multiple network statements, allowing RAIL to monitor multiple disjoint network spaces.

When a server on the specified network is blocked because of a failed Ethernet or port channel link, the switch becomes a proxy for the unavailable server and responds with TCP RST or ICMP Unreachable segments to devices sending packets to the unavailable server.

Example

These commands specify two IPv4 network spaces that RAIL monitors for server failures.

switch(config)# monitor server
switch(config-server-failure)# network 10.1.1.0/24
switch(config-server-failure)# network 10.2.1.96/28
switch(config-server-failure)# show active
monitor server-failure
   network 10.2.1.96/28
   network 10.1.1.0/24
switch(config-server-failure)#

Enabling RAIL on an Interface

RAIL monitors an interface for link errors only when RAIL is globally enabled and enabled for the interface. The monitor server-failure link command enables RAIL on the configuration mode interface. Configuration settings are effective for all Ethernet and port channel interfaces that enable RAIL.

Example

These commands enable RAIL on port channel interface 100.

switch(config)# interface port-channel 100
switch(config-if-Po100)# monitor server-failure link
switch(config-if-Po100)# show active
interface Port-Channel100
   monitor server-failure link
switch(config-if-Po100)#

Displaying RAIL Status

The switch provides commands to display RAIL configuration and status information:

Displaying RAIL Configuration settings

The show monitor server-failure command displays Rapid Automated Indication of Link-Loss (RAIL) configuration settings and the number of servers on each monitored network.

Example

This command displays RAIL configuration status and lists the number of servers that are on each monitored network.

switch> show monitor server-failure
Server-failure monitor is enabled
Proxy service: disabled
Networks being monitored: 3
   10.2.1.96/28      : 0 servers
   10.1.1.0/24       : 0 servers
   10.3.0.0/16       : 3 servers
switch>

Displaying RAIL History for All Connected Servers

The show monitor server-failure history command displays the time of all link failures detected by Rapid Automated Indication of Link-Loss (RAIL) and includes the interface name for each failure.

Example

This command displays the link failure history from the time RAIL is instantiated on the switch.

switch> show monitor server-failure history
Total server failures: 4

Server IP   Server MAC              Interface           Last Failed
----------- -----------------       -----------         -------------------
10.1.67.92  01:22:ab:cd:ee:ff       Ethernet17          2013-02-02 11:26:22
44.11.11.7  ad:3e:5f:dd:64:cf       Ethernet23          2013-02-10 00:07:56
10.1.1.1    01:22:df:42:78:cd       Port-Channel6       2013-02-09 19:36:09
10.1.8.13   01:33:df:ee:39:91       Port-Channel5       2013-02-10 00:03:39

switch>

Displaying Server Configuration and Status

The show monitor server-failure servers command displays status and configuration data about each server that RAIL monitors. The display format depends on the parameter specified by the command:

Examples
  • This command displays RAIL information for the server at IP address 10.11.11.7.
    switch> show monitor server-failure servers 10.11.11.7
    Server information:
    Server Ip Address        : 10.11.11.7
    MAC Address              : ad:3e:5f:dd:64:cf
    Current state            : down
    Interface                : Ethernet23
    Last Discovered          : 2013-01-06 06:47:39
    Last Failed              : 2013-02-10 00:07:56
    Last Proxied             : 2013-02-10 00:08:33
    Last Inactive            : 2013-02-09 23:52:21
    Number of times failed   : 3
    Number of times proxied  : 1
    Number of times inactive : 18
    
    switch>

  • This command displays RAIL information for the all servers on configured interfaces.
    switch> show monitor server-failure servers all
    Total servers monitored: 5
    
    Server IP   Server MAC         Interface       State Last Failed
    ----------  -----------------  --------------  ---------  -----------
    10.1.67.92  01:22:ab:cd:ee:ff  Ethernet17      inactive   7 days, 12:47:48 ago
    44.11.11.7  ad:3e:5f:dd:64:cf  Ethernet23      down       0:06:14 ago
    10.1.1.1    01:22:df:42:78:cd  Port-Channel6   up         4:38:01 ago
    10.1.8.13   01:33:df:ee:39:91  Port-Channel5   proxying   0:10:31 ago
    132.23.23.1 00:11:aa:bb:32:ad  Ethernet1       up         never
    
    switch>

PHY test pattern CLI

Use the Ethernet Physical Layer (PHY) test pattern CLI to check the quality of the physical layer for an Ethernet interface. You can do this by generating a specific test pattern to a peer, and having the peer check the test pattern that is received, and vice versa. Because the test pattern is a well-known sequence of bits, the peer can check that the pattern received matches this well-known sequence; any difference is a bit error introduced by the peculiarities of the physical layer. The quality of the link is determined based on the acceptable bit errors, as published by the hardware vendors.

To enable the test pattern generator, configure a specific test pattern on the transmitter side of an interface. The test pattern checker is enabled by configuring the test pattern to be checked on the receiver side of the interface. PRBS is the test pattern supported by EOS.

Note: Physical links are bidirectional; to test both directions, the generator and checker both need to be enabled on both sides of the link. Both directions can be tested simultaneously or separately. The order of testing does not matter.

Configuration

You can configure a test pattern is configured using the phy diag interface configuration mode command.

  1. Enter interface configuration mode, entering the targeted interface name.
    switch(config)# interface <interfaceName>

  2. Enable a test pattern on an interface using the phy diag command. You can select the transmitter or the receiver. To display the available interfaces, select test pattern ?.
    switch(config-if)# phy diag [ transmitter | receiver ] test pattern ?
      PRBS11  Configure the PRBS11 test pattern
      PRBS15  Configure the PRBS15 test pattern
      PRBS23  Configure the PRBS23 test pattern
      PRBS31  Configure the PRBS31 test pattern
      PRBS49  Configure the PRBS49 test pattern
      PRBS58  Configure the PRBS58 test pattern
      PRBS7   Configure the PRBS7 test pattern
      PRBS9   Configure the PRBS9 test pattern

  3. To disable a test pattern on an interface, enter the following command. You can select the tranmitter or the receiver, as well as the selected named test pattern.
    switch(config-if)# no phy diag [transmitter|receiver] test pattern TestPattern

  4. By default, a test pattern is disabled.
    switch(config-if)# default phy diag [transmitter|receiver] test pattern

  5. The following command clears the recorded test pattern status data for all the interfaces. Upon running the command, all the counter values are set to 0 and link states are marked as not locked.
    switch# clear phy diag test pattern

Show Commands

To display the configured and operational test pattern, as well as the test patterns available for an interface, use the show interfaces command.

In the following example, interfaces ethernet 36/1 and ethernet 31/1 are selected for display. The user-configured test pattern is displayed under the Configured column, which is divided based on transmitter and receiver configuration. The currently operational test pattern is displayed under the Operational column. The Available column lists the test patterns available for the interface.

switch# show interfaces ethernet 26/1,31/1 phy diag test pattern
                    Configured       Operational
Interface        Transmit Receive Transmit Receive Available                   
---------------- -------- ------- -------- ------- ------------------------
Ethernet26/1     PRBS15   PRBS15  PRBS15   PRBS15  PRBS 7,9,11,15,23,31,58     
Ethernet31/1     PRBS7    PRBS31  PRBS7    PRBS31  PRBS 7,9,11,15,23,31,58 

Use the show interfaces [<interface range>] phy detail command to display the operational test pattern for an interface. In the example below, the Test pattern field will not be available, on disabling the test pattern.

Note: This command is not available on DCS-7060PX4 and DCS-7060DX4.

switch# show interfaces ethernet 26/1 phy detail | i Test pattern
  Test pattern                enabled
switch# show interfaces ethernet 31/1 phy detail | i Test pattern
  Test pattern                enabled

Use the show interfaces [<interface range>] phy diag test pattern counters to display test pattern link state and error information.

Available error information:
  • Link state: whether or not the checker locked on to the configured test pattern.

  • Bit Errors: the accumulated number of bit errors.

  • Largest Burst: the largest burst of errors that occurred.

  • Burst Count: the number of occurrences of errors.

  • Last Error Time: the last time an error has occurred, ‘never’ if no errors have occurred.

switch# show interfaces ethernet 26/1,31/1 phy diag test pattern counters
Current System Time: Wed May 30 22:24:32 2018
                                                Largest    Burst 
Interface        Lane  Link State  Bit Errors   Burst      Count    Last Error Time  
---------------- ----- ----------- ------------ ---------- -------- -----------------
Ethernet26/1     0     locked      409266       409266     1        0:21:27 ago      
Ethernet26/1     1     locked      347084       347084     1        0:21:27 ago      
Ethernet26/1     2     locked      420681       420681     1        0:21:27 ago      
Ethernet26/1     3     locked      392969       392969     1        0:21:27 ago      
Ethernet31/1     0     not locked  1417655      651822     3        0:03:20 ago      
Ethernet31/1     1     not locked  1782238      736819     3        0:03:20 ago      
Ethernet31/1     2     not locked  1760538      866185     3        0:03:20 ago      
Ethernet31/1     3     not locked  1817413      923941     3        0:03:20 ago 

Use the show interfaces [<interface range>] phy diag test pattern counters to display the lock state of an interface along with a detailed information on the recorded bit errors.

Available detailed information:
  • Last clear: the time when the test pattern results were last cleared.

  • Operational test pattern: the test pattern operational at the receiver side.

  • Bit rate: the transmission bit rate.

  • Lock state: the current lock status, number of times it changed and the last time the lock status got changed.
    • locked: receiver is able to lock on to the incoming test pattern.
    • not locked: receiver is not able to lock on to the incoming test pattern.

  • Largest burst: the largest burst of errors that occurred.

  • Bit errors*: the accumulated number of errors, number of occurrences of errors, and last time errors were captured. The * suffix, indicating that data may not be accurate due to loss of lock, is applied if the current lock status is not locked or if the lock status has changed more than once. This suffix is cleared when the test pattern status data is cleared via the CLI listed above.

  • Total Bits: the total bits received.

  • Bit error rate (BER)*:the ratio of captured bit errors to the total bit received. The * suffix, indicating that data may not be accurate due to loss of lock, is applied if the current lock status is not locked or if the lock status has changed more than once. This suffix is cleared when the test pattern status data is cleared via the CLI listed above.

  • Bit errors since last lock: the accumulated number of errors since last time lock was gained.

  • Total bits since last lock: the total bits received since last lock.

  • BER since last lock: the ratio of captured bit errors to the total bit received since last lock.

switch# show interfaces ethernet 26/1,31/1 phy diag test pattern counters detail
*: Data may not be accurate due to loss of lock.

Current System Time:  Wed May 30 23:36:34 2018
Ethernet26/1
  Last clear                     1:33:29 ago
  Operational test pattern       PRBS15
                                 Current State     Changes      Last Change
                                 -------------     -------      -----------
  Lane 0
     Bit rate                    25.781 Gbps
     Lock state                  locked                  1       1:33:28 ago
     Largest burst               409266
     Bit errors                  409266                  1       1:33:28 ago
     Total bits                  144,607.648 Gb
     Bit error rate              2.83E-09
     Bit errors since last lock  409266
     Total bits since last lock  161,542.986 Gb
     BER since last lock         2.53E-09
  Lane 1
     Bit rate                    25.781 Gbps
     Lock state                  locked                  1       1:33:28 ago
     Largest burst               347084
     Bit errors                  347084                  1       1:33:28 ago
     Total bits                  144,607.668 Gb
     Bit error rate              2.40E-09
     Bit errors since last lock  347084
     Total bits since last lock  161,543.006 Gb
     BER since last lock         2.15E-09
  Lane 2
     Bit rate                    25.781 Gbps
     Lock state                  locked                  1        1:33:28 ago
     Largest burst               420681
     Bit errors                  420681                  1        1:33:28 ago
     Total bits                  144,607.658 Gb
     Bit error rate              2.91E-09
     Bit errors since last lock  420681
     Total bits since last lock  161,542.996 Gb
     BER since last lock         2.60E-09
  Lane 3
     Bit rate                    25.781 Gbps
     Lock state                  locked                  1        1:33:28 ago
     Largest burst               392969
     Bit errors                  392969                  1        1:33:28 ago
     Total bits                  144,607.678 Gb
     Bit error rate              2.72E-09
     Bit errors since last lock  392969
     Total bits since last lock  161,543.016 Gb
     BER since last lock         2.43E-09

Ethernet31/1
  Last clear                     1:33:29 ago
  Operational test pattern       PRBS31
                                 Current State     Changes       Last Change
                                 -------------     -------       -----------
  Lane 0
     Bit rate                    25.781 Gbps
     Lock state                  not locked              3        1:15:22 ago
     Largest burst               651822
     Bit errors                  1417655*                3        1:15:22 ago
     Total bits                  144,626.220 Gb
 Bit error rate              > 9.80E-09*
     Bit errors since last lock  765833*
     Total bits since last lock  144,471.763 Gb
     BER since last lock         > 5.30E-09*
  Lane 1
     Bit rate                    25.781 Gbps
     Lock state                  not locked              3        1:15:22 ago
     Largest burst               736819
     Bit errors                  1782238*                3        1:15:22 ago
     Total bits                  144,626.240 Gb
     Bit error rate              > 1.23E-08*
     Bit errors since last lock  1147126*
     Total bits since last lock  144,471.783 Gb
     BER since last lock         > 7.94E-09*
  Lane 2
     Bit rate                    25.781 Gbps
     Lock state                  not locked              3        1:15:22 ago
     Largest burst               866185
     Bit errors                  1760538*                3        1:15:22 ago
     Total bits                  144,626.230 Gb
     Bit error rate              > 1.22E-08*
     Bit errors since last lock  894353*
     Total bits since last lock  144,471.773 Gb
     BER since last lock         > 6.19E-09*
  Lane 3
     Bit rate                    25.781 Gbps
     Lock state                  not locked              3        1:15:22 ago
     Largest burst               923941
     Bit errors                  1817413*                3        1:15:22 ago
     Total bits                  144,626.250 Gb
     Bit error rate              > 1.26E-08*
     Bit errors since last lock  893472*
     Total bits since last lock  144,471.793 Gb
     BER since last lock         > 6.18E-09*

Bit Error Rate (BER)

Bit error rate is the ratio of the recorded bit errors to the total bits received for the duration of the test run. To achieve a reliable transmission, BER should be relatively small. As per IEEE 802.3 standard, the minimum BER requirement for Ethernet links is 1E-12. Therefore, links with BER lower than 1E-12 are to be considered reliable.

The BER reported by the test pattern CLI is the pre-FEC (Forward Error Correction) BER. For links that have FEC enabled, it is expected to see a higher BER, in the range of 1E-4 to 1E-8, because they are calculated before FEC is applied on the link. Based on the type of FEC applied on the link, these errors could get corrected to achieve the minimum BER requirement of 1E-12 or less.

Limitations

The configuration of test patterns is supported only on a few types of ports. The available test patterns that may be configured on an interface are found in the Available field of the show interfaces phy diag test pattern CLI command.

The test pattern CLI calculates only pre-FEC BER.

If one end of the system is from another vendor, consult the vendor’s documentation for the equivalent command(s) to achieve the appropriate behavior.

Data Transfer Commands

Control Plane and Data Plane Commands

Errdisable Commands

Fabric Link Monitoring Commands

RAIL Commands

Link Flap Monitor Commands

MAC Address Table Commands

Port Configuration Commands

Port Mirroring Commands

Port Security Commands

Storm Control Commands

Tracking Commands

clear counters

The clear counters command resets the counters to zero for the specified interfaces. The command provides the following options:
  • No parameter: When no option is selected, the counters are reset on the switch.

  • Session parameter: The command resets the counters in software for the current CLI session, establishing a baseline upon which subsequent show interfaces or show interfaces counters commands are relative. Counters are not affected for other CLI sessions.

Note: The clear counters command (and other commands that reset counters to zero) do not reset SNMP counters (such as IF-MIB::ifInOctets). As specified in RFC 2578, sections 7.1.6 and 7.1.10, a single value of a counter in SNMP has no information content. Instead, meaningful information is given by the difference between two separate fetches of a particular counter. SNMP counters automatically reset to 0 when they reach their maximum values.

Command Mode

Privileged EXEC

Command Syntax

clear counters [INTERFACE][SCOPE]

Parameters
  • INTERFACE     Interface type and number. Options include:
    • no parameter      Display information for all interfaces.
    • ethernet e_range     Ethernet interface range specified by e_range.
    • loopback l_range     Loopback interface specified by l_range.
    • management m_range     Management interface range specified by m_range.
    • port-channel p_range     Port-Channel Interface range specified by p_range.
    • vlan v_range     VLAN interface range specified by v_range.
    • VXLAN vx_range     VXLAN interface range specified by vx_range.

  • Valid e_range, l_range, m_range, p_range, v_range, and vx_range formats include number, number range, or comma-delimited list of numbers and ranges.

  • SCOPE     Duration of the reset results. Options include:
    • no parameter     counters are cleared on the switch.
    • session     counters are reset only for the current session.

Example

These commands display interface counters, clear the counters, then display the counters again.
switch# show interfaces ethernet 1
Ethernet1 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 001c.7302.2fff (bia 001c.7302.2fff)
  MTU 9212 bytes, BW 10000000 Kbit
  Full-duplex, 10Gb/s, auto negotiation: off
  Last clearing of "show interface" counters never
  5 minutes input rate 301 bps (0.0% with framing), 0 packets/sec
  5 minutes output rate 0 bps (0.0% with framing), 0 packets/sec
     2285370854005 packets input, 225028582832583 bytes
     Received 29769609741 broadcasts, 3073437605 multicast
     113 runts, 1 giants
     118 input errors, 117 CRC, 0 alignment, 18 symbol
     27511409 PAUSE input
     335031607678 packets output, 27845413138330 bytes
     Sent 14282316688 broadcasts, 54045824072 multicast
     108 output errors, 0 collisions
     0 late collision, 0 deferred
     0 PAUSE output

switch# show interfaces ethernet 1-5 counters
Port                 InOctets     InUcastPkts     InMcastPkts     InBcastPkts
Et1           225028582833321   2252527806659      3073437611     29769609741
Et2            20706544058626    121703943738      7619026884     43349412335
Et3            17473231954010     84335312119     18987530444     25136247381
Et4            21909861242537    119410161405      3792251718     48470646199
Et5                         0               0               0               0

Port                OutOctets    OutUcastPkts    OutMcastPkts    OutBcastPkts
Et1            27845413138330    266703466918     54045824072     14282316688
Et2            39581155181762    384838173282     34879250675     15500233246
Et3            25684397682539    256695349801     25193361878     16244203611
Et4           428040746505736   2285287022532     44408620604     19503612572
Et5                         0               0               0               0

switch# clear counters session

switch# show interfaces ethernet 1
Ethernet1 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 001c.7302.2fff (bia 001c.7302.2fff)
  MTU 9212 bytes, BW 10000000 Kbit
  Full-duplex, 10Gb/s, auto negotiation: off
  Last clearing of "show interface" counters 0:00:10 ago
  5 minutes input rate 322 bps (0.0% with framing), 0 packets/sec
  5 minutes output rate 0 bps (0.0% with framing), 0 packets/sec
     6 packets input, 835 bytes
     Received 0 broadcasts, 6 multicast
     0 runts, 0 giants
     0 input errors, 0 CRC, 0 alignment, 0 symbol
     0 PAUSE input
     0 packets output, 0 bytes
     Sent 0 broadcasts, 0 multicast
     0 output errors, 0 collisions
     0 late collision, 0 deferred
     0 PAUSE output

switch# show interfaces ethernet 1-5 counters
Port                 InOctets     InUcastPkts     InMcastPkts     InBcastPkts
Et1                      1204               0               9               0
Et2                      1204               0               9               0
Et3                      1204               0               9               0
Et4                      1204               0               9               0
Et5                         0               0               0               0

Port                OutOctets    OutUcastPkts    OutMcastPkts    OutBcastPkts
Et1                         0               0               0               0
Et2                         0               0               0               0
Et3                         0               0               0               0
Et4                         0               0               0               0
Et5                         0               0               0               0
switch#

clear mac address-table dynamic

The clear mac address-table dynamic command removes specified dynamic entries from the MAC address table. Entries are identified by their VLAN and Layer 2 (Ethernet or port channel) interface.
  • To remove a specific entry, include its VLAN and interface in the command.
  • To remove all dynamic entries for a VLAN, do not specify an interface.
  • To remove all dynamic entries for an interface, do not specify a VLAN.
  • To remove all dynamic entries, do not specify a VLAN or an interface.

Command Mode

Privileged EXEC

Command Syntax

clear mac address-table dynamic [VLANS][INTERFACE]

Parameters
  • VLANS     Table entries are cleared for specified VLANs. Options include:
    • no parameter     all VLANs.
    • vlan v_num     VLAN specified by v_num.

  • INTERFACE     Table entries are cleared for specified interfaces. Options include:
    • no parameter     all Ethernet and port channel interfaces.
    • interface ethernet e_range     Ethernet interfaces specified by e_range.
    • interface port-channel p_range     port channel interfaces specified by p_range.
    • VXLAN vx_range     VXLAN interfaces specified by vx_range.

    Valid range formats include number, range, or comma-delimited list of numbers and ranges.

Example

This command clears all dynamic mac address table entries for port channel 5 on vlan 34.
switch# clear mac address-table dynamic vlan 34 interface port-channel 5
switch#

clear server-failure servers inactive

The clear server-failure servers inactive command removes all inactive server entries from the server failed history list. The switch maintains this list, even after a server’s ARP entry is removed, to maintain a list of servers that are connected to the switch and log the most recent time of the failure of the link that connects the switch to the server.

Command Mode

Privileged EXEC

Command Syntax

clear server-failure servers inactive

Related Command

show monitor server-failure history

Example

This command clears the inactive servers from the server failed history list.
switch# clear server-failure servers inactive
switch#

default-profiles

The default-profiles command specifies the set of link-flap profiles that define error-disable criteria for interfaces where link flap monitoring is enabled without a link flap profile assignment. Entering a default-profile command replaces the current default-profile statement in running-config.

The default-profile set may contain zero, one, or multiple profiles. When the default-profile set is empty, errdisable flap-setting cause link-flap specifies default error-disable criteria. When the default-profile set contains multiple profiles, error-disable criteria is satisfied when conditions match any profile. Multiple profiles are assigned to the default-profile set through a single default-profiles command.

The no default-profiles and default default-profiles commands restore the empty default-profile set by deleting the default-profiles command from running-config.

Command Mode

Link-flap Configuration

Command Syntax

default-profiles [LF_PROFILES]

no default-profiles

default default-profiles

Parameters

LF_PROFILES     Name of link-flap profiles assigned to default profile set. Parameter may contain zero, one, or multiple link-flap profile names:
  • no parameter     default-profile set is empty.
  • profile     name of single link-flap profile.
  • profile_1  profile_2 ... profile_N     list of link-flap profile names.

Related Commands

Guidelines

The errdisable flap-setting cause link-flap statement is also configurable through the profile max-flaps (Link Flap Configuration) command.

Example

This command assigns configures LF01 and LF02 as the default-profile set.
switch(config)# monitor link-flap policy
switch(config-link-flap)# default-profiles LF01 LF02
switch(config-link-flap)# show active
monitor link-flap policy
   profile LF01 max-flaps 15 time 60 violations 1 intervals 1
   profile LF02 max-flaps 10 time 30 violations 5 intervals 10
   profile LF03 max-flaps 25 time 100 violations 2 intervals 12
   profile LF04 max-flaps 5 time 15 violations 1 intervals 3
   default-profiles LF01 LF02
switch(config-link-flap)#

description

The description command adds comment text for the configuration mode interface. The text provides information about the interface and has no effect on interface functions. The show interfaces description command displays interface description text.

The no description command removes the description text for the configuration mode interface from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Interface-VXLAN Configuration

Command Syntax

description label_text

no description

default description

Parameter

label_text     character string assigned to description attribute.

Example

These commands add description text to interface ethernet 23, then displays the text through the show interfaces description command.
switch(config)# interface ethernet 23
switch(config-if-Et23)# description external line
switch(config-if-Et23)# show interfaces ethernet 23 description
Interface              Status     Protocol    Description
Et23                   up         up          external line

errdisable detect cause link-change

The errdisable detect cause link-change command enables the error-disabling of Ethernet interfaces when the switch detects a link flap error on the interface. The errdisable flap-setting cause link-flap command defines a link flap error in terms of the frequency of connection state changes.

The switch places an interface in error-disabled state when it detects an error on the interface. Error-disabled is an operational state that is similar to link-down state. To re-enable an error-disabled interface, enter shutdown and no shutdown command in the configuration mode for the interface.

By default, link flap detection is enabled. The no errdisable detect cause link-changecommand disables the triggering of error-disable actions. The errdisable detect cause link-change and default errdisable detect cause link-change commands enable the triggering of error-disable actions by removing the no errdisable detect cause link-change command from running-config.

Command Mode

Global Configuration

Command Syntax

errdisable detect cause link-change

no errdisable detect cause link-change

default errdisable detect cause link-change

Examples
  • This command disables error detection on the switch.
    switch(config)# no errdisable detect cause link-change
    switch(config)#

  • These commands sets the link flap error criteria of 15 connection state changes over a 30 second period, then enables error detection on the switch.
    switch(config)# errdisable flap-setting cause link-flap max-flaps 15 time 30
    switch(config)# errdisable detect cause link-change
    switch(config)#

errdisable flap-setting cause link-flap

The errdisable flap-setting cause link-flap command configures the link-flap frequency that defines an link-flap error on an Ethernet interface. The errdisable detect cause link-change command uses this criteria to trigger an error-disable action.

The link-flap frequency is defined by the quantity of link flaps (connection state changes) over a specified period. The default settings are five link flaps and ten seconds.

The no errdisable flap-setting cause link-flap and default errdisable flap-setting cause link-flap commands restore the default link flap cause settings by removing the errdisable flap-setting cause link-flap command from running-config.

Command Mode

Global Configuration

Command Syntax

errdisable flap-setting cause link-flap max-flaps quantity time period

no errdisable flap-setting cause link-flap

default errdisable flap-setting cause link-flap

Parameters
  • quantity     Number of link flaps. Value ranges from 1 to 100. Default value is 5.
  • period     Interval over which link flaps accumulate to trigger an error condition (seconds). Value ranges from 1 to 1800. Default value is 10.

Example

This command sets the link flap error criteria of 15 connection state changes over 30 second periods.
switch(config)# errdisable flap-setting cause link-flap max-flaps 15 time 30
switch(config)#

errdisable recovery cause

The errdisable recovery cause command enables the automated recovery of error-disabled Ethernet interfaces. An interface that is disabled as a result of a specified condition attempts normal operation after a specified interval. When the disabling condition persists, recovered interfaces eventually return to the error-disabled state.

When automated recovery is not enabled, interfaces are recovered manually by entering shutdown and no shutdown from the interface’s configuration mode.

Running-config can simultaneously store errdisable recovery cause statements for each error-disable condition. By default, error-disable recovery is disabled for all conditions.

The no errdisable recovery cause and default errdisable recovery cause commands disable automated recovery for interfaces disabled by the specified condition by removing the corresponding errdisable recovery cause command from running-config.

Command Mode

Global Configuration

Command Syntax

errdisable recovery cause CONDITION

no errdisable recovery cause CONDITION

default errdisable recovery cause CONDITION

Parameters

CONDITION     Disabling condition for which command automates recovery. Options include:
  • arp-inspection
  • bpduguard
  • link-flap
  • no-internal-vlan
  • portchannelguard
  • portsec
  • tapagg
  • uplink-failure-detection
  • xcvr_unsupported

Related Command

errdisable recovery interval configures the period that an ethernet interface remains disabled before automated recovery begins.

Example

This command enables error-disable recovery for interfaces that are disabled by link-flap and bpduguard conditions and sets the errdisable recovery period at 10 minutes.
switch(config)# errdisable recovery cause bpduguard
switch(config)# errdisable recovery cause link-flap
switch(config)# errdisable recovery interval 600
switch(config)# show running-config
! Command: show running-config

errdisable recovery cause bpduguard
errdisable recovery cause link-flap
errdisable recovery interval 600
!

switch(config)#

errdisable recovery interval

The errdisable recovery interval command specifies the period that an error-disabled Ethernet interface remains disabled before automated errdisable recovery begins. This command affects only interfaces whose automated recovery is enabled for the disabling condition (errdisable recovery cause). When automated recovery is not enabled, interfaces are recovered manually by entering shutdown and no shutdown from the interface’s configuration mode.

The no errdisable recovery interval and default errdisable recovery interval commands restore the default error recovery period of 300 seconds by removing the errdisable recovery interval command from running-config.

Command Mode

Global Configuration

Command Syntax

errdisable recovery interval period

no errdisable recovery interval

default errdisable recovery interval

Parameters

period     Error disable recovery period (seconds). Value ranges from 30 to 86400. Default value is 300.

Related Command

errdisable recovery cause enables the automated recovery of error-disabled Ethernet interfaces.

Example

This command enables error-disable recovery for interfaces that are disabled by link-flap conditions and sets the errdisable recovery period at 10 minutes.
switch(config)# errdisable recovery cause link-flap
switch(config)# errdisable recovery interval 600
switch(config)# show running-config
! Command: show running-config

!
errdisable recovery cause link-flap
errdisable recovery interval 600
!

!
i
switch(config)#

interface loopback

The interface loopback command places the switch in loopback interface configuration mode for the specified interface and creates a loopback interface if one does not exist.It can also be used to configure multiple loopback interfaces if they have all been previously created.

The command can specify a single interface or multiple interfaces:
  • Single interface: Command creates an interface if it specifies one that was not previously created.

  • Multiple interfaces: Command is valid only if all specified interfaces were previously created.

The no interface loopback command removes the specified interfaces from running-config, including all interface configuration statements. The default interface loopback command removes all configuration statements for the specified loopback interface without deleting the loopback interface from running-config.

The following commands are available in loopback interface configuration mode:
  • description
  • exit
  • ip address
  • ip proxy-arp
  • ipv6 address
  • ipv6 enable
  • load interval
  • logging event
  • mtu
  • shutdown (Interfaces)
  • snmp trap

Command Mode

Global Configuration

Command Syntax

interface loopback l_range

no interface loopback l_range

default interface loopback l_range

Parameters

l_range     Loopback interfaces (number, range, or comma-delimited list of numbers and ranges). Loopback number ranges from 0 to 1000.

Examples
  • This command enters loopback interface configuration mode for loopback interfaces 1 through 5.
    switch(config)# interface loopback 1-5
    switch(config-if-Lo1-5)#

  • This command creates interface 23 and enters loopback interface configuration mode.
    switch(config)# interface loopback 23
    switch(config-if-Lo23)#

  • This command removes loopback interfaces 5 through 7 from running-config.
    switch(config)# no interface loopback 5-7
    switch(config)#

ip access-group (Control Plane mode)

The ip access-group command applies an IPv4 or standard IPv4 Access Control List (ACL) to the control plane.

The no ip access-group and default ip access-group commands remove the corresponding ip access-group command from running-config.

Command Mode

Control-plane Configuration

Command Syntax

ip access-group list_name [VRF_INSTANCE] DIRECTION

no ip access-group [list_name][VRF_INSTANCE] DIRECTION

default ip access-group [list_name][VRF_INSTANCE] DIRECTION

Parameters
  • list_name     name of ACL assigned to interface.
  • VRF_INSTANCE     specifies the VRF instance being modified.
    • no parameter     changes are made to the default VRF.
    • vrf vrf_name     changes are made to the specified user-defined VRF.

  • DIRECTION     transmission direction of packets, relative to interface. Valid options include:
    • in     inbound packets.

Example

These commands apply the IPv4 ACL named test2 to the control plane.
switch(config)# system control-plane
switch(config-system-cp)# ip access-group test2 in
switch(config-system-cp)#

link tracking group (interface)

The link tracking group command adds the configuration mode interface to a link-state group and specifies whether it is upstream or downstream.

The no link tracking group and default link tracking group commands remove the specified link-state group assignment for the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Interface-VXLAN Configuration

Command Syntax

link tracking group group_name DIRECTION

no link tracking group [group_name]

default link tracking group [group_name]

Parameters
  • group_name     link tracking group name.
  • DIRECTION     position of the interface in the link-state group. Valid options include:
    • upstream
    • downstream

Example

These commands create link-state group “xyz” and add VLAN interface 100 to the group as an upstream interface.
switch(config)# link tracking group xyz
switch(config-link-state-xyz)# show active
link tracking group xyz
switch(config-link-state-xyz)# exit
switch(config)# interface vlan 100
switch(config-if-Vl100)# link tracking group xyz upstream
switch(config-if-Vl100)# show active
 interface Vlan100
   link state group xyz upstream
switch(config-if-Vl100)#

link tracking group

The link tracking group command creates and enables a link-state group and places the switch in link-state-group configuration mode. A link-state group consists of “upstream” interfaces (connections to servers) and “downstream” interfaces (connections to switches and clients). In the event of a failure of all upstream interfaces in the link-state group, the downstream interfaces are shut down.

The no link tracking group and default link tracking group commands delete the link tracking group from running-config.

Command Mode

Global Configuration

Command Syntax

link tracking group group_name

no link tracking group group_name

default link tracking group group_name

Parameter

group_name link-state group name.

Commands available in link-state Configuration Mode

links minimum configures the minimum number of links that the link-state group requires.

Example

This command creates and enables link-state group 1.
switch(config)# link tracking group 1
switch(config-link-state-1)# 

links minimum

The links minimum command specifies the minimum number of links the configuration mode link-state group requires.

The no links minimum and default links minimum commands restore the default minimum value of 1 by deleting the corresponding links minimum statement from running-config.

Command Mode

Link-State Configuration

Command Syntax

links minimum quantity

no links minimum

default links minimum

Parameter

quantity     Minimum number of links. Value ranges from 1 to 100000. Default value is 1.

Related Commands

Example

These commands configure link-state tracking group link-a to have at least 60 links.
switch(config)# link tracking group link-a
switch(config-link-state-1ink-a)# links minimum 60
switch(config-link-state-link-a)# 

load interval

The load-interval command changes the load interval for the configuration mode interface. Load interval is the time period over which data is used to compute interface rate counters. Interface rates are exponentially weighted moving averages; recent data samples have greater influence than older samples. Statistics calculated with shorter load intervals are usually more sensitive to short traffic bursts.

The no load-interval and default load-interval commands restore the default value of 300 seconds by removing the corresponding load-interval statement from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Interface-VXLAN Configuration

Command Syntax

load-interval delay

no load-interval

default load-interval

Parameter

delay     Load interval delay. Values range from 5 to 600 (seconds). Default value is 300 (five minutes).

Example

These commands set the load interval for interface ethernet 7 at 60 seconds.
switch(config)# interface ethernet 7
switch(config-if-Et7)# load-interval 60
switch(config-if-Et7)#

mac address learning

The mac address learning command enables MAC address learning on a VLAN configuration mode. By default, MAC address learning is enabled by on a VLAN.

The no mac address learning command disables MAC address learning for the VLAN configuration mode. The mac address learning and default mac address learning commands enable MAC address learning for the VLAN configuration mode by deleting the corresponding no mac address learning command from the running-config.

Command Mode

Interface-VLAN Configuration

Command Syntax

mac address learning local limit

no mac address learning local limit

default mac address learning local limit

Parameter

local limit Maximum number of locally learned dynamic hosts. Range 0-10000. To reset the learning limit threshold to have no limit, use the mac address learning command.

Examples
  • These commands enable MAC address learning on vlan 10 configuration.
    switch(config)# vlan 10
    switch(config-vlan-10)# mac address learning 

  • These commands disable MAC address learning on vlan 10 configuration.
    switch(config)# vlan 10
    switch(config-vlan-10)# no mac address learning

  • An example for 5,000 MACs:
    switch(config-vla-10)# mac address learning local limit 5000 hosts

    Mac address learning local limit 5000 host.

    No mac address learning local limit 5000 host.

    Default mac address learning local limit 5000 host.

mac address-table aging-time

The mac address-table aging-time command configures the aging time for MAC address table dynamic entries. Aging time defines the period an entry is in the table, as measured from the most recent reception of a frame on the entry’s VLAN from the specified MAC address. The switch removes entries when their presence in the MAC address table exceeds the aging time.

The no mac address-table aging-time and default mac address-table aging-time commands reset the aging time to its default by removing the mac address-table aging-time command from running-config.

Command Mode

Global Configuration

Command Syntax

mac-address-table aging-time period

no mac-address-table aging-time

default mac-address-table aging-time

Parameters
  • period     MAC address table aging time. Default is 300 seconds. Options include:
    • 0     disables deletion of table entries on the basis of aging time.
    • 10 through 1000000 (one million) aging period (seconds).

Example

This command sets the MAC address table aging time to two minutes (120 seconds).
switch(config)# mac address-table aging-time 120
switch(config)#

mac address-table static

The mac address-table static command adds a static entry to the MAC address table. Each table entry references a MAC address, a VLAN, and a list of Layer 2 (Ethernet or port channel) ports. The table supports three entry types: unicast drop, unicast, and multicast.
  • A drop entry does not include a port.
  • A unicast entry includes one port.
  • A multicast entry includes at least one port.

Packets with a MAC address (source or destination) and VLAN specified by a drop entry are dropped. Drop entries are valid for only unicast MAC addresses.

The command replaces existing dynamic or static table entries with the same VLAN-MAC address. Static entries are not removed by aging (mac address-table aging-time). Static MAC entries for mirror destinations or LAG members are typically avoided.

The most important byte of a MAC address distinguishes it as a unicast or multicast address:
  • Unicast: most significant byte is an even number. Examples: 0200.0000.0000     1400.0000.0000.

  • Multicast: most significant byte is an odd number. Examples: 0300.0000.0000     2500.0000.0000.

The no mac address-table static and default mac address-table static commands remove corresponding mac address-table static commands from running-config and MAC address table entries.

Command Mode

Global Configuration

Command Syntax

mac address-table static mac_address vlan v_num [DESTINATION]

no mac address-table static mac_address vlan v_num [DESTINATION]

default mac address-table static mac_address vlan v_num [DESTINATION]

Parameters
  • mac_address     Table entry’s MAC address (dotted hex notation – H.H.H).
  • v_num     Table entry’s VLAN.
  • DESTINATION     Table entry’s port list.

    For multicast MAC address entries, the command may contain multiple ports, listed in any order. The CLI accepts only one interface for unicast entries.

  • drop     creates drop entry in table. Valid only for unicast addresses.
    • interface ethernet e_range     Ethernet interfaces specified by e_range.
    • interface port-channel p_range     Port channel interfaces specified by p_range.
    • no parameter     Valid for no and default commands that remove multiple table entries.

      e_range and p_range formats include number, range, comma-delimited list of numbers and ranges.

Examples
  • This command adds a static entry for unicast MAC address 0012.3694.03ec to the MAC address table.
    switch(config)# mac address-table static 0012.3694.03ec vlan 3 interface ethernet 7
    switch(config)# show mac address-table static
              Mac Address Table
    ----------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports    Moves   Last Move
    ----    -----------       ----        -----    -----   ---------
       3    0012.3694.03ec    STATIC      Et7
    Total Mac Addresses for this criterion: 1
    
              Multicast Mac Address Table
    ----------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
    Total Mac Addresses for this criterion: 0
    
    switch(config)#

  • These commands adds a static drop entry for MAC address 0012.3694.03ec to the MAC address table, then displays the entry in the MAC address table.
    switch(config)# mac address-table static 0012.3694.03ec vlan 3 drop
    switch(config)# show mac address-table static
              Mac Address Table
    ----------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports    Moves   Last Move
    ----    -----------       ----        -----    -----   ---------
       1    0012.3694.03ec    STATIC
    Total Mac Addresses for this criterion: 1
    
              Multicast Mac Address Table
    ----------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
    Total Mac Addresses for this criterion: 0
    
    switch(config)#

  • This command adds a static entry for the multicast MAC address 0112.3057.8423 to the MAC address table.
    switch(config)# mac address-table static 0112.3057.8423 vlan 4 interface 
    port-channel 10 port-channel 12
    switch(config)# show mac address-table
              Mac Address Table
    -----------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports    Moves   Last Move
    ----    -----------       ----        -----    -----   ---------
    Total Mac Addresses for this criterion: 0
    
              Multicast Mac Address Table
    ----------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
       4    0112.3057.8423    STATIC      Po10 Po12
    Total Mac Addresses for this criterion: 1
    switch(config)#

monitor link-flap policy

The monitor link-flap policy command places the switch in link-flap configuration mode for configuring link flap profiles and compiling a default-profile set. Link-flap configuration mode is not a group change mode; running-config is changed immediately after commands are executed. The exit command does not affect the configuration.

Link flap profiles are assigned to Ethernet interfaces and specify conditions that define a link-flap error. When link flap monitoring is enabled on an interface, the link-flap conditions determine when the interface is error-disabled. Multiple profiles can be assigned to an interface to monitor a set of error conditions.

Command Mode

Global Configuration

Command Syntax

monitor link-flap policy

Commands Available in Link-flap Configuration Mode

Examples
  • These commands place the switch in link-flap configuration mode.
    switch(config)# monitor link-flap policy
    switch(config-link-flap)#

  • This command returns the switch to global configuration mode.
    switch(config-link-flap)# exit
    switch(config)#

monitor link-flap profiles

The monitor link-flap profiles command enables link-flap monitoring on the configuration mode interface and specifies the error-disable criteria for the interface. Entering a monitor link-flap profiles command replaces the corresponding statement in running-config.

The command enables the following link flap detection options:
  • monitor link-flap (no profiles listed): The interface detects link flaps using the criteria defined by the default-profile set ( default-profiles).

  • monitor link-flap profiles (at least one profile listed): The interface detects link flaps using the criteria of the listed profiles. Error-disable criteria require conditions that match at least one profile.

  • default monitor link-flap: The interface detects link flaps using the errdisable flap-setting cause link-flap and errdisable recovery cause commands.

  • no monitor link-flap: The interface does not detect link flaps.

  • Default monitor link flap is the default setting.

Command Mode

Interface-Ethernet Configuration

Interface-Management Configuration

Command Syntax

monitor link-flap [LF_PROFILES]

no monitor link-flap

default monitor link-flap

Parameters

LF_PROFILES     Name of link-flap profiles assigned to interface. Parameter may contain zero, one, or multiple link-flap profile names:
  • no parameter     Link flap criteria determined by default-profile set.
  • profiles profile_name     Name of single link-flap profile.
  • profiles profile_name_1  profile_name_2 ... profile_name_N     List of link-flap profile names.

Examples
  • This command applies the LF03 and LF04 link flap profiles to interface ethernet 33.

    switch(config)# interface ethernet 33
    switch(config-if-Et33)# monitor link-flap profiles LF03 LF04
    switch(config-if-Et33)# show active
    interface Ethernet33
       monitor link-flap profiles LF04 LF03
    switch(config-if-Et33)#

  • This command disables link-flap monitoring on interface ethernet 34.
    switch(config)# interface ethernet 34
    switch(config-if-Et34)# no monitor link-flap
    switch(config-if-Et34)# show active
    interface Ethernet34
       no monitor link-flap
    switch(config-if-Et34)#

monitor server-failure link

The monitor server-failure link command enables Rapid Automated Indication of Link-loss (RAIL) on the configuration mode interface. RAIL must be properly configured globally or this command has no effect on switch operation.

When an interface monitored by RAIL goes down, the switch performs these steps for servers that the switch accesses from the interface:

  1. IP addresses of the servers are removed from ARP cache.

  2. A dynamic MAC entry is added to the MAC address table for each server. The port for each entry is listed as CPU.

The no monitor server-failure link and default monitor server-failure link commands disable RAIL on the configuration mode interface by deleting the corresponding monitor server-failure link command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Command Syntax

monitor server-failure link

no monitor server-failure link

default monitor server-failure link

Related Commands

monitor server-failure places the switch in server-failure configuration mode for configuring RAIL.

Example

These commands enable RAIL on interface port-channel 100.
switch(config)# interface port-channel 100
switch(config-if-Po100)# monitor server-failure link
switch(config-if-Po100)# show active
interface Port-Channel100
   monitor server-failure link
switch(config-if-Po100)#

monitor server-failure

The monitor server-failure command places the switch in server-failure configuration mode. Rapid Automated Indication of Link-loss (RAIL) settings are configured in server-failure configuration mode. RAIL is disabled by default and is enabled by the no shutdown command in server-failure configuration mode.

The no monitor server-failure and default monitor server-failure commands disable RAIL and restore all settings to their default state by removing all server-failure configuration mode statements from running-config.

Server-failure configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting server-failure configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

monitor server-failure

no monitor server-failure

default monitor server-failure

Examples
  • These commands place the switch in server-failure configuration mode and enables RAIL.
    switch(config)# monitor server-failure
    switch(config-server-failure)# show active
    switch(config-server-failure)# no shutdown
    switch(config-server-failure)# show active
    monitor server-failure
       no shutdown
    switch(config-server-failure)#

  • This command deletes all server-failure configuration mode commands from running-config.
    switch(config)# no monitor server-failure
    switch(config)#

monitor session destination cpu

The monitor session destination cpu command configures the CPU as the destination port of a specified port mirroring session. The monitor session source command configures the source port of the mirroring session. By default, mirror sessions duplicate ingress and egress traffic but are configurable to mirror traffic from one direction.

The CPU can only be configured as a destination for a mirroring session, not as a source. However, the CPU can serve as the destination for multiple mirroring sessions. Traffic mirrored to the CPU can be viewed using tcpdump.

The no monitor session destination cpu and default monitor session destination cpu commands remove the mirror session destination assignment by deleting the corresponding monitor session destination cpu command from running-config. Theno monitor sessioncommand removes the entire mirror session.

Command Mode

Global Configuration

Command Syntax

monitor session session_name destination cpu

no monitor session session_name destination cpu

default monitor session session_name destination cpu

Parameter

session_name     Label assigned to port mirroring session.

Guidelines

To view the traffic mirrored to the CPU from a source port, use tcpdump from the Bash shell, with the source interface as an argument. This causes tcpdump to capture packets from the kernel interface of the source port.

Examples
  • These commands configure interface ethernet 35 as the source and the CPU as the destination port for the redirect_1 mirroring session, then display the mirror interface.
    switch(config)# monitor session redirect_1 destination cpu
    switch(config)# monitor session redirect_1 source ethernet 35
    switch(config)# show monitor session
    
    Session redirect_1
    ------------------------
    Source Ports:
    
      Both:        Et35
    
    Destination Ports:
    
        Cpu :  active (mirror0)
    
    switch(config)#

  • This command uses tcpdump to view the traffic mirrored by the redirect_1 mirroring session. The CPU mirror interface specified in the previous output must be used in the tcpdump expression (in this case, mirror0).
    switch# bash tcpdump -i mirror0
    tcpdump: WARNING: mirror0: no IPv4 address assigned
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on mirror0, link-type EN10MB (Ethernet), capture size 65535 bytes
    09:51:12.478363 00:1c:73:27:a6:d3 (oui Arista Networks) > 01:80:c2:00:00:00 (oui 
    Unknown), 802.3, length 119: LLC, dsap STP (0x42) Individual, ssap STP (0x42) 
    Command, ctrl 0x03: STP 802.1s, Rapid STP, CIST Flags [Proposal, Learn, Forward, 
    Agreement], length 102
    09:51:14.478235 00:1c:73:27:a6:d3 (oui Arista Networks) > 01:80:c2:00:00:00 (oui 
    Unknown), 802.3, length 119: LLC, dsap STP (0x42) Individual, ssap STP (0x42) 
    Command, ctrl 0x03: STP 802.1s, Rapid STP, CIST Flags [Proposal, Learn, Forward, 
    Agreement], length 102
    switch#

monitor session destination

The monitor session destination command configures an interface as the destination port of a specified port mirroring session. The destination is usually an Ethernet interface, but other options are available on certain platforms (see Guidelines). The monitor session source command configures the source port of the mirroring session.

An interface cannot be used in more than one mirror session and cannot be simultaneously used as both source and destination. By default, mirror sessions duplicate ingress and egress traffic but are configurable to mirror traffic only from one direction.

Note: On platforms which support the use of port channels as mirror destinations, a port channel must not be used as a mirror destination if it is a member of an MLAG.

The no monitor session destination and default monitor session destination commands remove the mirroring session destination assignment by deleting the corresponding monitor session destination command from running-config. Theno monitor sessionremoves the entire mirroring session.

Command Mode

Global Configuration

Command Syntax

monitor session session_name destination{cpu | ethernet e_range | port-channel p_range | tunnel mode}

no monitor session session_name destination

default monitor session session_name destination

Parameters
  • session_name     label assigned to the port mirroring session.
  • cpu     configures a CPU as the destination interface.
  • ethernet e_range     configures Ethernet interfaces specified by e_range as the destination interface. The ethernet interface value ranges from 1 to 50.
  • port-channel p_range     configures port channel interfaces specified by p_range as the destination interface. The port-channel value ranges from 1 to 2000.
  • tunnel mode     configures a tunnel as the destination interface. Option includes:
    • gre     configures GRE-tunnel as the destination interface.

Guidelines

Tunnel mode is supported on select platforms only.

Port mirroring capacity varies by platforms. The session destination capacity of switches on each platform is listed below:
  • Arad Platform: Ethernet interfaces (one).
  • FM6000 Platform: Ethernet interfaces (any count), Port channel interfaces (any count), CPU.
  • Petra Platform: Ethernet interfaces (eight for Rx or Tx sessions; four for both ways).
  • Trident Platform: Ethernet interfaces (one).
  • Trident II Platform: Ethernet interfaces (one).

When there are multiple transmit (Tx) sources in a monitor session, mirrored frames use Tx properties of the lowest numbered Tx mirror source configured. Packets are modified based on properties.

Allowed VLANs on the ethernet8 source interface are 10, 20 and 30. Allowed VLANs on ethernet9 source interface are 30, 40, and 50. The frames going out of ethernet9 tagged with 10, 20, and 30 appears at the mirrored destination as tagged frames. The tagged frames with 40 or 50 on ethernet9 appears at the mirrored destination as untagged frames. Since ethernet8 is the lowest numbered source interface, all Tx frames on ethernet8 are tagged in the mirrored destination.

Examples
  • This command configures interface ethernet 8 as the destination port for the redirect_1 mirroring session.
    switch(config)# monitor session redirect_1 destination ethernet 2
    switch(config)# show monitor session
    
    Session redirect_1
    ------------------------
    Source Ports:
    
    Destination Ports:
    
        Et2 :  active
    
    switch(config)#

  • This command configures a GRE tunnel with source and destination addresses as 1.1.1.1 and 2.2.2.2 respectively as the destination interface for the redirect_2 mirroring.
    switch(config)# monitor session redirect_2 destination tunnel mode gre source 
    1.1.1.1 destination 2.2.2.2
    switch(config)# show monitor session
    
    Session redirect_2
    ------------------------
    Source Ports:
    
    Destination Ports:
    
             status  source    dest    TTL  DSCP  proto    VRF     fwd-drop
     Gre1 :  active  1.1.1.1   2.2.2.2 128  0     0x88be   default no
    
    switch(config)#

monitor session forwarding-drop

The monitor session forwarding-drop command configures a forwarding-drop session for mirroring ingress packets that are dropped during ASIC forwarding.

The no monitor session forwarding-drop and default monitor session forwarding-drop commands delete the current forwarding-drop configuration.

Command Mode

Global Configuration

Command Syntax

monitor session session_name forwarding-drop destination tunnel mode

no monitor session session_name forwarding-drop destination tunnel mode

default monitor session session_name forwarding-drop destination tunnel mode

Parameters
  • destination     specifies to mirror packets at destination.
  • tunnel mode     specifies to mirror packets that pass through a tunnel. Options include:
    • gre     configures GRE-tunnel as the destination interface.

Guidelines

The forwarding-drop configuration is supported on select platforms only.

Example

This command configures a forwarding-drop session to 1.1.1.1 as the destination.
switch(config)# monitor session 1 forwarding-drop destination tunnel mode gre source 1.1.1.1 destination 
2.2.2.2
switch(config)# show monitor session

Session 1
------------------------
Programmed in HW: No
Source Ports:
Destination Ports:
            status   source    dest      TTL   DSCP  proto    VRF       fwd-drop
    Gre1 :  active   1.1.1.1   2.2.2.2   128    0    0x88be   default   yes

switch(config)#

monitor session ip access-group

The monitor session ip access-group command configures an ACL to filter the traffic being mirrored to the destination port.ACLs applied to a source port affect the RX side of the interface, and do not impact the TX side of the interface. TX mirrored packets cannot be filtered, and will continue to be sent to the mirror destination.

The no monitor session ip access-group and default monitor session ip access-group commands remove the filter from the specified mirror session by deleting the corresponding monitor session ip access-group command from running-config. Theno monitor session command removes the entire mirror session.

Command Mode

Global Configuration

Command Syntax

monitor session session_name ip access-group acl_name

no monitor session session_name ip access-group

default monitor session session_name ip access-group

Parameters
  • session_name     Label assigned to port mirroring session.
  • acl_name     The ACL to be applied to filter traffic for the specified session.

Examples
  • These commands create an ACL and apply it to filter the traffic mirrored to the destination port by session redirect_1.
    switch(config)# ip access-list allow-host
    switch(config-acl-allow-host)# 10 permit ip host 192.168.11.24 host 10.0.215.23
    switch(config-acl-allow-host)# 20 deny ip any any
    switch(config-acl-allow-host)# exit
    switch(config)#
    switch(config)# monitor session redirect_1 ip access-group allow-host
    switch(config)#

  • Use the show monitor session command to verify the configuration.
    switch# show monitor session
    Session redirect_1
    ------------------------
    Source Ports:
    Both:        Et35(Acl:allow-host)
    Destination Ports:
    Cpu :  active (mirror0)
    ip access-group: allow-host
    switch#

monitor session source

The monitor session source command configures the source port of a specified port mirroring session. The monitor session destination or monitor session destination cpu command configures the destination port of the mirroring session.

An interface cannot be used in more than one mirror session and cannot be simultaneously a source and a destination. An interface which is part of a port channel cannot be used as a source, but a port channel which is a member of an MLAG can be used. By default, mirror sessions duplicate ingress and egress traffic but are configurable to mirror traffic from only one direction.

The no monitor session source and default monitor session source commands remove the mirroring session source assignment by deleting the corresponding monitor session source command from running-config. The no monitor session removes entire the mirroring session.

Command Mode

Global Configuration

Command Syntax

monitor session session_name source INT_NAME DIRECTION

no monitor session session_name source INT_NAME DIRECTION

default monitor session session_name source INT_NAME DIRECTION

Parameters
  • session_name     Label assigned to port mirroring session.
  • INT_NAME     Source interface for the mirroring session.
    • ethernet e_range     Ethernet interfaces specified by e_range.
    • port-channel p_range     Port channel interfaces specified by p_range.

  • DIRECTION     transmission direction of traffic to be mirrored.
    • no parameter    mirrors transmitted and received traffic.
    • both     mirrors transmitted and received traffic.
    • rx     mirrors received traffic only.
    • tx     mirrors transmitted traffic only.

Guidelines

On DCS-7050, DCS-7050X, DCS-7250X, and DCS-7300X series, due to limitations of the switch ASIC, all frames mirrored on egress are prefixed with an 802.1Q VLAN tag, even when the egress port is configured as an access port. If the capture device is unable to process VLAN tags in a desirable manner mirroring should be configured exclusively for ingress traffic by specifying rx.

Restrictions

Port mirroring capacity varies by platform. Session source capacity for each platform is listed below:
  • FM6000 Platform: Ethernet interfaces (any number), port channel interfaces (any number).
  • Arad Platform: Ethernet interfaces (any number), port channel interfaces (any number).
  • Petra Platform: Ethernet interfaces (eight for Rx or Tx sessions; four for both ways).
  • Trident Platform: Ethernet interfaces (any number), port channel interfaces (any number).
  • Trident II Platform: Ethernet interfaces (any number), port channel interfaces (any number).

    The number of interfaces that can be effectively mirrored is restricted by the destination port speed.

Example

This command configures interface ethernet 7 as the source port for redirect_1 mirroring session.
switch(config)# monitor session redirect_1 source ethernet 7
switch(config)#

monitor session source ip access-group

The monitor session source ip access-group command configures an ACL to filter the traffic being mirrored from a specific source port. This enables the ability to filter traffic using a different ACL on each source port and have the combined matched traffic sent to the destination port.

The no monitor session source ip access-group and default monitor session source ip access-group commands remove the filter from the specified mirror session by deleting the corresponding monitor session source ip access-group command from running-config. Theno monitor sessioncommand removes the entire mirror session.

Command Mode

Global Configuration

Command Syntax

monitor session s_name source INT_NAME [DIRECT] ip access-group acl_name

no monitor session s_name source INT_NAME [DIRECT] ip access-group acl_name

default monitor session s_name source INT_NAME [DIRECT] ip access-group acl_name

Parameters
  • s_name     Label assigned to port mirroring session.
  • INT_NAME     Source interface for the mirroring session.
    • ethernet e_range     Ethernet interfaces specified by e_range.
    • port-channel p_range     Port channel interfaces specified by p_range.

  • DIRECT     transmission direction of traffic to be mirrored. Options include:
    • no parameter     mirrors received traffic only.
    • rx     mirrors received traffic only.

  • acl_name     The ACL to be applied to filter traffic for the specified session.

Example

These commands create ACLs and apply them to filter the traffic mirrored from two source ports by session redir_1.
switch(config)# ip access-list allow-host-x
switch(config-acl-allow-host-x)# 10 permit ip host 192.168.11.24 host 10.0.215.23
switch(config-acl-allow-host-x)# 20 deny ip any any
switch(config-acl-allow-host-x)# exit
switch(config)# ip access-list allow-host-y
switch(config-acl-allow-host-y)# 10 permit ip host 172.16.233.80 host 10.0.215.23
switch(config-acl-allow-host-y)# 20 deny ip any any
switch(config-acl-allow-host-y)# exit
switch(config)# monitor session redir_1 source ethernet 5,9 rx
switch(config)# monitor session redir_1 source ethernet 5 ip access-group allow-host-x
switch(config)# monitor session redir_1 source ethernet 9 ip access-group allow-host-y
switch(config)#

monitor session truncate

The monitor session truncate command configures a port mirroring session to truncate mirrored packets, retaining only the first 160 bytes. Packet truncation can be used to prevent oversubscription of the session’s destination port.

Packet truncation applies to the mirroring session as a whole, and cannot be applied to individual source ports.

The no monitor session truncate and default monitor session truncate commands restores mirroring of full packets by deleting the corresponding monitor session truncate command from running-config. The no monitor sessionremoves the entire mirroring session.

Command Mode

Global Configuration

Command Syntax

monitor session session_name truncate

no monitor session session_name truncate

default monitor session session_name truncate

Parameters

session_name     Label assigned to port mirroring session.

Example

This command configures mirroring session redirect_1 to truncate mirrored packets.
switch(config)# monitor session redirect_1 truncate
switch(config)#

mtu

The mtu command configures the IPv4 and IPv6 Maximum Transmission Unit (MTU) size for the configuration mode interface. The switch fragments IP packets that are larger than the MTU value for the outbound interface. An interface's MTU value is displayed with the show interfaces command.

MTU is independently configurable on all routable interfaces.

The no mtu and default mtu commands restore the interface’s MTU to the default value by removing the corresponding mtu command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Loopback Configuration

Interface-Management Configuration

Interface-Port-channel Configuration

Interface-VLAN Configuration

Command Syntax

mtu bytes

no mtu

default mtu

Parameter

bytes      MTU size (bytes). Values range from 68 to 9214. The default MTU size is 1500 bytes.

Example

This command sets the MTU size of 1492 bytes on interface vlan 20.
switch(config)# interface vlan 20
switch(config-if-Vl20)# mtu 1492
switch(config-if-Vl20)#

network (server-failure configuration mode)

The network command specifies the IPv4 network space that Rapid Automated Indication of Link-loss (RAIL) monitors for failed links to connected servers. RAIL reduces the wait time for applications on directly connected servers that are blocked due to a failed link. Running-config supports simultaneous network command, allowing RAIL to monitor multiple disjoint network spaces.

When a server on the specified network is blocked because of a failed Ethernet or port channel link, the switch becomes a proxy for the unavailable server and responds with TCP RST or ICMP Unreachable segments to devices sending packets to the unavailable server.

The no network and default network commands terminate the RAIL monitoring of the specified IPv4 address space by deleting the corresponding network command from running-config.

Command Mode

Server-failure Configuration

Command Syntax

network netv4_address

no network netv4_address

default network netv4_address

Parameter

netv4_addr     IPv4 subnet address to be monitored (CIDR or address-mask notation).

Related Command

monitor server-failure places the switch in server-failure configuration mode.

Example

This command specifies two IPv4 network spaces that RAIL monitors for server failures.
switch(config)# monitor server
switch(config-server-failure)# network 10.1.1.0/24
switch(config-server-failure)# network 10.2.1.96/28
switch(config-server-failure)# show active
monitor server-failure
   network 10.2.1.96/28
   network 10.1.1.0/24
switch(config-server-failure)#

no monitor session

The no monitor session and default monitor session commands remove the specified monitor session from the switch by deleting all corresponding monitor commands from running-config. Commands that remove or alter individual commands within a session configuration are described in the monitor session destination and monitor session source commands.

Command Mode

Global Configuration

Command Syntax

no monitor session session_name

default monitor session session_name

Parameter

session_name     Label assigned to port mirroring session.

Example

This command displays the configuration of the redirect_1 mirroring session, deletes the session, then confirms that the session was removed.
switch(config)# show monitor session redirect_1
Session redirect_1
------------------------
Source Ports
  Both:        Et7
Destination Port: Et8
switch(config)# no monitor session redirect_1
switch(config)# show monitor session redirect_1
Session not created

switch(config)#

phy diag

Use the phy diag command to configure a test pattern in the interface configuration mode. The no and default forms of the command disables the test pattern.

Command Mode

Interface configuration mode

Command Syntax

phy diag [transmitter | receiver] test pattern TestPattern

no phy diag [transmitter | receiver] test pattern TestPattern

default phy diag [transmitter | receiver] test pattern TestPattern

Parameters
  • transmitterConfigures the physical transmitter.
  • receiverConfigures the physical receiver.
  • test pattern TestPatternConfigures the named test pattern.

Examples
  • Enable a test pattern on an interface using the phy diag command. You can select the transmitter or the receiver. To display the available interfaces, select test pattern ?.
    switch(config-if)# phy diag [ transmitter | receiver ] test pattern ?
      PRBS11  Configure the PRBS11 test pattern
      PRBS15  Configure the PRBS15 test pattern
      PRBS23  Configure the PRBS23 test pattern
      PRBS31  Configure the PRBS31 test pattern
      PRBS49  Configure the PRBS49 test pattern
      PRBS58  Configure the PRBS58 test pattern
      PRBS7   Configure the PRBS7 test pattern
      PRBS9   Configure the PRBS9 test pattern

  • To disable a test pattern on an interface, enter the following command. You can select the tranmitter or the receiver, as well as the selected named test pattern.
    switch(config-if)# no phy diag [ transmitter | receiver ] test pattern TestPattern

  • By default, a test pattern is disabled.
    switch(config-if)# default phy diag [ transmitter | receiver ] test pattern

  • The following command clears the recorded test pattern status data for all the interfaces. Upon running the command, all the counter values are set to 0 and link states are marked as not locked.
    switch# clear phy diag test pattern

platform sand monitor serdes error log

The platform sand monitor serdes error log command is used for enabling the serdes error log for fabric link monitoring.

Command Mode

Global Configuration

Command Syntax

platform sand monitor serdes error log

Example

This command enables the serdes error log for fabric link monitoring.
switch(config)# platform sand monitor serdes error log
switch(config)#

platform sand monitor serdes error threshold

The platform sand monitor serdes error threshold command is used for generating a fabric link monitoring serdes error threshold.

Command Mode

Global Configuration

Command Syntax

platform sand monitor serdes error threshold

Example

This command monitors serdes error thresholds over the specified number of received cells, resulting in the isolation of a fabric link between 200 and 30000 received cells.
switch(config)# platform sand monitor serdes error threshold 200 30000
switch(config)#

platform sand monitor serdes poll period

The platform sand monitor serdes poll period command is used to enable the serdes poll period.

Command Mode

Global Configuration

Command Syntax

platform sand monitor serdes poll period

Example

This command changes the serdes polling period for fabric link monitoring to 6 seconds.
switch(config)# platform sand monitor serdes poll period 6
switch(config)#

platform sand monitor serdes poll threshold isolation

The platform sand monitor serdes poll threshold isolation command is used to set and enables fabric link monitoring for serdes poll threshold isolation.

Command Mode

Global Configuration

Command Syntax

platform sand monitor serdes poll threshold isolation

Example

This command changes the number of consecutive polls in which the threshold needs to be detected to isolate a link. In this case the number is 5 consecutive polls.
switch(config)# platform sand monitor serdes poll threshold isolation 5
switch(config)#

platform sand monitor serdes poll threshold recovery

The platform sand monitor serdes poll threshold recovery command is used to set and enable fabric link monitoring for serdes poll threshold recovery.

Command Mode

Global Configuration

Command Syntax

platform sand monitor serdes poll threshold recovery

Example

This command changes the number of consecutive serdes polls used for threshold recovery to 6 seconds.
switch(config)# platform sand monitor serdes poll threshold recovery 6
switch(config)#

profile max-flaps (Link Flap Configuration)

The profile max-flaps command creates a link flap profile that, when assigned to an Ethernet interface, specifies the conditions that result in an error-disable action. Link flap profile parameters include:
  • flaps     Threshold number of interface state changes.

  • period     Interval when link flaps accumulate to trigger an error condition.

  • violations     Number of link flap errors (threshold exceeded over specified period).

  • intervals     Quantity of periods.

By default, violations and intervals are each set to one, resulting in a profile that triggers a link-flap error when the specified frequency is exceeded once. By configuring violations and intervals, link-flap errors are defined when the frequency is exceeded multiple times over a specified set of intervals.

Default is a reserved profile name that modifies the errdisable flap-setting cause link-flap statement in running-config. When configuring the default profile, violations and intervals are disregarded.

The no profile max-flaps command removes the specified profile by deleting the corresponding profile max-flaps command from running-config. The no profile max-flaps default command restores default errdisable flap-setting cause link-flap values by removing that command from running-config.

Command Mode

Link-flap Configuration

Command Syntax

profile PROFILE_NAME max-flaps flap_max time period [EXTENSIONS]

no profile LF_PROFILE

Parameters
  • PROFILE_NAME     Name of link flap profile. Options include:
  • flap_max      Threshold number of interface state changes. Value ranges from 1 to 100.

  • period      Interval when flaps accumulate toward threshold (seconds). Value ranges from 1 to 1800.

  • EXTENSIONS     Configures multi-flap triggers. Options include:
    • no parameter     Sets errors and episodes to default values (one).
    • violations errors intervals episodes     Link flap errors (errors) and number of periods (episodes).
      • Errors range is 1 to 1000. Default value is 1.
      • Episodes range is 1 to 1000. Default value is 1.

Related Command

monitor link-flap policy places the switch in link-flap configuration mode.

Example

These commands create two link flap profiles with various trigger settings.
switch(config)# monitor link-flap policy
switch(config-link-flap)# profile LF01 max-flaps 15 time 60
switch(config-link-flap)# profile LF02 max-flaps 10 time 30 violations 5 intervals 10
switch(config-link-flap)# show active
monitor link-flap policy
   profile LF01 max-flaps 15 time 60 violations 1 intervals 1
   profile LF02 max-flaps 10 time 30 violations 5 intervals 10
switch(config-link-flap)#

proxy (server-failure configuration mode)

The proxy command enables the Rapid Automated Indication of Link-loss (RAIL) proxy setting and specifies the interval that RAIL responds to messages sent to servers on failed links, starting from when the switch detects the failed link. The RAIL state machine is in the proxying state during the timeout interval this command specifies. When RAIL proxy is not enabled, the switch maintains a list of unavailable servers without responding to messages sent the servers. The switch can enter RAIL proxy state only when this command is enabled.

The RAIL proxy setting is disabled by default. When RAIL proxy is enabled, the default period is three minutes.

The no proxy and default proxy commands return the RAIL proxy setting to disabled by removing the proxy statement from running-config.

The no proxy lifetime and default proxy lifetime command sets the proxy time setting to its default value of three minutes if the RAIL proxy setting is enabled. These commands have no effect if the RAIL proxy setting is disabled.

Command Mode

Server-failure Configuration

Command Syntax

proxy [lifetime time_span]

no proxy [lifetime]

default proxy [lifetime]

Parameter

timespan     proxy timeout period (minutes). Value ranges from 1 to 10080. Default value is 3.

Related Command

monitor server-failure places the switch in server-failure configuration mode.

Examples
  • These commands enable the RAIL proxy and sets the proxy timeout period of 10 minutes.
    switch(config)# monitor server
    switch(config-server-failure)# proxy lifetime 10
    switch(config-server-failure)# show active
    monitor server-failure
       proxy lifetime 10
    switch(config-server-failure)#

  • This command sets the proxy timeout period to its default value of 3 minutes.
    switch(config-server-failure)# no proxy lifetime
    switch(config-server-failure)# show active
    monitor server-failure
       proxy
    switch(config-server-failure)#

  • This command disables the RAIL proxy.
    switch(config-server-failure)# no proxy
    switch(config-server-failure)# show active
    monitor server-failure
    switch(config-server-failure)#

show bridge mac-address-table aging timeout

The show bridge mac-address-table aging timeout command displays the aging time for MAC address table dynamic entries. Aging time defines the period an entry is in the table, as measured from the most recent reception of a frame on the entry’s VLAN from the specified MAC address. The switch removes entries that exceed the aging time.

Aging time ranges from 10 seconds to 1000000 seconds with a default of 300 seconds (five minutes).

Command Mode

EXEC

Command Syntax

show bridge mac-address-table aging timeout

Example

This command shows the MAC address table aging time.
switch> show bridge mac-address-table aging timeout
Global Aging Time:  120
switch>

show errdisable recovery

The show errdisable recovery command displays information about the recovery intervals and error disable causes.

Command Mode

EXEC

Command Syntax

show errdisable recovery

Parameter

no parameter state of the system.

Example

The following output is for a system where the causes are listed and interval timer for each cause is identified along with the timer status.
switch# show errdisable recovery
Errdisable Reason              Timer Status   Timer Interval
------------------------------ ----------------- --------------
   bpduguard                      Disabled                   30
   hitless-reload-down            Disabled                  300
   lacp-no-portid                 Disabled                  N/A
   lacp-rate-limit                Disabled                  300
   license-enforce                Disabled                  N/A
   link-flap                      Disabled                  300
   no-internal-vlan               Disabled                  300
   uplink-failure-detection       Disabled                  300

show fabric monitoring health

The platform sand monitor health command is used to display the fabric monitoring connected state status with isolated links.

Command Mode

Global Configuration

Command Syntax

platform sand monitor health

Example

This command displays the connected state status with isolated links.
switch(config)# show platform sand health
Fabric serdes isolated by fabric monitoring: (36 total)

Arad5/0 serdes [0-1, 10-19, 2, 20-29, 3, 30-35, 4-9]

Top fabric serdes list by number of times isolated by monitoring:
Arad5/0 serdes 0: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 1: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 10: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 11: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 12: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 13: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 14: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 15: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 16: 1 (last occurred: 0:01:04 ago)
Arad5/0 serdes 17: 1 (last occurred: 0:01:04 ago)

switch(config)#

show interfaces

The show interfaces command displays operational status and configuration information of specified interfaces. The output includes speed, duplex, flow control information and basic interface statistics.

The input and output bit rates, as displayed, do not include framing bits that are part of the Ethernet standard, the inter-frame gap and preamble that total 20 bytes per packet. The percentage number includes those framing bits to provide a better link utilization estimate.

Command Mode

EXEC

Command Syntax

show interfaces [INT_NAME]

Parameters

INT_NAME     Interface type and numbers. Options include:
  • no parameter     all interfaces.
  • ethernet e_range     Ethernet interface range specified by e_range.
  • loopback l_range     Loopback interface specified by l_range.
  • management m_range     Management interface range specified by m_range.
  • port-channel p_range     Port-Channel Interface range specified by p_range.
  • vlan v_range     VLAN interface range specified by v_range.
  • VXLAN vx_range     VXLAN interface range specified by vx_range.

    Valid range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command display configuration and status information for Ethernet interface 1 and 2.
switch> show interfaces ethernet 1-2
Ethernet1 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 001c.2481.7647 (bia 001c.2481.7647)
  Description: mkt.1
  MTU 9212 bytes, BW 10000000 Kbit
  Full-duplex, 10Gb/s, auto negotiation: off
  Last clearing of "show interface" counters never
  5 seconds input rate 33.5 Mbps (0.3% with framing), 846 packets/sec
  5 seconds output rate 180 kbps (0.0% with framing), 55 packets/sec
     76437268 packets input, 94280286608 bytes
     Received 2208 broadcasts, 73358 multicast
     0 runts, 0 giants
     0 input errors, 0 CRC, 0 alignment, 0 symbol
     0 PAUSE input
     6184281 packets output, 4071319140 bytes
     Sent 2209 broadcasts, 345754 multicast
     0 output errors, 0 collisions
     0 late collision, 0 deferred
     0 PAUSE output
Ethernet2 is up, line protocol is up (connected)
  Hardware is Ethernet, address is 001c.2481.7648 (bia 001c.2481.7648)
  Description: mkt.2
  MTU 9212 bytes, BW 10000000 Kbit
  Full-duplex, 10Gb/s, auto negotiation: off
  Last clearing of "show interface" counters never
  5 seconds input rate 711 kbps (0.0% with framing), 271 packets/sec
  5 seconds output rate 239 kbps (0.0% with framing), 65 packets/sec
     73746370 packets input, 78455101010 bytes
     Received 11 broadcasts, 83914 multicast
     0 runts, 0 giants
     0 input errors, 0 CRC, 0 alignment, 0 symbol
     0 PAUSE input
     5687714 packets output, 4325064454 bytes
     Sent 15 broadcasts, 107279 multicast
     0 output errors, 0 collisions
     0 late collision, 0 deferred
     0 PAUSE output
switch>

show interfaces description

The show interfaces description command displays the status and description text of the specified interfaces. The description command configures an interface’s description parameter.

Command Mode

EXEC

Command Syntax

show interfaces [INT_NAME] description

Parameters

INT_NAME     Interface type and labels. Options include:
  • no parameter     all interfaces.
  • ethernet e_range     Ethernet interface range specified by e_range.
  • loopback l_range     Loopback interface specified by l_range.
  • management m_range Management interface range specified by m_range.
  • port-channel p_range     Port-Channel Interface range specified by p_range.
  • vlan v_range     VLAN interface range specified by vx_range.
  • VXLAN vx_range     VXLAN interface range specified by vx_range.

    Range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays description text and status of interfaces ethernet 1-10.
switch> show interfaces ethernet 1-10 description
Interface                      Status         Protocol Description
Et1                            up             up       ctar_01
Et2                            up             up       ctar_02
Et3                            up             up       ctar_03
Et4                            up             up       fobd_01
Et5                            up             up       fobd_02
Et6                            up             up       yzrq_01
Et7                            up             up       yzrq_02
Et8                            down           down     yzrq_03
Et9                            up             up       yzrq_04
Et10                           up             up       yzrq_05
switch>

show interfaces phy diag

Command Mode

EXEC

Command Syntax

show interfaces [interface type interface range] phy diag [error-correction | test pattern]

Parameters
  • interface type interface rangeType of interface and range.
  • error-correctionForwards error correction.
  • test patternDisplays test patterns.

Guidelines

The user-configured test pattern is displayed under the Configured column, which is divided based on transmitter and receiver configuration. The currently operational test pattern is displayed under the Operational column. The Available column lists the test patterns available for the interface.

Example
  • In this example, interfaces ethernet 26/1 and 31/1 in the show interfaces ethernet 26/1,31/1 phy diag test pattern command are selected to display the configured and operational test pattern, and the available test patterns.

    switch# show interfaces ethernet 26/1,31/1 phy diag test pattern
                     Configured       Operational
    Interface     Transmit Receive Transmit Receive Available                   
    ------------- -------- ------- -------- ------- -----------------------
    Ethernet26/1  PRBS15   PRBS15  PRBS15   PRBS15  PRBS 7,9,11,15,23,31,58     
    Ethernet31/1  PRBS7    PRBS31  PRBS7    PRBS31  PRBS 7,9,11,15,23,31,58

    The user-configured test pattern is displayed under the Configured column, which is divided based on transmitter and receiver configuration. The currently operational test pattern is displayed under the Operational column. The Available column lists the test patterns available for the interface.

  • In this example, the show interfaces ethernet 26/1 phys detail | i Test pattern command displays the operational test pattern for an interface. Here the Test pattern field will not be available, on disabling the test pattern.
    switch# show interfaces ethernet 26/1 phy detail | i Test pattern
      Test pattern                enabled
    switch# show interfaces ethernet 31/1 phy detail | i Test pattern
      Test pattern                enabled

  • In this example, the show interfaces ethernet 26/1,31/1 phy diag test pattern counters command displays test pattern link state and error information.
    The following information is listed in the display output:
    • Link state: whether or not the checker locked on to the configured test pattern.
    • Bit Errors: the accumulated number of bit errors.
    • Largest Burst: the largest burst of errors that occurred.
    • Burst Count: the number of occurrences of errors.
    • Last Error Time: the last time an error has occurred, ‘never’ if no errors have occurred.
    switch# show interfaces ethernet 26/1,31/1 phy diag test pattern counters
    Current System Time: Wed May 30 22:24:32 2018
                                                    Largest    Burst 
    Interface        Lane  Link State  Bit Errors   Burst      Count  Last Error Time  
    ---------------- ----- ----------- ------------ ---------- ------ ----------------
    Ethernet26/1     0     locked      409266       409266     1       0:21:27 ago      
    Ethernet26/1     1     locked      347084       347084     1       0:21:27 ago      
    Ethernet26/1     2     locked      420681       420681     1       0:21:27 ago      
    Ethernet26/1     3     locked      392969       392969     1       0:21:27 ago      
    Ethernet31/1     0     not locked  1417655      651822     3       0:03:20 ago      
    Ethernet31/1     1     not locked  1782238      736819     3       0:03:20 ago      
    Ethernet31/1     2     not locked  1760538      866185     3       0:03:20 ago      
    Ethernet31/1     3     not locked  1817413      923941     3       0:03:20 ago 

  • In this example, the show interfaces ethernet 26/1,31/1 phy diag test pattern counters command displays the lock state of an interface along with a detailed information on the recorded bit errors.
    The following information is listed in the display output:
    • Last clear: the time when the test pattern results were last cleared.
    • Operational test pattern: the test pattern operational at the receiver side.
    • Bit rate: the transmission bit rate.
    • Lock state: the current lock status, number of times it changed and the last time the lock status got changed.
      • locked: receiver is able to lock on to the incoming test pattern.
      • not locked: receiver is not able to lock on to the incoming test pattern.

    • Largest burst: the largest burst of errors that occurred.
    • Bit errors*: the accumulated number of errors, number of occurrences of errors, and last time errors were captured. The * suffix, indicating that data may not be accurate due to loss of lock, is applied if the current lock status is not locked or if the lock status has changed more than once. This suffix is cleared when the test pattern status data is cleared via the CLI listed above.
    • Total Bits: the total bits received.
    • Bit error rate (BER)*: the ratio of captured bit errors to the total bit received. The * suffix, indicating that data may not be accurate due to loss of lock, is applied if the current lock status is not locked or if the lock status has changed more than once. This suffix is cleared when the test pattern status data is cleared via the CLI listed above.
    • Bit errors since last lock: the accumulated number of errors since last time lock was gained.
    • Total bits since last lock: the total bits received since last lock.
    • BER since last lock: the ratio of captured bit errors to the total bit received since last lock.
    switch# show interfaces ethernet 26/1,31/1 phy diag test pattern counters detail
    *: Data may not be accurate due to loss of lock.
    
    Current System Time:  Wed May 30 23:36:34 2018
    Ethernet26/1
      Last clear                     1:33:29 ago
      Operational test pattern       PRBS15
                                     Current State     Changes      Last Change
                                     -------------     -------      -----------
      Lane 0
         Bit rate                    25.781 Gbps
         Lock state                  locked                  1       1:33:28 ago
         Largest burst               409266
         Bit errors                  409266                  1       1:33:28 ago
         Total bits                  144,607.648 Gb
         Bit error rate              2.83E-09
         Bit errors since last lock  409266
         Total bits since last lock  161,542.986 Gb
         BER since last lock         2.53E-09
      Lane 1
         Bit rate                    25.781 Gbps
         Lock state                  locked                  1       1:33:28 ago
         Largest burst               347084
         Bit errors                  347084                  1       1:33:28 ago
         Total bits                  144,607.668 Gb
         Bit error rate              2.40E-09
         Bit errors since last lock  347084
         Total bits since last lock  161,543.006 Gb
         BER since last lock         2.15E-09
      Lane 2
         Bit rate                    25.781 Gbps
         Lock state                  locked                  1       1:33:28 ago
         Largest burst               420681
         Bit errors                  420681                  1       1:33:28 ago
         Total bits                  144,607.658 Gb
         Bit error rate              2.91E-09
         Bit errors since last lock  420681
         Total bits since last lock  161,542.996 Gb
         BER since last lock         2.60E-09
      Lane 3
         Bit rate                    25.781 Gbps
         Lock state                  locked                  1       1:33:28 ago
         Largest burst               392969
         Bit errors                  392969                  1       1:33:28 ago
         Total bits                  144,607.678 Gb
         Bit error rate              2.72E-09
         Bit errors since last lock  392969
         Total bits since last lock  161,543.016 Gb
         BER since last lock         2.43E-09
    
    Ethernet31/1
      Last clear                     1:33:29 ago
      Operational test pattern       PRBS31
                                     Current State     Changes      Last Change
                                     -------------     -------      -----------
      Lane 0
         Bit rate                    25.781 Gbps
         Lock state                  not locked              3       1:15:22 ago
         Largest burst               651822
         Bit errors                  1417655*                3       1:15:22 ago
         Total bits                  144,626.220 Gb
     Bit error rate              > 9.80E-09*
         Bit errors since last lock  765833*
         Total bits since last lock  144,471.763 Gb
         BER since last lock         > 5.30E-09*
      Lane 1
         Bit rate                    25.781 Gbps
         Lock state                  not locked              3       1:15:22 ago
         Largest burst               736819
         Bit errors                  1782238*                3       1:15:22 ago
         Total bits                  144,626.240 Gb
         Bit error rate              > 1.23E-08*
         Bit errors since last lock  1147126*
         Total bits since last lock  144,471.783 Gb
         BER since last lock         > 7.94E-09*
      Lane 2
         Bit rate                    25.781 Gbps
         Lock state                  not locked              3       1:15:22 ago
         Largest burst               866185
         Bit errors                  1760538*                3       1:15:22 ago
         Total bits                  144,626.230 Gb
         Bit error rate              > 1.22E-08*
         Bit errors since last lock  894353*
         Total bits since last lock  144,471.773 Gb
         BER since last lock         > 6.19E-09*
      Lane 3
         Bit rate                    25.781 Gbps
         Lock state                  not locked              3       1:15:22 ago
         Largest burst               923941
         Bit errors                  1817413*                3       1:15:22 ago
         Total bits                  144,626.250 Gb
         Bit error rate              > 1.26E-08*
         Bit errors since last lock  893472*
         Total bits since last lock  144,471.793 Gb
         BER since last lock         > 6.18E-09*

show link tracking group

The show link tracking group command displays information about a specified link-state group or about all groups.

Command Mode

EXEC

Command Syntax

show link tracking group [DATA_LEVEL][GROUPS]

Parameters
  • DATA_LEVEL    device for which the command provides data. Options include:
    • no parameter     information about all groups in group list.
    • detail     detailed information about all groups in group list.

  • GROUPS
    • no parameter    all link-state groups.
    • group_name     link-state group name.

Example

This command displays all the link-state group information.
switch# show link tracking group detail
Link State Group: 1 Status: up
Upstream Interfaces : Vlan100
Downstream Interfaces : Vlan200
Number of times disabled : 2
Last disabled 0:10:29 ago

Link State Group: group3 Status: down
Upstream Interfaces : Ethernet24
Downstream Interfaces : Ethernet8
Number of times disabled : 2
Last disabled 0:30:35 ago

Link State Group: 2 Status: up
Upstream Interfaces : Ethernet2 Ethernet5
Downstream Interfaces : Ethernet12
Number of times disabled : 0
Last disabled never
switch#

show mac address-table

The show mac-address-table command displays the specified MAC address table entries.

Command Mode

EXEC

Command Syntax

show mac address-table [ENTRY_TYPE][MAC_ADDR][INTF_1 ... INTF_N][VLANS]

Parameters
  • ENTRY_TYPE     command filters display by entry type. Entry types include mlag-peer, dynamic, static, unicast, multicast entries, and configured.
    • no parameter     all table entries.
    • configured  static entries; includes unconfigured VLAN entries.
    • dynamic     entries learned by the switch.
    • static     entries entered by CLI commands and include a configured VLAN.
    • unicast     entries with unicast MAC address.

  • MAC_ADDR     command uses MAC address to filter displayed entries.
    • no parameter     all MAC addresses table entries.
    • address mac_address     displays entries with specified address (dotted hex notation – H.H.H).

  • INTF_X     command filters display by port list. When parameter lists multiple interfaces, command displays all entries containing at least one listed interface.
    • no parameter     all Ethernet and port channel interfaces.
    • ethernet e_range     Ethernet interfaces specified by e_range.
    • port-channel p_range     Port channel interfaces specified by p_range.

  • VLANS     command filters display by VLAN.
    • no parameter     all VLANs.
    • vlan v_num     VLANs specified by v_num.

Examples
  • This command displays the MAC address table.
    switch> show mac address-table
              Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports      Moves   Last Move
    ----    -----------       ----        -----      -----   ---------
     101    001c.8224.36d7    DYNAMIC     Po2        1       9 days, 15:57:28 ago
     102    001c.8220.1319    STATIC      Po1
     102    001c.8229.a0f3    DYNAMIC     Po1        1       0:05:05 ago
     661    001c.8220.1319    STATIC      Po1
     661    001c.822f.6b22    DYNAMIC     Po7        1       0:20:10 ago
    3000    001c.8220.1319    STATIC      Po1
    3000    0050.56a8.0016    DYNAMIC     Po1        1       0:07:38 ago
    3902    001c.8220.1319    STATIC      Po1
    3902    001c.822b.a80e    DYNAMIC     Po4        2       9 days, 15:57:30 ago
    3903    001c.8220.1319    STATIC      Po1
    3903    001c.822c.3009    DYNAMIC     Po5        1       4 days, 15:13:03 ago
    3908    001c.8220.1319    STATIC      Po1
    3908    001c.822c.4e1d    DYNAMIC     Po1        1       0:07:26 ago
    3908    001c.822c.55d9    DYNAMIC     Po1        1       0:04:33 ago
    3909    001c.8220.1319    STATIC      Po1
    3909    001c.822f.6a80    DYNAMIC     Po1        1       0:07:08 ago
    3910    001c.730f.6a80    DYNAMIC     Et9        1       4 days, 15:13:07 ago
    3911    001c.8220.1319    STATIC      Po1
    3911    001c.8220.40fa    DYNAMIC     Po8        1       1:19:58 ago
    3912    001c.822b.033e    DYNAMIC     Et11       1       9 days, 15:57:23 ago
    3913    001c.8220.1319    STATIC      Po1
    3913    001c.822b.033e    DYNAMIC     Po1        1       0:04:35 ago
    3984    001c.8220.178f    DYNAMIC     Et8        1       4 days, 15:07:29 ago
    3992    001c.8220.1319    STATIC      Po1
    3992    001c.8221.07b9    DYNAMIC     Po6        1       4 days, 15:13:15 ago
    Total Mac Addresses for this criterion: 25
    
              Multicast Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
    Total Mac Addresses for this criterion: 0
    switch>

  • This command displays the MAC address learning status on vlan 10.
    switch(config)# vlan 10
    switch(config-vlan-10)# no mac address learning
    switch(config-vlan-10)# show mac address-table 
              Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports      Moves   Last Move
    ----    -----------       ----        -----      -----   ---------
    Total Mac Addresses for this criterion: 0
    
              Multicast Mac Address Table
    ------------------------------------------------------------------
    
    Vlan    Mac Address       Type        Ports
    ----    -----------       ----        -----
    Total Mac Addresses for this criterion: 0
    
    VLANs with disabled MAC learning: 10

show mac address-table count

The show mac-address-table count command displays the number of entries in the MAC address table for the specified VLAN or for all VLANs.

Command Mode

EXEC

Command Syntax

show mac address-table count [VLANS]

Parameters

VLANS     The VLANs for which the command displays the entry count.
  • no parameter     all configured VLANs.
  • vlan v_num     VLAN interface specified by v_num.

Example

This command displays the number of entries on VLAN 39.
switch> show mac address-table count vlan 39

Mac Entries for Vlan 39:
---------------------------
Dynamic Address Count            : 1
Unicast Static  Address Count    : 1
Multicast Static  Address Count  : 0
Total Mac Addresses              : 2

switch>

show mac address-table mlag-peer

The show mac-address-table mlag-peer command displays the specified MAC address table entries learned from the MLAG peer switch.

Command Mode

EXEC

Command Syntax

show mac address-table mlag-peer [ENTRY_TYPE][MAC_ADDR][INTF_1 ... INTF_N][VLANS]

Parameters
  • ENTRY_TYPE     command filters display by entry type. Entry types include mlag-peer, dynamic, static, unicast, multicast entries, and configured.
    • no parameter     all MLAG peer entries.
    • configured     static entries on MLAG peer; includes unconfigured VLAN entries.
    • dynamic     entries learned on MLAG peer.
    • static    MLAG entries entered by CLI commands and include a configured VLAN.
    • unicast     MLAG entries with unicast MAC address.

  • MAC_ADDR     command uses MAC address to filter displayed entries.
    • no parameter     all MAC addresses table entries.
    • address mac_address     displays entries with specified address (dotted hex notation – H.H.H).

  • INTF_X     command filters display by port list. When parameter lists multiple interfaces, command displays all entries containing at least one listed interface.
    • no parameter     all Ethernet and port channel interfaces.
    • ethernet e_range     Ethernet interfaces specified by e_range.
    • port-channel p_range     Port channel interfaces specified by p_range.

  • VLANS     command filters display by VLAN.
    • no parameter     all VLANs.
    • vlan v_num     VLANs specified by v_num.

show mac address-table multicast

The show mac-address-table command displays the specified multicast MAC address table entries.

Command Mode

EXEC

Command Syntax

show mac address-table multicast [MAC_ADDR][INTF][VLANS]

Parameters
  • MAC_ADDR     command uses MAC address to filter displayed entries.
    • no parameter     all MAC addresses table entries.
    • address mac_address     displays entries with specified address (dotted hex notation – H.H.H).

  • INTF     command filters display by port list. When parameter lists multiple interfaces, command displays all entries containing at least one listed interface.
    • no parameter     all Ethernet and port channel interfaces.
    • ethernet e_range     Ethernet interfaces specified by e_range.
    • port-channel p_range     Port channel interfaces specified by p_range.

  • VLANS     command filters display by VLAN.
    • no parameter     all VLANs.
    • vlan v_num     VLANs specified by v_num.

show mac address-table multicast brief

The show mac-address-table command displays a summary of multicast MAC address table entries.

Command Mode

EXEC

Command Syntax

show mac address-table multicast [VLANS] brief

Parameters

VLANS     command filters display by VLAN.
  • no parameter     all VLANs.
  • vlan v_num     VLANs specified by v_num.

Related Command

show mac address-table multicast.

show monitor server-failure

The show monitor server-failure command displays Rapid Automated Indication of Link-loss (RAIL) configuration settings and the number of servers on each monitored network.

Command Mode

EXEC

Command Syntax

show monitor server-failure

Example

This command displays RAIL configuration status and lists the number of servers that are on each monitored network.
switch> show monitor server-failure
Server-failure monitor is enabled
Proxy service: disabled
Networks being monitored: 3
   10.2.1.96/28      : 0 servers
   10.1.1.0/24       : 0 servers
   10.3.0.0/16       : 3 servers
switch>

show monitor server-failure history

The show monitor server-failure history command displays the time of all link failures detected by Rapid Automated Indication of Link-loss (RAIL) and includes the interface name for each failure.

The history is cleared by removing RAIL from the switch (no monitor server-failure).

Command Mode

EXEC

Command Syntax

show monitor server-failure history

Related Command

clear server-failure servers inactive

Example

This command displays the Fast Server Failure link failure history from the time RAIL is instantiated on the switch.
switch> show monitor server-failure history
Total server failures: 4

Server IP   Server MAC           Interface       Last Failed
----------- -----------------    -----------     -------------------
10.1.67.92  01:22:ab:cd:ee:ff    Ethernet17      2013-02-02 11:26:22
44.11.11.7  ad:3e:5f:dd:64:cf    Ethernet23      2013-02-10 00:07:56
10.1.1.1    01:22:df:42:78:cd    Port-Channel6   2013-02-09 19:36:09
10.1.8.13   01:33:df:ee:39:91    Port-Channel5   2013-02-10 00:03:39

switch>

show monitor server-failure servers

The show monitor server-failure servers command displays status and configuration information about each server that RAIL is monitoring. The display format depends on the parameter specified by the command:
  • single IP address: command displays information about the server at the specified address, including IP address, MAC address, RAIL state, the time of most recent entry of all RAIL states, and the number of failed, proxied, and inactive state entries.

  • no parameter, key specifying a server list: command displays a table. Each row corresponds to a monitored server. Information that the command displays includes IP address, MAC address, RAIL state, the time of most recent link failure.

Command Mode

EXEC

Command Syntax

show monitor server-failure servers [SERVER_LIST]

Parameters

SERVER_LIST     Servers for which command displays information. Valid options include:
  • no parameter     all servers in up, down, and proxying states.
  • ipv4_addr     individual server; command displays detailed information.
  • all     all servers on monitored networks.
  • inactive     all servers in inactive state.
  • proxying     all servers in proxying state.

Examples
  • This command displays RAIL information for the server at IP address 10.11.11.7.
    switch> show monitor server-failure servers 10.11.11.7
    Server information:
    Server Ip Address        : 10.11.11.7
    MAC Address              : ad:3e:5f:dd:64:cf
    Current state            : down
    Interface                : Ethernet23
    Last Discovered          : 2013-01-06 06:47:39
    Last Failed              : 2013-02-10 00:07:56
    Last Proxied             : 2013-02-10 00:08:33
    Last Inactive            : 2013-02-09 23:52:21
    Number of times failed   : 3
    Number of times proxied  : 1
    Number of times inactive : 18
    
    switch>

  • This command displays RAIL data for all servers in monitored networks that are in inactive state.
    switch> show monitor server-failure servers inactive
    Inactive servers: 1
    
    Server IP   Server MAC         Interface    State     Last Failed
    ----------  -----------------  -----------  --------  -------------
    10.1.67.92  01:22:ab:cd:ee:ff  Ethernet17   inactive  7 days, 12:48:06 ago
    
    switch>

  • This command displays RAIL information for all servers in monitored networks that are in up, down, and proxying states.
    switch> show monitor server-failure servers
    Active servers: 4
    
    Server IP   Server MAC            Interface         State        Last Failed
    ----------  -----------------     --------------    ---------    -----------
    44.11.11.7  ad:3e:5f:dd:64:cf     Ethernet23        down         0:03:21 ago
    10.1.1.1    01:22:df:42:78:cd     Port-Channel6     up           4:35:08 ago
    10.1.8.13   01:33:df:ee:39:91     Port-Channel5     proxying     0:07:38 ago
    132.23.23.1 00:11:aa:bb:32:ad     Ethernet1         up           never       
    
    switch>

  • This command displays RAIL information for all servers on configured interfaces.
    switch> show monitor server-failure servers all
    Total servers monitored: 5
    
    Server IP   Server MAC         Interface       State Last Failed
    ----------  -----------------  --------------  ---------  -----------
    10.1.67.92  01:22:ab:cd:ee:ff  Ethernet17      inactive   7 days, 12:47:48 ago
    44.11.11.7  ad:3e:5f:dd:64:cf  Ethernet23      down       0:06:14 ago
    10.1.1.1    01:22:df:42:78:cd  Port-Channel6   up         4:38:01 ago
    10.1.8.13   01:33:df:ee:39:91  Port-Channel5   proxying   0:10:31 ago
    132.23.23.1 00:11:aa:bb:32:ad  Ethernet1       up         never
    
    switch>

show monitor session

The show monitor session command displays the configuration of the specified port mirroring session. The command displays the configuration of all mirroring sessions on the switch when the session name parameter is omitted.

Command Mode

EXEC

Command Syntax

show monitor session SESSION_NAME

Parameters

SESSION_NAME     Port mirroring session identifier. Options include:
  • no parameter     displays configuration for all sessions.
  • label     command displays configuration of the specified session.

Example

This command displays the mirroring configuration of the specified monitor session.
switch> show monitor session redirect_1

Session redirect_1
------------------------

Source Ports

  Both:        Et7

Destination Port: Et8
switch(config)>

show platform trident mirroring

The show platform trident mirroring command displays current parameters of all configured mirroring sessions in Trident series platforms.

Command Mode

Privileged EXEC

Command Syntax

show platform trident mirroring [detail | session]

Parameters
  • detail     displays the detailed information of all configured mirroring sessions.
  • session session_name     displays the information of specified mirroring session.

Guidelines

This command is supported on DCS-7050/7050X, DCS-7250X, and DCS-7300X devices only.

Examples
  • This command displays the detailed information of all configured mirroring sessions.
    switch(config)# show platform trident mirroring detail
    
    Session : 123
    =========================
    
    srcIntf(rx): Ethernet12/3
    Hw Mirror Id: 0x1
    
    IM_MTP_INDEX
    ------------
    count: 1
    Dest: Et15/1
    
    EGR_IM_MTP_INDEX
    ----------------
    DestPort[ 0 ]: Et15/1
     Encap Enable: 0
    
    srcIntf(tx): Ethernet12/3
    Hw Mirror Id: 0x2
    
    EM_MTP_INDEX
    ------------
    count: 1
    Dest: Et15/1
    
    EGR_EM_MTP_INDEX
    ----------------
    DestPort[ 0 ]: Et15/1
    
    Session : abc
    =========================
    
    srcIntf(rx): Ethernet24/2
    Hw Mirror Id: 0x0
    
    IM_MTP_INDEX
    ------------
    count: 1
    Dest: Et24/4
    
    EGR_IM_MTP_INDEX
    ----------------
    DestPort[ 0 ]: Et24/4
     Encap Enable: 0
    
    switch(config)#

  • This command displays the information of session 123.
    switch(config)# show platform trident mirroring session 123
    
    Session         SrcIntf      Acl             DestIntf NextHopMac        OutIntf
    =======         =======      ===             ======== ==========        =======
    123             Et12/3(rx)                   Et15/1
                    Et12/3(tx)                   Et15/1
    
    switch(config)#

show port-channel load-balance

The show port-channel load-balance command displays the traffic distribution between the member ports of the specified port channels. The command displays distribution for unicast, multicast, and broadcast streams.

The distribution values displayed are based on the total interface counters which start from zero at boot time or when the counters are cleared. For more current traffic distribution values, clear the interface counters of the member interfaces using the clear counters command.

Command Mode

EXEC

Command Syntax

show port-channel load-balance [MEMBERS]

Parameters

MEMBERS List of port channels for which information is displayed. Options include:
  • no parameter All configured port channels.
  • c_range Ports in specified channel list (number, number range, or list of numbers and ranges).

Example

This command displays traffic distribution for all configured port channels.
switch> show port-channel load-balance
ChanId Port      Rx-Ucst Tx-Ucst Rx-Mcst Tx-Mcst Rx-Bcst Tx-Bcst
------ --------- ------- ------- ------- ------- ------- -------
8      Et10      100.00% 100.00% 100.00% 100.00% 0.00%   100.00%
------ --------- ------- ------- ------- ------- ------- -------
1      Et1       13.97%  42.37%  47.71%  30.94%  0.43%   99.84%
1      Et2       86.03%  57.63%  52.29%  69.06%  99.57%  0.16%
------ --------- ------- ------- ------- ------- ------- -------
2      Et23      48.27%  50.71%  26.79%  73.22%  0.00%   100.00%
2      Et24      51.73%  49.29%  73.21%  26.78%  0.00%   0.00%
------ --------- ------- ------- ------- ------- ------- -------
4      Et3       55.97%  63.29%  51.32%  73.49%  0.00%   0.00%
4      Et4       44.03%  36.71%  48.68%  26.51%  0.00%   0.00%
------ --------- ------- ------- ------- ------- ------- -------
5      Et19      39.64%  37.71%  50.00%  90.71%  0.00%   0.00%
5      Et20      60.36%  62.29%  50.00%  9.29%   0.00%   100.00%
------ --------- ------- ------- ------- ------- ------- -------
6      Et6       100.00% 100.00% 100.00% 100.00% 0.00%   100.00%
------ --------- ------- ------- ------- ------- ------- -------
7      Et5       100.00% 0.00%   100.00% 100.00% 0.00%   0.00%
switch>

show port-security

The show port-security command displays a summary of MAC address port security configuration and status on each interface where switchport port security is enabled.

Command Mode

EXEC

Command Syntax

show port-security

Display Values

Each column corresponds to one physical interface. The table displays interfaces with port security enabled.
  • Secure Port: Interface with switchport port-security enabled.
  • MaxSecureAddr: Maximum quantity of MAC addresses that the specified port can process.
  • CurrentAddr: Static MAC addresses assigned to the interface.
  • SecurityViolation: Number of frames with unsecured addresses received by port.
  • Security Action: Action triggered by a security violation.

These are the value displayed by the command.
  • Aging Time: Age of Mac address.
  • MAC Moveable: Mac address movement.
  • Port Security: Enabled or disabled status

Examples
  • This command displays switchport port security configuration and status data.
    switch> show port-security
    Secure Port    MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                   (Count)        (Count)      (Count)
    ----------------------------------------------------------------------------
         Et7              5             3            0            Shutdown
         Et10             1             0            0            Shutdown
    ----------------------------------------------------------------------------
    Total Addresses in System: 3
    switch>

  • From EOS Release 4.26.0F, show port-security command displays the settings for the new global port security configurations, including MAC aging, MAC moves, and persistent port security.
    switch(config)# show port-security
    Secure address moves: disabled
    Secure address aging: disabled
    Secure address reboot persistence: enabled
    Secure address link down persistence: enabled
    Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action
                    (Count)       (Count)          (Count)
    ----------------------------------------------------------------------------
    ----------------------------------------------------------------------------
    Total Addresses in System: 0

show port-security interface

The show port-security interface command displays the switchport port-security status of all specified interfaces.

Command Mode

EXEC

Command Syntax

show port-security interface [INT_NAME]

Parameters

INT_NAME     Interface type and numbers. Options include:
  • no parameter     Display information for all interfaces.
  • ethernet e_range      Ethernet interface range specified by e_range.
  • loopback l_range     Loopback interface specified by l_range.
  • management m_range      Management interface range specified by m_range.
  • port-channel p_range      Port-Channel Interface range specified by p_range.
  • vlan v_range      VLAN interface range specified by v_range.
  • VXLAN vx_range     VXLAN interface range specified by vx_range.

    Valid range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command display port-security configuration and status for the specified interfaces.
switch> show port-security interface ethernet 7-8
Interface                  : Ethernet7
Port Security              : Enabled
Port Status                : Secure-down
Violation Mode             : Shutdown
Maximum MAC Addresses      : 5
Aging Time                 : 5 mins
Aging Type                 : Inactivity
SecureStatic Address Aging : Disabled
Total MAC Addresses        : 3
Configured MAC Addresses   : 3
Learn/Move/Age Events      : 5
Last Source Address:Vlan   : 164f.29ae.4e14:10
Last Address Change Time   : 0:39:47 ago
Security Violation Count   : 0
Interface                  : Ethernet8
Port Security              : Disabled
Port Status                : Secure-down
Violation Mode             : Shutdown
Maximum MAC Addresses      : 1
Aging Time                 : 5 mins
Aging Type                 : Inactivity
SecureStatic Address Aging : Disabled
switch>

show port-security mac-address

The show port-security mac-address command display static unicast MAC addresses assigned to interfaces where switchport port security is enabled.

Command Mode

EXEC

Command Syntax

show port-security mac-address

Example

This command displays MAC addresses assigned to port-security protected interfaces.
switch> show port-security mac-address
Secure Mac Address Table
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
                                                              (mins)
----    -----------       ----------------    -----   -------------
  10    164f.29ae.4e14    SecureConfigured     Et7     N/A
  10    164f.29ae.4f11    SecureConfigured     Et7     N/A
  10    164f.320a.3a11    SecureConfigured     Et7     N/A
---------------------------------------------------------------------
Total Mac Addresses for this criterion: 3
switch>

show storm-control

The show storm-control command displays the storm-control level and interface inbound packet capacity for the specified interface.

The configured value (storm-control ) differs from the programmed threshold in that the hardware accounts for Interframe Gaps (IFG) based on the minimum packet size. This command displays the broadcast or multicast rate after this adjustment.

Command Mode

Privileged EXEC

Command Syntax

show storm-control [INT_NAME]

Parameters
  • no parameter     Command returns data for all interfaces configured for storm control.
  • INT_NAME     interface type and port range. Settings include:
    • ethernet e_range     Ethernet interfaces that e_range denotes.
    • port-channel p_range     Port channel interfaces that p_range denotes.

      When storm control commands exist for a port-channel and an Ethernet port that is a member of the port channel, the command for the port-channel takes precedence.

      Valid range formats include number, number range, or comma-delimited list of numbers and ranges.

Example

This command displays the storm control configuration for ethernet port 2 through ethernet port 4.
switch# show storm-control
Port          Type  Level Rate(Mbps)   Status      Drops Reason
Et10/2         all     75       7500   active          0
Et10/3   multicast     55       5500   active          0
Et10/4   broadcast     50       5000   active          0
switch#

show switch forwarding-mode

The show switch forwarding-mode command displays the switch’s current and available forwarding plane hardware modes.

Command Mode

EXEC

Command Syntax

show switch forwarding-mode

Related Command

switch forwarding-mode configures the switch’s forwarding mode setting.

Example

This command changes the switch’s forward mode to store-and-forward, then displays the forwarding mode.
switch(config)# switch forwarding-mode store-and-forward
switch(config)# show switch forwarding-mode
Current switching mode:    store and forward
Available switching modes: cut through, store and forward

show track

The show track command displays information about tracked objects configured on the switch.

Command Mode

EXEC

Command Syntax

show track [OBJECT][INFO_LEVEL]

Parameters
  • OBJECT tracked object for which information is displayed. Options include:
    • no parameter     displays information for all tracked objects configured on the switch.
    • object_name     displays information for the specified object.

  • INFO_LEVEL     amount of information that is displayed. Options include:
    • no parameter     displays complete information including object status, number of status changes, time since last change, and client process tracking the object (if any).
    • brief     displays brief list of all tracked objects and their current status.

Examples
  • This command displays all information for tracked object ETH8.
    switch# show track ETH8
    Tracked object ETH8 is up
       Interface Ethernet8 line-protocol
          4 change, last change time was 0:36:12 ago
       Tracked by:
          Ethernet5/1 vrrp instance 50
    switch#

  • This command displays summary information for all tracked objects.
    switch# show track brief
    Tracked object ETH2 is up
    Tracked object ETH4 is down
    Tracked object ETH6 is up
    Tracked object ETH8 is up
    switch#

shutdown (server-failure configuration mode)

The shutdown command disables Rapid Automated Indication of Link-Loss (RAIL). By default, RAIL is disabled.

After entering server-failure configuration mode, a no shutdown command is required to enable RAIL.

The no shutdown command enables RAIL on the switch. The shutdown and default shutdown commands disable RAIL by removing the shutdown command from running-config.

Command Mode

Server-failure Configuration

Command Syntax

shutdown

no shutdown

default shutdown

Examples
  • This command enables RAIL on the switch.
    switch(config)# monitor server
    switch(config-server-failure)# no shutdown
    switch(config-server-failure)#  show active
    monitor server-failure
       no shutdown
    switch(config-server-failure)#

  • This command disables RAIL on the switch.
    switch(config-server-failure)# shutdown
    switch(config-server-failure)# show active
    monitor server-failure
    switch(config-server-failure)#

storm-control

The storm-control command configures and enables storm control on the configuration mode physical interface. The command provides three mode options:
  • storm-control broadcast broadcast inbound packet control.
  • storm-control multicast multicast inbound packet control.
  • storm-control unknown-unicast unknown unicast inbound packet control.

An interface configuration can contain three storm control statements, one with each mode setting.

The threshold is either a percentage of the available port bandwidth or the number of packets per second (PPS) and is configurable on each interface for each transmission mode.

The no storm-control and default storm-control commands remove the corresponding storm-control statement from running-config, disabling storm control for the specified transmission type on the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Interface-Port-Channel Configuration

Command Syntax

storm-control MODE level { threshold_percent | pps threshold }

no storm-control MODE

default storm-control MODE

Parameters
  • MODE     packet transmission type. Options include:
    • broadcast
    • multicast
    • unknown-unicast

  • threshold_percent     Inbound packet level that triggers storm control, as a percentage of port capacity. Value ranges from 0.01 to 100. Storm control is suppressed by a level of 100.

    The configured value differs from the programmed threshold in that the hardware accounts for InterFrame Gaps (IFG) based on the minimum packet size. The show storm-control command displays the broadcast, multicast, or unknown unicast rate after this adjustment.

  • pps threshold Inbound packet level that triggers storm control, in packets per second. The value ranges from 0 to 1073741823.

Example

These commands enable multicast, broadcast, and unknown unicast storm control on Ethernet port 20 and sets thresholds of 65% (multicast), 50% (broadcast), and 350000 PPS (unknown-unicast). During each one second interval, the interface drops inbound multicast traffic, broadcast traffic, and unknown unicast traffic in excess of the specified thresholds.
switch(config)# interface ethernet 20
switch(config-if-Et20)# storm-control multicast level 65
switch(config-if-Et20)# storm-control broadcast level 50
switch(config-if-Et20)# storm-control unknown-unicast level pps 350000
switch(config-if-Et20)# show active
interface Ethernet20
   storm-control broadcast level 50
   storm-control multicast level 65
   storm-control unknown-unicast level pps 350000
switch(config-if-Et20)#

switch forwarding-mode

The switch forwarding-mode command specifies the mode of the switch's forwarding plane hardware. The default forwarding mode is cut through.

The no switch forwarding-mode and default switch forwarding-mode commands restore the default forwarding mode by removing the switch forwarding-mode command from running-config.

Command Mode

Global Configuration

Command Syntax

switch forwarding-mode MODE_SETTING

no switch forwarding-mode

default switch forwarding-mode

Parameters

MODE_SETTING     Specifies the switch’s forwarding plane hardware mode. Options include:
  • cut-through     the switch begins forwarding frames before their reception is complete.
  • store-and-forward     the switch accumulates entire packets before forwarding them.

Guidelines

The forwarding plane mode is store-and-forward on Petra and Arad platform switches.

Related Command

show switch forwarding-mode displays the current forwarding mode.

Example

This command changes the forwarding mode to store-and-forward.
switch(config)# switch forwarding-mode store-and-forward
switch(config)#

switchport

The switchport command places the configuration mode interface in switched port (Layer 2) mode. Switched ports are configurable as members of one or more VLANs through other switchport commands. Switched ports ignore all IP level configuration commands, including IP address assignments.

The no switchport command places the configuration mode interface in routed port (Layer 3) mode. Routed ports are not members of any VLANs and do not switch or bridge packets. All IP level configuration commands, including IP address assignments, apply directly to the routed port interface.

By default, Ethernet and Port Channel interfaces are in switched port mode. The default switchport command also places the configuration mode interface in switched port mode by removing the corresponding no switchport command from running-config.

These commands only toggle the interface between switched and routed modes. They have no effect on other configuration states.

Command Mode

Interface-Ethernet Configuration

Interface-Port Channel Configuration

Command Syntax

switchport

no switchport

default switchport

Guidelines

When an interface is configured as a routed port, the switch transparently allocates an internal VLAN whose only member is the routed interface. Internal VLANs are created in the range from 1006 to 4094. VLANs that are allocated internally for a routed interface cannot be directly created or configured. The vlan internal order command specifies the method that VLANs are allocated.

All IP-level configuration commands, except autostate and ip virtual-router, can be used to configure a routed interface. Any IP-level configuration changes made to a routed interface are maintained when the interface is toggled to switched port mode.

A LAG that is created with the channel-group command inherits the mode of the member port. A LAG created from a routed port becomes a routed LAG. IP-level configuration statements are not propagated to the LAG from its component members.

Examples
  • These commands put interface ethernet 5 in routed port mode.
    switch(config)# interface ethernet 5
    switch(config-if-Et5)# no switchport
    switch(config-if-Et5)#

  • These commands returns interface ethernet 5 to switched port mode.
    switch(config)# interface ethernet 5
    switch(config-if-Et5)# switchport
    switch(config-if-Et5)#

switchport default mode access

The switchport default mode access command places the configuration mode interface in switched port default access (Layer 3) mode. Switched ports are configurable as members of one or more VLANs through other switchport commands. Switched ports ignore all IP level configuration commands, including IP address assignments.

Command Mode

Global Configuration

Command Syntax

switchport default mode access

Related Command

switchport default mode routed puts a switch with all ports in routed port mode.

Example

This command puts a switch with all ports in access port mode.
switch(config)# switchport default mode access

switchport default mode routed

The switchport default mode routed command places the configuration mode interface in switched port default routed (Layer 3) mode. Switched ports are configurable as members of one or more VLANs through other switchport commands. Switched ports ignore all IP level configuration commands, including IP address assignments.

By default, on a switch with default startup config or no config, all ports come up in access mode. By adding the CLI command switchport default mode routed to kickstart config, all ports will come up in routed mode after boot up. On boot up, Zero Touch Provisioning (ZTP) is enabled by default if the startup config (/mnt/flash/startupconfig) is deleted. ZTP can be disabled by setting DISABLE=True in ZTP config (/mnt/flash/zerotouchconfig). Kickstart config (/mnt/flash/kickstart-config) is used when startup config is missing and ZTP is disabled.

Command Mode

Global Configuration

Command Syntax

switchport default mode routed

Related Command

switchport default mode access puts a switch with all ports in access port mode.

Example

This command puts a switch with all ports in routed port mode.
switch(config)# switchport default mode routed 

switchport mac address learning

The switchport mac address learning command enables MAC address learning for the configuration mode interface. MAC address learning is enabled by default on all Ethernet and port channel interfaces.

The switch maintains a MAC address table for switching frames between VLAN ports. When the switch receives a frame, it associates the MAC address of the transmitting interface with the recipient VLAN and port. When MAC address learning is enabled for the recipient port, the entry is added to the MAC address table. When MAC address learning is not enabled, the entry is not added to the table.

The no switchport mac address learning command disables MAC address learning for the configuration mode interface. The switchport mac address learning and default switchport mac address learning commands enable MAC address learning for the configuration mode interface by deleting the corresponding no switchport mac address learning command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port Channel Configuration

Command Syntax

switchport mac address learning

no switchport mac address learning

default switchport mac address learning

Example

These commands disables MAC address learning for interface ethernet 8, then displays the active configuration for the interface.
switch(config)# interface ethernet 8
switch(config-if-Et8)# no switchport mac address learning
switch(config-if-Et8)# show active
interface Ethernet8
   no switchport mac address learning
switch(config-if-Et8)#

switchport port-security

The switchport port-security command enables MAC address port security on the configuration mode interface. Ports with port security enables restrict traffic to a limited number of hosts, as determined by their MAC addresses. On enabling the switchport port-security command, the port-security mode would be 'shutdown', by default.

The switchport port-security mac-address maximum command specifies the maximum number of MAC addresses. The switchport port-security violation command enables port security in protect mode.

The no switchport port-security and default switchport port-security commands disable port security on the configuration mode interface by removing the corresponding switchport port-security command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port Channel Configuration

Command Syntax

switchport port-security

no switchport port-security

default switchport port-security

Example

These commands enable port security on interface ethernet 7.
switch(config)# interface ethernet 7
switch(config-if-Et7)# switchport port-security
switch(config-if-Et7)#

switchport port-security mac-address maximum

The switchport port-security mac-address maximum command specifies the maximum MAC address limit for the configuration mode interface when configured as a secure port. When port security is enabled, the port accepts traffic and adds source addresses to the MAC table until the maximum is reached. Once the maximum is reached, if any traffic arrives from a source not already in the MAC table for the secure port, the port becomes errdisabled. The switchport port-security command configures an interface as a secure port.

The no switchport port-security mac-address maximum and default switchport port-security mac-address maximum commands restore the maximum MAC address limit of one on the configuration mode interface by removing the corresponding switchport port-security mac-address maximum command from running-config.

Command Mode

Interface-Ethernet Configuration

Interface-Port Channel Configuration

Command Syntax

switchport port-security mac-address maximum max_addr

no switchport port-security mac-address maximum

default switchport port-security mac-address maximum

Parameters

max_addr     maximum number of MAC addresses. Value ranges from 1 to 1000. Default value is 1.

Example

These commands configure a maximum of five incoming addresses for secure interface port-channel 14.
switch(config)# interface port-channel 14
switch(config-if-Po14)# switchport port-security mac-address maximum 5
switch(config-if-Po14)#

switchport port-security violation

The switchport port-security violation command configures port security in protect mode (with the option of enabling logging) or the shutdown mode.

The no switchport port-security and no switchport port-security violation protect log commands disable port security protect mode and port security protect mode logging on the configuration mode interface.

Command Mode

Interface-Ethernet Configuration

Interface-Port Channel Configuration

Command Syntax

switchport port-security violation {protect [log]| shutdown}

no switchport port-security violation protect log

default switchport port-security violation protect log

Parameters
  • protect - Configures the port security in the protect mode.
  • shutdown -Configures the port security in the shutdown mode.
  • log -cthe log of new addresses seen after reaching the limit in the protect mode.

Guidelines

When enabling port security, the port accepts traffic and adds source addresses to the MAC table until reaching the maximum. The switchport port-security command configures an interface as a secure port.

In the protect mode, the ACLs dynamically create to block incoming MAC addresses when reaching the configured maximum MAC value.

In the shutdown mode, once reaching the maximum, if any traffic arrives from a source not in the MAC table for the secure port, the port sets to errdisabled.

Examples
  • These commands configure port security violation protect mode for secure port channel interface 14.
    switch(config)# interface port-channel 14
    switch(config-if-Po14)# switchport port-security violation protect
    switch(config-if-Po14)#

  • These commands configure port security violation protect logging mode for secure port channel interface 14.
    switch(config)# interface port-channel 14
    switch(config-if-Po14)# switchport port-security violation protect log
    switch(config-if-Po14)#

  • These commands configure port security violation shutdown mode for secure port channel interface 15.
    switch(config)# interface port-channel 15
    switch(config-if-Po15)# switchport port-security violation shutdown
    switch(config-if-Po15)#
Note: After reaching the interface limit, a brief window occurs when learned MAC addresses can exceed the limit. After PortSec-Protect disables MAC learning on the interface, EOS removes the excess MAC addresses.

system control-plane

The system control-plane command places the switch in control-plane configuration mode. Control-plane mode is used for assigning an ACL (access control list) to the control plane.

The control-plane configuration mode is not a group change mode; running-config is changed immediately after commands are executed. Exiting control-plane configuration mode does not affect the configuration.

The exit command returns the switch to global configuration mode.

Command Mode

Global Configuration

Command Syntax

system control-plane

Command Available in control-plane Configuration Mode

ip access-group (Control Plane mode)

Examples
  • This command places the switch in the control plane mode.
    switch(config)# system control-plane
    switch(config-system-cp)#

  • This command assigns the control-plane-2 ACL to the control plane.
    switch(config-system-cp)# ip access-group control-plane-2
    switch(config-system-cp)#

  • This command exits the control plane mode.
    switch(config-system-cp)# exit
    switch(config)#

track

The track command creates an object whose state changes to provide information to a client process. The client process must be separately configured for object tracking to have an effect on the switch.

The no track and default track commands remove the specified tracked object by removing the corresponding track command from running-config.

Command Mode

Global Configuration

Command Syntax

track object_name interface INTERFACE_NAME PROPERTY

no track object_name

default track object_name

Parameters
  • object_name     User-created name for the tracked object.
  • INTERFACE_NAME Interface associated with the tracked object. Options include:
    • ethernet e_num     Ethernet interface specified by e_num.
    • loopback l_num     Loopback interface specified by l_num.
    • management m_num     Management interface specified by m_num.
    • port-channel p_num     Port-channel interface specified by p_num.
    • vlan v_num     VLAN interface specified by v_num.
    • VXLAN vx_num     VXLAN interface specified by vx_num.

  • PROPERTY Tracked property. Options include:
    • line-protocol     Object changes when the state of the associated interface changes.

Example

This command creates a tracked object which tracks the state of the line protocol on interface ethernet 8.
switch(config)# track ETH8 interface ethernet 8 line-protocol
switch(config)#

traffic-loopback

The traffic-loopback command is used to create loopbacks to verify the functionality of interfaces and partner links. The source determines whether outgoing traffic is being looped back to the interface (system) to test the interface itself, or incoming traffic is being looped back to the link partner (network) to test the link between the systems. The device determines whether system traffic is looped on the physical level (phy) or Layer-2 level (mac). Only the phy level is available for network traffic.

The no traffic-loopback command deletes the loopback configuration.

Command Mode

Interface Configuration

Command Syntax

traffic-loopback source [system|network] device [phy|mac]

no traffic-loopback

Parameters

  • system loops outgoing traffic back to the interface.
  • network loops incoming traffic back to the link partner.
  • phy implements loopback in the physical layer.
  • mac implements loopback in the MAC layer (available only for system traffic).

Examples
  • These commands cause outgoing traffic on interface ethernet 1 to be looped back to the interface at the MAC level.
    switch(config)# interface ethernet 1
    switch(config-if-Et1)# traffic-loopback source system device mac
    switch(config-if-Et1)#

  • These commands cause incoming traffic on interface ethernet 1 to be looped back to the link partner at the physical level.
    switch(config)# interface ethernet 1
    switch(config-if-Et1)# traffic-loopback source network device phy
    switch(config-if-Et1)#

  • These commands delete the loopback configuration from interface ethernet 1.
    switch(config)# interface ethernet 1
    switch(config-if-Et1)# no traffic-loopback
    switch(config-if-Et1)#